Fedora 17 : python-pip-1.3.1-4.fc17 (2013-13213)

Fix potential DOS with specially crafted malicious SSL certs. Backing out rename of pip binary to fix 958377 and updating package summary to match upstream's description. Backing out rename of pip binary to fix 958377 and updating package summary to match upstream's description. Note that Tenable...

Fedora 19 : python-pip-1.3.1-4.fc19 (2013-13216)

Fix potential DOS with specially crafted malicious SSL certs. Backing out rename of pip binary to fix 958377 and updating package summary to match upstream's description. Backing out rename of pip binary to fix 958377 and updating package summary to match upstream's description. Note that Tenable...

Fedora 19 : kde-workspace-4.10.5-3.fc19 (2013-13098)

This update addresses 2 issues : - backport systray icons memleak fix http://bugs.kde.org/314919 - backport potential kcheckpass security issue http://git.reviewboard.kde.org/r/111261 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora securit...

Fedora 19 : libXvMC-1.0.8-1.fc19 (2013-12593)

Update to 1.0.8, fixes potential strncpy overflow Update to latest git to fix the following CVEs: CVE-2013-1999 CVE-2013-1990 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean a...

Oracle Linux 4 : kernel (ELSA-2007-0014)

From Red Hat Security Advisory 2007:0014 : Updated kernel packages that fix several security issues in the Red Hat Enterprise Linux 4 kernel are now available. This security advisory has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles...

ShopEx最新版多处SQL注射

简要描述： 不知道我有不有搞错，但已经尽量下载了最新版了。。。 在很多地方测试都存在。。。 ShopEx最新版多处SQL注射 详细说明： 我很怀疑自己是不是搞错呢。。。 注射1： http://127.0.0.1:5656/shopex/api.php POST act=searchsubregions&apiversion=1.0&returndata=string&pregionid=22 and select 1 fromselect count,concat0x7c,select Select version from informationschema.tables limit...

ICU: Layout Engine font layout and glyph table errors (JDK 2D, 8004994)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors relate...

FreeBSD : OpenVPN -- potential side-channel/timing attack when comparing HMACs (92f30415-9935-11e2-ad4c-080027ef73ec)

The OpenVPN project reports : OpenVPN 2.3.0 and earlier running in UDP mode are subject to chosen ciphertext injection due to a non-constant-time HMAC comparison function. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted fr...

SynConnect 2.0 the presence of SQL injection vulnerabilities-vulnerability warning-the black bar safety net

SynConnect in the loginid parameter in the presence ofSQL injectionvulnerability that stems from the program using SQL before the query is not adequately verify user-supplied input. An attacker exploit the vulnerability to manipulate the application, access or modify data, or the use of the...

OpenVPN -- potential side-channel/timing attack when comparing HMACs

The OpenVPN project reports: OpenVPN 2.3.0 and earlier running in UDP mode are subject to chosen ciphertext injection due to a non-constant-time HMAC comparison function...

Potential Information Disclosure and Insufficient Entropy vulnerabilities in Zend\Math\Rand and Zend\Validate\Csrf Components

More info at https://framework.zend.com/security/advisory/ZF2013-02...

phpMyRecipes - Multiple HTML Injection Vulnerabilities

source: https://www.securityfocus.com/bid/58160/info phpMyRecipes is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input. Attacker-supplied HTML and script code could be executed in the context of the affected site, potentially allowing the...

dovecot security and bug fix update

1:2.0.9-5 - script-login did not drop privileges correctly 709095 - fix directory traversal due to not obeying chroot directive 709097 - check proxy destination host against SSL certificate name 754980 1:2.0.9-4 - dovecot may not set correct premissions for mail folder 697620 1:2.0.9-3 - fix...

AdaptCMS 2.0.4 - config.php?question SQL Injection

AdaptCMS 2.0.4 - config.php?question SQL Injection Exploit Title: AdaptCMS = 2.0.4 SQL Injection vulnerability Date: 26/10/2012 Exploit Author: Kallimero Vendor Homepage: http://www.adaptcms.com/ Software Link: http://www.insanevisions.com/page/3/Downloads/ Version: 2.0.4 Tested on: Debian...

DHS Secretary Warns of Potential Cyber Attacks

There is no shortage of problems for President Obama and the new Congress to tackle as they settle into their offices in Washington, D.C., this week, and one of the topics that’s at the top of that list is cybersecurity. Earlier this week a group of Democratic senators introduced a new...

SuSE 11.2 Security Update : PHP5 (SAT Patch Number 6634)

Three security bugs have been fixed in PHP5. - php5: potential overflow in phpstreamscandir. CVE-2012-2688 - openbasedir bypass via SQLite extension. CVE-2012-3365 - An out of band read sql denial of service has been fixed bnc769785. CVE-2012-3450 %NASLMINLEVEL 70300 C Tenable Network Security,...

Use-after-free when displaying table with many columns and column groups — Mozilla

Using the Address Sanitizer tool, security researcher Atte Kettunen from OUSPG discovered that the combination of large numbers of columns and column groups in a table could cause the array containing the columns during rendering to overwrite itself. This can lead to a user-after-free causing a...

ECShop V2. 7. 3 GBK release1106 injection 0day and fix-vulnerability warning-the black bar safety net

C0deplay Team j8g Look at the code / Modify personal information / elseif $action == ‘acteditprofile’ the includeonceROOTPATH . ‘includes/libtransaction.php’; $birthday = trim$POST'birthdayYear' .’-’. trim$POST'birthdayMonth' .’-’. trim$POST'birthdayDay'; $email = trim$POST'email'; $other'msn' =...

linux-flashplugin -- multiple vulnerabilities

Adobe reports: These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system...

Google Sheds Light on New Android App Scanner

Google has divulged more information about its forthcoming application verifier for the Android operating system. The feature is being rolled out over the air alongside the latest build of the OS, Jelly Bean 4.2, on Nexus 7 and Galaxy Nexus devices as of yesterday. While it can be disabled, the a...