shopify-scripts: sprintf gem - format string combined attack

In the sprintf gem, NOT included in mruby-engine, there are severe vulnerabilities, including information leak, and heap buffer overflow. Here are the technical details. Technical Error 1: ============== The CHECKl macro can sometimes receive negative values, that will bypass the size checks, sin...

[CVE-2015-2926] XSS vuln in phpTrafficA

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Product: phpTrafficA Product page: http://soft.zoneo.net/phpTrafficA/ Affected versions: Up to and including 2.3 latest as of writing. Description: The user agent string provided by the browser is not sanitized nor escaped when handled. This string ...

CVE-2014-8086

Race condition in the ext4filewriteiter function in fs/ext4/file.c in the Linux kernel through 3.17 allows local users to cause a denial of service file unavailability via a combination of a write action and an FSETFL fcntl operation for the ODIRECT flag...

Cisco Grand Challenge to Fix Internet of Things Security

As seemingly every new gadget and electronic device is coming retrofitted with an Internet connection these days – appliances, cars and medical devices a few chief examples, the floodgates have opened ever wider for an alarming number of new attack vectors. The burgeoning evolution of “Internet o...

CVE-2013-6424

Integer underflow in the xTrapezoidValid macro in render/picture.h in X.Org allows context-dependent attackers to cause a denial of service crash via a negative bottom value...

CVE-2013-1914

Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C Library aka glibc or libc6 2.17 and earlier allows remote attackers to cause a denial of service crash via a 1 hostname or 2 IP address that triggers a large number of domain conversion results...

Fedora Update for gnutls FEDORA-2013-2984

Check for the Version of gnutls OpenVAS Vulnerability Test Fedora Update for gnutls FEDORA-2013-2984 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the term...

Fedora Update for gnupg FEDORA-2013-0477

Check for the Version of gnupg OpenVAS Vulnerability Test Fedora Update for gnupg FEDORA-2013-0477 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms ...

Fedora Update for gnutls FEDORA-2012-4569

Check for the Version of gnutls OpenVAS Vulnerability Test Fedora Update for gnutls FEDORA-2012-4569 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the term...

Zen-Cart 1.3.9h Cross Site Request Forgery

Advisory Information Title: Zen-Cart Admin CSRF/XSRF - Delete / Disable Products Date published: 2012-02-10 01:59:45 AM upSploit Ref: UPS-2011-0018 CVE REF: CVE-2011-4403 Advisory Summary An attacker can force an administrator to delete or disable products from within his store. Vendor Zen-Cart...

Suggested The Linux 3.1 Kernel logo

Suggested The Linux 3.1 Kernel logo This new logo was proposed just this weekend and the current discussion to see whether it will be accepted for Linux 3.1 can be found in this LKML thread. To mark the upcoming release of the Linux 3.1 kernel IBM's Darrick Wong has proposed changing the familiar...

Suggested The Linux 3.1 Kernel logo

Suggested The Linux 3.1 Kernel logo This new logo was proposed just this weekend and the current discussion to see whether it will be accepted for Linux 3.1 can be found in this LKML thread. To mark the upcoming release of the Linux 3.1 kernel IBM's Darrick Wong has proposed changing the familiar...

Debian DSA-1895-1 : xmltooling - several vulnerabilities

Several vulnerabilities have been discovered in the xmltooling packages, as used by Shibboleth : - Chris Ries discovered that decoding a crafted URL leads to a crash and potentially, arbitrary code execution. - Ian Young discovered that embedded NUL characters in certificate names were not...

Debian Security Advisory DSA 1155-2 (sendmail)

The remote host is missing an update to sendmail announced via advisory DSA 1155-2. It turned out that the sendmail binary depends on libsasl2 = 2.1.19.dfsg1 which is neither available in the stable nor in the the security archive. This version is scheduled for the inclusion in the next update of...

[SECURITY] [DSA 1155-2] New sendmail packages fix denial of service

-------------------------------------------------------------------------- Debian Security Advisory DSA 1155-2 [email protected] http://www.debian.org/security/ Martin Schulze August 24th, 2006 http://www.debian.org/security/faq -...

Instaboard 1.3 SQL Injection

Affected Product: NetPleasure's Instaboard 1.3 www.netpleasure.com/instaboard/ Venerability: Multiple SQL Injection Vunerabilities. http://server/instaboard/index.cfm?frmid=120AND20u.userid20IN20select20userid20from20users http://server/instaboard/index.cfm?frmid=1&tpcid=120SQL...

wwwthreads-5.5.txt

---------- Forwarded message ---------- Date: 30 Jan 2002 22:12:17 -0000 From: Root Extractor To: [email protected] Subject: WWWThreads, UBBThreads Security Hole in upload system WWWThreads, UBBThreads Security Hole in upload system Author: RootExtractor, CompuMe [email protected],...

Vulnerability in Poll_It cgi v2.0

This has already been sent to securityfocus.com and cgi-world.com. It is now listed at securityfocus.com at http://www.securityfocus.com/bid/1431. Original email that I sent is below: The CGI is available from: http://www.cgi-world.com/pollit.html The bug takes place when calling the CGI and...