MS15-022: Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (3038999)

The remote Windows host has a version of Microsoft Office, Office Compatibility Pack, Microsoft Word Viewer, Microsoft Excel Viewer, SharePoint Server, or Microsoft Office Web Apps that is affected by multiple vulnerabilities : - Multiple remote code execution vulnerabilities exist due to...

Cisco Unified Web Interaction Manager Cross-Site Scripting Vulnerability

A vulnerability in Cisco Unified Web Interaction Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against the user of the web interface of the affected system. The vulnerability is due to a lack of input sanitization of the Cisco Unified Web...

Double free

The krb5gssprocesscontexttoken function in lib/gssapi/krb5/processcontexttoken.c in the libgssapikrb5 library in MIT Kerberos 5 aka krb5 through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly maintain security-context handles, which allows remote authenticated users to...

CVE-2014-5352

The krb5gssprocesscontexttoken function in lib/gssapi/krb5/processcontexttoken.c in the libgssapikrb5 library in MIT Kerberos 5 aka krb5 through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly maintain security-context handles, which allows remote authenticated users to...

CVE-2014-5352

The krb5gssprocesscontexttoken function in lib/gssapi/krb5/processcontexttoken.c in the libgssapikrb5 library in MIT Kerberos 5 aka krb5 through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly maintain security-context handles, which allows remote authenticated users to...

CVE-2014-5352

The krb5gssprocesscontexttoken function in lib/gssapi/krb5/processcontexttoken.c in the libgssapikrb5 library in MIT Kerberos 5 aka krb5 through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly maintain security-context handles, which allows remote authenticated users to...

CVE-2014-5352

Summary: CVE-2014-5352 affects MIT Kerberos libgssapi_krb5 (krb5) where gss_process_context_token can mishandle security-context handles, enabling remote authenticated users to cause denial of service (use-after-free/double-free) or potentially execute code via crafted GSSAPI traffic (demonstrate...

WordPress WooCommerce 2.2.10 Cross Site Scripting

==================================================== Product: WooCommerce WordPress plugin Vendor: WooThemes Tested Version: 2.2.10 Vulnerability Type: Cross-Site Scripting CWE-79 Risk Level: Medium CVSSv2 Base Score: 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N Solution Status: Solved in version 2.2.11...

Security: Wrong security context loaded when using SAML2 STS Login Module

It was found that when processing undefined security domains, the org.jboss.security.plugins.mapping.JBossMappingManager implementation would fall back to the default security domain if it was available. A user with valid credentials in the defined default domain, with a role that is valid in the...

Security: Wrong security context loaded when using SAML2 STS Login Module

It was found that when processing undefined security domains, the org.jboss.security.plugins.mapping.JBossMappingManager implementation would fall back to the default security domain if it was available. A user with valid credentials in the defined default domain, with a role that is valid in the...

Security: Wrong security context loaded when using SAML2 STS Login Module

It was found that when processing undefined security domains, the org.jboss.security.plugins.mapping.JBossMappingManager implementation would fall back to the default security domain if it was available. A user with valid credentials in the defined default domain, with a role that is valid in the...

Security: Wrong security context loaded when using SAML2 STS Login Module

It was found that when processing undefined security domains, the org.jboss.security.plugins.mapping.JBossMappingManager implementation would fall back to the default security domain if it was available. A user with valid credentials in the defined default domain, with a role that is valid in the...

Ubuntu 14.04 LTS : Kerberos vulnerabilities (USN-2498-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2498-1 advisory. It was discovered that Kerberos incorrectly sent old keys in response to a -randkey -keepold request. An authenticated remote attacker could use this iss...

FreeBSD : krb5 -- Vulnerabilities in kadmind, libgssrpc, gss_process_context_token VU#540092 (24ce5597-acab-11e4-a847-206a8a720317)

SO-AND-SO reports : CVE-2014-5352: In the MIT krb5 libgssapikrb5 library, after gssprocesscontexttoken is used to process a valid context deletion token, the caller is left with a security context handle containing a dangling pointer. Further uses of this handle will result in use-after-free and...

Adobe Flash Player OP_inclocal and OP_declocal Memory Corruption (APSB12-22) - Ver2 (CVE-2012-5271)

A memory corruption vulnerability has been reported in Adobe Flash Player. The vulnerability is due to memory access without bounds checking while verifying certain opcodes. A remote attacker can exploit this issue by enticing the victim to open a specially crafted SWF file with an affected versi...

Mozilla Browsers JavaScript Argument Passing Code Execution - Ver2 (CVE-2007-0777)

Mozilla Firefox and Seamonkey are very popular open source web browsers from Mozilla Foundation, based on the Mozilla Suite code base. The browser is an application designed for tasks related to web browsing, such as displaying HTML pages, downloading files, rendering different media, and so on...

Apple QuickTime Text Track Descriptors Heap Buffer Overflow - Ver2 (CVE-2012-0664)

A heap buffer overflow vulnerability has been reported in Apple QuickTime. The vulnerability is due to improper validation of parameters lengths. A remote attacker can exploit this vulnerability by enticing a victim to open a specially crafted QuickTime Text file with an affected version of...

Internet Explorer Center Element Remote Code Execution (MS12-037) - Ver2 (CVE-2012-1523)

A remote code execution vulnerability has been reported in Microsoft Internet Explorer. The vulnerability is due to an error in the way Internet Explorer accesses an object that has been deleted. A remote attacker could trigger this vulnerability by enticing an unsuspecting victim to open a...

IPSwitch IMAIL LDAP Overflow - Ver2 (CVE-2004-0297)

The LDAP protocol elements are encoded for exchange using ASN.1 Basic Encoding Rules BER. Buffer overflow vulnerabilities exist in the LDAP component of IPSwitch's IMail server. The vulnerable LDAP daemon does not properly validate the content of an LDAP message. The vulnerability allows both DoS...

UltraVNC VNCLog Buffer Overflow - Ver2 (CVE-2006-1652)

UltraVNC is an open source client/server remote control application which uses the Virtual Network Computing VNC protocol. The VNC protocol allows a user to control a remote host by sending mouse and keyboard events, and receiving screen and sound updates. UltraVNC offers several extra features a...