openSUSE Security Update : lxsession (openSUSE-SU-2010:0426-1)

lxsession-logout did not properly lock the screen before suspending, hibernating and switching between users which could allow attackers with physical access to take control of the system to obtain sensitive information and / or execute arbitrary code in the context of the user who is currently...

Inception - Attacking FireWire Devices

Inception is a FireWire physical memory manipulation and hacking tool exploiting IEEE 1394 SBP-2 DMA. The tool can unlock any password accepted and escalate privileges to Administrator/root on almost any powered on machine you have physical access to. The tool can attack over FireWire, Thunderbol...

CVE-2013-5464

IBM Maximo Asset Management 7.5.x before 7.5.0.3 IFIX027, 7.5.0.4 before IFIX011, and 7.5.0.5 before IFIX006 and SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2 allow remote authenticated users to bypass intended access restrictions, and modify physical counts associated wit...

Design/Logic Flaw

IBM Maximo Asset Management 7.5.x before 7.5.0.3 IFIX027, 7.5.0.4 before IFIX011, and 7.5.0.5 before IFIX006 and SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2 allow remote authenticated users to bypass intended access restrictions, and modify physical counts associated wit...

CVE-2013-5464

CVE-2013-5464 affects IBM Maximo Asset Management 7.5.x (various subversions) and SmartCloud Control Desk 7.x. The issue allows remote authenticated users to bypass access restrictions and modify physical counts in restricted storerooms via unspecified vectors. IBM references APARs IV46277, IV465...

U-mail 最新版漏洞大阅兵(信息泄露，多个getshell，多处SQL注入漏洞，远程代码执行)

简要描述： 疯狗、 xsser finger求打雷 详细说明： 注：一个getshell重复 http://wooyun.org/bugs/wooyun-2014-059954 疯狗、 xsser finger求打雷 1、 信息泄露 phpinfo信息泄露 http://www.xxx.com/webmail/client/mail/index.php?module=test&action=info phpinfo信息泄露 其中源码如下：WorldClient\html\client\mail\module\info.php if !defined "PRELOADOK" exit...

Authentication flaw

pyxtrlock before 0.1 uses an incorrect variable name, which allows physically proximate attackers to bypass the lock screen via multiple failed authentication attempts, which trigger a crash...

CVE-2013-4427

CVE-2013-4427 affects pyxtrlock before 0.2. The vulnerability arises because the program does not properly check the return values of xcb_grab_pointer and xcb_grab_keyboard, allowing physically proximate attackers to gain access to the keyboard or mouse without unlocking the screen via unspecifie...

CVE-2013-4427

pyxtrlock before 0.2 does not properly check the return values of the 1 xcbgrabpointer and 2 xcbgrabkeyboard XCB library functions, which allows physically proximate attackers to gain access to the keyboard or mouse without unlocking the screen via unspecified vectors...

CVE-2014-3202

Unity before 7.2.1 does not properly handle entry activation, which allows physically proximate attackers to bypass the lock screen by holding the ENTER key, which triggers the process to crash...

CVE-2013-7221

The automatic screen lock functionality in GNOME Shell aka gnome-shell before 3.10 does not prevent access to the "Enter a Command" dialog, which allows physically proximate attackers to execute arbitrary commands by leveraging an unattended workstation...

UBUNTU-CVE-2013-7221

The automatic screen lock functionality in GNOME Shell aka gnome-shell before 3.10 does not prevent access to the "Enter a Command" dialog, which allows physically proximate attackers to execute arbitrary commands by leveraging an unattended workstation...

kernel security update

CentOS Errata and Security Advisory CESA-2014:0433 Updated kernel packages that fix two security issues, three bugs, and add one enhancement are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common...

Deserialization of untrusted data

Power Management in Apple OS X 10.9.x through 10.9.2 allows physically proximate attackers to bypass an intended transition into the locked-screen state by touching 1 a key or 2 the trackpad during a lid-close action...

CVE-2014-1321

Power Management in Apple OS X 10.9.x through 10.9.2 allows physically proximate attackers to bypass an intended transition into the locked-screen state by touching 1 a key or 2 the trackpad during a lid-close action...

RedHat Update for kernel RHSA-2014:0328-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MS-DOS: Permanent Denial of Service

Steps to Reproduce: 1. Install MS DOS 2.0 on a computer 2. Start your car and run it over that computer. 3. Now MS DOS would not start. Possible Fix: MSDOS owners shouldn't own a car for sake of proper functioning of the operating system I've attached proof of concept...

Default credentials

The login page aka index.php in ownCloud before 5.0.6 does not disable the autocomplete setting for the password parameter, which makes it easier for physically proximate attackers to guess the password...

CVE-2013-2047

The login page aka index.php in ownCloud before 5.0.6 does not disable the autocomplete setting for the password parameter, which makes it easier for physically proximate attackers to guess the password...

Memory corruption

USB Host in Apple iOS before 7.1 and Apple TV before 6.1 allows physically proximate attackers to execute arbitrary code or cause a denial of service memory corruption via crafted USB messages...