Explained: the cloud

Even if you are reading this post because you have no idea what the cloud is, you might be using it more often than you realize. Twitter, LinkedIn, Dropbox, Google Drive, and Microsoft Office 365 are some of the most well-known cloud apps. Let’s start with a definition of the cloud to get a grip ...

Buffer Overflow Vulnerability in Youku PC Player

Youku PC Player is a video player for Youku.com. YoukuNplayer.exe is vulnerable to a buffer overflow vulnerability when parsing special vod files. An attacker exploiting this vulnerability could cause a denial of service or execute arbitrary code...

OpenJDK: DSA implementation timing attack (JCE, 8175106)

A covert timing channel flaw was found in the DSA implementation in the JCE component of OpenJDK. A remote attacker able to make a Java application generate DSA signatures on demand could possibly use this flaw to extract certain information about the used key via a timing side channel...

CVE-2017-1381

IBM WebSphere Application Server Proxy Server or On-demand-router ODR 7.0, 8.0, 8.5, 9.0 and could allow a local attacker to obtain sensitive information, caused by stale data being cached and then served. IBM X-Force ID: 127152...

Design/Logic Flaw

IBM WebSphere Application Server Proxy Server or On-demand-router ODR 7.0, 8.0, 8.5, 9.0 and could allow a local attacker to obtain sensitive information, caused by stale data being cached and then served. IBM X-Force ID: 127152...

CVE-2017-1381

IBM WebSphere Application Server Proxy Server or On-demand-router ODR 7.0, 8.0, 8.5, 9.0 and could allow a local attacker to obtain sensitive information, caused by stale data being cached and then served. IBM X-Force ID: 127152...

XSS Vulnerability in Shenzhen Siliconware Sewise VOD Server System

wise on-demand server software is server-side distribution software that provides streaming playback of audio and video files. There is an XSS vulnerability in sewise VOD server system of Shenzhen Siliconware Technology. An attacker can exploit the vulnerability to obtain sensitive information su...

[SECURITY] Fedora 26 Update: systemd-233-4.fc26

systemd is a system and service manager that runs as PID 1 and starts the rest of the system. It provides aggressive parallelization capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, keeps track of processes using Linux control groups,...

World On Demand TV - Customized SSL, Dangerous filesystem permissions, Exported ContentProvider vulnerabilities

HackApp vulnerability scanner discovered that application World On Demand TV published at the 'play' market has multiple vulnerabilities...

CVE-2017-5149

An issue was discovered in St. Jude Medical Merlin@home, versions prior to Version 8.2.2 RF models: EX1150; Inductive models: EX1100; and Inductive models: EX1100 with MerlinOnDemand capability. The identities of the endpoints for the communication channel between the transmitter and St. Jude...

Bill Calls for Study of Cybersecurity Standards for Cars

A House bill was introduced Tuesday that could accelerate the federal government’s involvement in regulating automobile cybersecurity. The Security and Privacy in Your Car Study Act of 2017, authored by Reps. Ted Lieu D-Calif. and Joe Wilson R-SC, calls on the National Highway Traffic Safety...

ORF TVthek: Video on demand - Customized SSL, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application ORF TVthek: Video on demand published at the 'play' market has multiple vulnerabilities...

SA110 : Java Deserialization Vulnerabilities

SUMMARY Blue Coat products that deserialize unsafe Java objects from untrusted sources are susceptible to one or more vulnerabilities. A remote attacker can exploit these vulnerabilities to cause the target to execute arbitrary code. AFFECTED PRODUCTS Cloud Data Protection for Salesforce CDP-SFDC...

IBM Host On-Demand Cross-Site Scripting Vulnerability

IBM Host On-Demand is a suite of terminal emulator applications for Java emulation that provides secure browser-based access to host applications and data through browser-based emulation and supports the rapid creation of customized Web applications using the Java toolset, among other things. A...

CVE-2015-5002

Cross-site scripting XSS vulnerability in IBM Host On-Demand 11.0 through 11.0.14 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM Host On-Demand 11.0 through 11.0.14 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2015-5002

Cross-site scripting XSS vulnerability in IBM Host On-Demand 11.0 through 11.0.14 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2015-5002

IBM Host On-Demand (11.0–11.0.14) is affected by a DOM XSS in the administrative interface caused by improper input validation. A remote attacker can trigger script execution via a crafted URL, potentially compromising user sessions. Remediation: upgrade to Host On-Demand 11.0.14 (special build) ...

FreeBSD : xen-kernel -- Long latency populate-on-demand operation is not preemptible (83350009-881e-11e5-ab94-002590263bf5)

The Xen Project reports : When running an HVM domain in Populate-on-Demand mode, Xen would sometimes search the domain for memory to reclaim, in response to demands for population of other pages in the same domain. This search runs without preemption. The guest can, by suitable arrangement of its...

Xen Denial of Service Vulnerability (CNVD-2015-07245)

Xen is an open source virtual machine monitor product developed at the University of Cambridge in the United Kingdom. A security vulnerability exists in the 'libxlbuildpost' function in the tools/libxl/libxldom.c file and in the 'libxlsetmemory target' functions, due to a security flaw in the...