Cisco Releases Security Updates

Cisco has released security updates to address vulnerabilities in Wireless LAN Controller software, Identity Services Engine software, and Aironet 1800 Series Access Points. Exploitation of some of these vulnerabilities could allow a remote attacker to take control of an affected device. US-CERT...

金蝶某系统存在任意文件上传漏洞可威胁内网

简要描述： 上传绕过，可内网才是关键 详细说明： WooYun: 某大型在线考试系统通用型任意文件上传（涉及银行、证卷等企业） 问题发生后，是有进行相应的修补，但修补的有问题，限制了对jsp马的上传，但jspx毫无限制 上传jsp直接报错 但是jspx就 http://exam.kingdee.com/mana/edit/attachupload.jsp 可直接上传jspx马 上传成功后直接查看源代码获取shell地址 漏洞证明：...

Dynamic Shellcode Injection: Shellter

Shellter is a dynamic shellcode injection tool, and probably the first dynamic PE infector ever created. It can be used in order to inject shellcode into native Windows applications currently 32-bit apps only. The shellcode can be something yours or something generated through a framework, such a...

CentOS 7 : ntp (CESA-2015:2231)

Updated ntp packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give...

ntp, ntpdate, sntp security update

CentOS Errata and Security Advisory CESA-2015:2231 Updated ntp packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common...

PNG image processing library libpng exposed vulnerability-a vulnerability warning-the black bar safety net

! According to the report: image processing library libpng recently exposed vulnerabilities, currently has a preliminary fix vulnerabilities. Currently the main problem is the libpng the popularity of the range is too wide: operating systemthe browser any with generating a thumbnail associated...

RHEL 7 : ntp (RHSA-2015:2231)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:2231 advisory. The Network Time Protocol NTP is used to synchronize a computer's time with another referenced time source. These packages include the ntpd...

DEBIAN-CVE-2015-7940

The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman ECDH key exchanges, aka an "invalid curve attack."...

RealtyScript 4.0.2 SQL Injection

RealtyScript v4.0.2 Multiple Time-based Blind SQL Injection Vulnerabilities Vendor: Next Click Ventures Product web page: http://www.realtyscript.com Affected version: 4.0.2 Summary: RealtyScript is award-winning real estate software that makes it effortless for a real estate agent, office, or...

RealtyScript 4.0.2 - Multiple Blind SQL Injections

RealtyScript 4.0.2 - Multiple Blind SQL Injections RealtyScript v4.0.2 Multiple Time-based Blind SQL Injection Vulnerabilities Vendor: Next Click Ventures Product web page: http://www.realtyscript.com Affected version: 4.0.2 Summary: RealtyScript is award-winning real estate software that makes...

Microsoft Windows 10 - Sandboxed Mount Reparse Point Creation Mitigation Bypass (MS15-111)

Microsoft Windows 10 - Sandboxed Mount Reparse Point Creation Mitigation Bypass MS15-111 Source: https://code.google.com/p/google-security-research/issues/detail?id=486 Windows: Sandboxed Mount Reparse Point Creation Mitigation Bypass Platform: Windows 10 build 10240, earlier versions do not have...

Microsoft Windows 10 - Sandboxed Mount Reparse Point Creation Mitigation Bypass (MS15-111)

Source: https://code.google.com/p/google-security-research/issues/detail?id=486 Windows: Sandboxed Mount Reparse Point Creation Mitigation Bypass Platform: Windows 10 build 10240, earlier versions do not have the functionality Class: Security Feature Bypass Summary: A mitigation added to Windows ...

Design/Logic Flaw

Cisco Aironet 1850 access points with software 8.1112.4 allow local users to gain privileges via crafted CLI commands, aka Bug ID CSCuv79694...

CVE-2015-6315

The CVE-2015-6315 issue affects Cisco Aironet 1850 Series Access Points running software 8.1(112.4). A local privilege-escalation vulnerability exists in the CLI, caused by insufficient escape protections when validating commands, allowing an authenticated, local attacker to gain root-level privi...

Adobe Reader Arbitrary File Deletion Sandbox Escape Vulnerability

This vulnerability allows local attackers to delete arbitrary files on vulnerable installations of Adobe Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...

MS15-111: Security Update for Windows Kernel to Address Elevation of Privilege (3096447)

The remote Windows host is affected by the following vulnerabilities : - Multiple elevation of privilege vulnerabilities exist in the Windows kernel due to improper handling of objects in memory. A local attacker can exploit these vulnerabilities, via a specially crafted application, to execute...

CVE-2015-6315

Cisco Aironet 1850 access points with software 8.1112.4 allow local users to gain privileges via crafted CLI commands, aka Bug ID CSCuv79694...

KLA10674 Multiple vulnerabilities in Microsoft Windows

Multiple serious vulnerabilities have been found in Microsoft Windows. Malicious users can exploit these vulnerabilities to bypass security restrictions, gain privileges, execute arbitrary code or obtain sensitive information. Below is a complete list of vulnerabilities 1. Improper information...

PHP arbitrary class instantiation in "files_external" - ownCloud

A user may instantiate arbitrary ownCloud classes due to a lack of a proper check of the mount point options provided by a user via the web front end. These may include constructor arguments and could potentially lead to a remote code execution. Affected Software ownCloud Server 8.1.2 CVE-2015-76...

Ubuntu: Security Advisory (USN-2727-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...