CVE-2013-4544

hw/net/vmxnet3.c in QEMU 2.0.0-rc0, 1.7.1, and earlier allows local guest users to cause a denial of service or possibly execute arbitrary code via vectors related to 1 RX or 2 TX queue numbers or 3 interrupt indices. NOTE: some of these details are obtained from third party information...

Vtiger - 'Install' Remote Command Execution (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Vtiger Install Unauthenticated Remote Command Execution', 'Description' = %q This module exploits an arbitrary command execution...

CVE-2014-1896

The 1 dosend and 2 dorecv functions in io.c in libvchan in Xen 4.2.x, 4.3.x, and 4.4-RC series allows local guests to cause a denial of service or possibly gain privileges via crafted xenstore ring indexes, which triggers a "read or write past the end of the ring."...

stunnel < 5.00 PRNG State Security Weakness

The version of stunnel installed on the remote host is prior to version 5.00. It is, therefore, affected by a security weakness due to the PRNG state not being reset for new connections where the server forks. A remote attacker can exploit this issue to disclose sensitive information, such as the...

PT-2014-3918

Name of the Vulnerable Software and Affected Versions IBM Lotus Protector for Mail Security versions 2.8.x through 2.8.1-22904 Description A cross-site scripting XSS issue exists in the Admin Web UI, allowing remote authenticated users to inject arbitrary web script or HTML. This can be achieved...

PT-2014-3931

Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.1.1 before SP10 IBM AIX versions 7.1.2 before SP5 Description The issue allows remote authenticated users to bypass intended permission settings and modify arbitrary files via FTP commands when a Workload Partition for AIX 5...

2 on 1 7-day Alipay the balance of treasure once again broke a major security vulnerability-vulnerability warning-the black bar safety net

Internet Security Alert on the platform a titled Taobao certification defects can login any Taobao account and Alipay me of the balance of treasure sprinkle of Vulnerability in one shot, one time each BBS, Weibo, wechat, QQ group to expand the fiery discussion, many people expressed concern about...

MariaDB多个拒绝服务漏洞

MariaDB基于事务的Maria存储引擎，替换了MySQL的MyISAM存储引擎，它使用了Percona的 XtraDB，InnoDB的变体，分支的开发者希望提供访问即将到来的MySQL 5.4 InnoDB性能。 1），当处理某些编写有子查询的SELECT语句时的空指针引用错误，可以被利用来导致系统崩溃。 成功利用此漏洞，需要在"materialization"和"semijoin"优化切换到打开时。 2） 处理有某些并发的SQL查询的KILL查询语句时的错误，可被利用来导致系统崩溃。 3）分析NAMECONST表达式时包含AND/OR表达式，可以被利用来导致系统崩溃。...

MariaDB Server 5.5.x < 5.5.36 Remote Multiple Denial of Service Vulnerabilities

Binary data 8132.prm...

CVE-2011-0528: Undefined Security Weakness

Puppet 2.6.0 through 2.6.3 does not properly restrict access to node resources, which allows remote authenticated Puppet nodes to read or modify the resources of other nodes via unspecified vectors...

CVE-2013-6728: Undefined Security Weakness

The charting component in IBM WebSphere Dashboard Framework WDF 6.1.5 and 7.0.1 allows remote attackers to view or delete image files by leveraging incorrect security constraints for a temporary directory...

Solaris 9 (sparc) : 113335-05

Vulnerability in the Solaris component of Oracle and Sun Systems Products Suite subcomponent: Filesystem. Supported versions that are affected are 8 and 9. Easily exploitable vulnerability requiring logon to Operating System. Successful attack of this vulnerability can result in unauthorized...

Microsoft Office Web Apps Remote Code Execution vulnerability (2904244)

This host is missing an important security update according to Microsoft Bulletin MS13-100. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE...

Dredge School Administration System - DSMloader.php Account Information Disclosure

Dredge School Administration System - DSMloader.php Account Information Disclosure source: https://www.securityfocus.com/bid/64720/info Dredge School Administration System is prone to the following security vulnerabilities: 1. An SQL-injection vulnerability 2. A cross-site request forgery...

CVE-2013-3667

The software update mechanism as used in Bare Bones Software Yojimbo before 4.0, TextWrangler before 4.5.3, and BBEdit before 10.5.5 does not properly download and verify updates before installation, which allows attackers to perform "tampering or corruption" of the updates...

CVE-2013-3667

The software update mechanism as used in Bare Bones Software Yojimbo before 4.0, TextWrangler before 4.5.3, and BBEdit before 10.5.5 does not properly download and verify updates before installation, which allows attackers to perform "tampering or corruption" of the updates...

CVE-2013-4554: Undefined Security Weakness

Xen 3.0.3 through 4.1.x possibly 4.1.6.1, 4.2.x possibly 4.2.3, and 4.3.x possibly 4.3.1 does not properly prevent access to hypercalls, which allows local guest users to gain privileges via a crafted application running in ring 1 or 2...

PT-2013-4779

Name of the Vulnerable Software and Affected Versions IBM Cognos Command Center versions prior to 10.2 Description The issue concerns multiple cross-site request forgery CSRF vulnerabilities. These vulnerabilities allow remote attackers to hijack the authentication of administrators for requests...

openSUSE: Security Advisory for Mozilla Firefox and others (openSUSE-SU-2013:0631-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2013-4956: Undefined Security Weakness

Puppet Module Tool PMT, as used in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, installs modules with weak permissions if those permissions were used when the modules were originally built, which might allow local users to rea...