SuSE 11.3 Security Update : Xen (SAT Patch Number 8588)

The Xen hypervisor and tool-suite have been updated to fix security issues and bugs : - XSA-73: A lock order reversal between page allocation and grant table locks could lead to host crashes or even host code execution. CVE-2013-4494 - XSA-74: A lock order reversal between pagealloclock and...

SuSE 11.2 Security Update : Xen (SAT Patch Number 8577)

Xen has been updated to fix a security issue and a bug : - XSA-73: A lock order reversal between page allocation and grant table locks could lead to host crashes or even host code execution. CVE-2013-4494 A non-security bug has also been fixed : - It is possible to start a VM twice on the same no...

Threat Outbreak Alert: Product Purchase Order Request Email Messages on December 10, 2013

Medium Alert ID: 32102 First Published: 2013 December 10 19:42 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain purchase order details and specifications for the recipient. The text in the email message attempts to convin...

Fedora 19 : xen-4.2.3-10.fc19 (2013-22325)

Lock order reversal between pagealloclock and mmrwlock, Hypercalls exposed to privilege rings 1 and 2 of HVM guests, Insufficient TLB flushing in VT-d iommu code Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable ha...

Fedora 18 : xen-4.2.3-10.fc18 (2013-22312)

Lock order reversal between pagealloclock and mmrwlock, Hypercalls exposed to privilege rings 1 and 2 of HVM guests, Insufficient TLB flushing in VT-d iommu code Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable ha...

Small Zhu in the order management system of an injection-vulnerability warning-the black bar safety net

I didn't stop, too busy with work, time although little, but always there is nothing original out, okay 90SEC can often come up around and back into an internship, really scared a jump. Often engage in a shopping station should have encountered such an order management system, a fee system for. 漏...

XDCMS某处平衡权限漏洞可泄漏用户信息

简要描述： XDCMS订餐系统最新版，官方演示站某处平衡权限。 详细说明： XDCMS订餐系统最新版，官方演示站某处平衡权限。 可以查看任意用户订单，包括订单密码等用户敏感信息。 这是用户333333的订单260的信息： 然后登陆另一个用户444444，此用户名可以查看用户333333的订单信息： 再来看看444444用户看到的222号id的订单信息： 由于用户没有控制用户之间的权限问题，导致平衡权限，造成订单遍历。 由于没有刚放演示站的最新版代码，此处不做代码分析。 问题应该出在\system\modules\company\order.php的show函数处。 漏洞证明： 见详细信息...

CVE-2013-6322

Cross-site scripting XSS vulnerability in Sterling Order Management in IBM Sterling Selling and Fulfillment Suite 8.0 before HF128 and 8.5 before HF93 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in Sterling Order Management in IBM Sterling Selling and Fulfillment Suite 8.0 before HF128 and 8.5 before HF93 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-6322

IBM Sterling Order Management (Sterling Selling and Fulfillment Suite) is affected by CVE-2013-6322 as a reflected XSS in 8.0 before HF128 and 8.5 before HF93. The vulnerability allows remote authenticated users to inject scripts/HTML via unspecified vectors, potentially impacting data integrity....

CVE-2013-6322

Cross-site scripting XSS vulnerability in Sterling Order Management in IBM Sterling Selling and Fulfillment Suite 8.0 before HF128 and 8.5 before HF93 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Lock order reversal between page_alloc_lock and mm_rwlock

ISSUE DESCRIPTION The locks pagealloclock and mmrwlock are not always taken in the same order. This raises the possibility of deadlock. The incorrect order occurs only in the implementation of the deprecated domctl hypercall XENDOMCTLgetmemlist. IMPACT A malicious guest administrator may be able ...

Threat Outbreak Alert: Fake Purchase Order Notification Email Messages on November 13, 2013

Medium Alert ID: 31769 First Published: 2013 November 14 17:22 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a purchase order notification for the recipient. The text in the email message attempts to convince the...

Threat Outbreak Alert: Fake Product Purchase Order Email Messages on November 13, 2013

Medium Alert ID: 31750 First Published: 2013 November 13 16:36 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a product order notification for the recipient. The email message attempts to convince the recipient to open...

Out-of-bounds

The SVG implementation in Blink, as used in Google Chrome before 31.0.1650.48, allows remote attackers to cause a denial of service out-of-bounds read by leveraging the use of tree order, rather than transitive dependency order, for layout...

CVE-2013-6623

The SVG implementation in Blink, as used in Google Chrome before 31.0.1650.48, allows remote attackers to cause a denial of service out-of-bounds read by leveraging the use of tree order, rather than transitive dependency order, for layout...

CVE-2013-6623

The SVG implementation in Blink, as used in Google Chrome before 31.0.1650.48, allows remote attackers to cause a denial of service out-of-bounds read by leveraging the use of tree order, rather than transitive dependency order, for layout...

CVE-2013-6623

Removed by vendor...

Threat Outbreak Alert: Fake Product Order Email Messages on November 14, 2013

Medium Alert ID: 31712 First Published: 2013 November 11 19:47 GMT Last Updated: 2013 November 15 16:11 GMT Version: 3 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a product order notification for the recipient. The text in the emai...

Fedora 20 : xen-4.3.1-1.fc20 (2013-20517)

update to xen-4.3.1, Lock order reversal between page allocation and grant table lock ocaml xenstored mishandles oversized message replies systemd changes to allow oxenstored to be used instead of xenstored Note that Tenable Network Security has extracted the preceding description block directly...