CVE-2014-5256

Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibility of recursive processing that triggers V8 garbage collection in conjunction with a V8 interrupt, which allows remote attackers to cause a denial of service memory corruption and application crash via deep JSON...

DLA-48-1 bind9 - security update

Bulletin has no description...

Firefox 32 Debuts With Public-Key Pinning, Several Security Fixes

Mozilla has released Firefox 32, the latest version of its browser, which now supports public-key pinning and also includes fixes for several critical security vulnerabilities. The move to support public-key pinning is an important one for Firefox, as it helps protect users against...

Nokia : Exploiting cross-site scripting in Referer header in Trade.online.nokia.com

Little Insight: The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks or referer page back link . The payload Referer: javascript:prompt1; was submitted in the Referer HTTP header. This input was store on page back link when user...

APPLE-SA-2014-08-13-1 Safari 6.1.6 and Safari 7.0.6

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-08-13-1 Safari 6.1.6 and Safari 7.0.6 Safari 6.1.6 and Safari 7.0.6 are now available and address the following: WebKit Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5, OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.4 Impact...

SA-CONTRIB-2014-079 - RedHen CRM - Cross Site Scripting (XSS)

The RedHen CRM project contains the redhendedup module which enables you to find duplicate contacts in the CRM. The redhendedup module doesn't sufficiently filter administrator-entered text when deduping contacts as which creates a Cross Site Scripting XSS vulnerability. The vulnerability is...

SA-CONTRIB-2014-081 - Site Banner - Cross Site Scripting (XSS)

The Site Banner module enables you to display a banner at the top and bottom of a Drupal site. This module incorrectly prints existing context settings without proper sanitization, opening a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must...

SA-CONTRIB-2014-078 - Notify - Access bypass

The notify module allows users to subscribe to periodic emails which include all new or revised content and/or comments of specific content types, much like the daily newsletters sent by some websites. The Notify module does not sufficiently check whether the user has access to recently added or...

e2fsprogs -- buffer overflow if s_first_meta_bg too big

Theodore Ts'o reports: If sfirstmetabg is greater than the of number block group descriptor blocks, then reading or writing the block group descriptors will end up overruning the memory buffer allocated for the descriptors. The finding is credited to a vulnerability report from Jose Duart of Goog...

Flickr Cross-Site Request Forgery Vulnerability Patched

Yahoo-owned Flickr, one of the biggest online photo management and sharing website in the world was recently impacted by a web application vulnerability, which could allow an attacker to modify users’ profile image. Flickr is one of the most popular photo sharing website with more than 87 million...

WordPress WPSS 0.62 SQL Injection

|||||||||||||||||||||||||||||||||||||||||||||||||| |-------------------------------------------------------------------------| | Exploit Title: Wordpress WPSS V 0.62 Plugin Sql injection | | Exploit Author: Ashiyane Digital Security Team | | Date : Date: 2014-08-05 | | Vendor Homepage :...

SA-CORE-2014-004 - Drupal core - Denial of service

Drupal 6 and Drupal 7 include an XML-RPC endpoint which is publicly available xmlrpc.php. The PHP XML parser used by this XML-RPC endpoint is vulnerable to an XML entity expansion attack and other related XML payload attacks which can cause CPU and memory exhaustion and the site's database to rea...

SA-CONTRIB-2014-075 - Biblio Autocomplete - SQL injection and Access Bypass

This module provides functionality for AJAX based auto-completion of fields in the Biblio node type provided by the Biblio module using previously entered values and third party services. The submodule "Biblio self autocomplete" for previously entered values doesn't sufficiently sanitize user inp...

Superfish 7.x-1.9 Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Superfish 7.x-1.9 Cross Site Scripting Vulnerability ==================================================== Author: Ubani A Balogun Reported: June 25, 2014 Product Description: - -------------------- Superfish integrates jQuery Superfish plugin with you...

SA-CONTRIB-2014-073- Date - Cross Site Scripting (XSS)

Date module provides flexible date/time field type Date field and a Date API that other modules can use. The module incorrectly prints date field titles without proper sanitization thereby opening a Cross Site Scripting XSS vulnerability. The vulnerability is mitigated by the fact that an attacke...

Fixed in Apache Tomcat 7.0.55

Important: Request Smuggling CVE-2014-0227 It was possible to craft a malformed chunk as part of a chunked request that caused Tomcat to read part of the request body as a new request. This was fixed in revision 1601333. This issue was identified by the Tomcat security team on 30 May 2014 and mad...

vBulletin 5.1.2 SQL Injection

?php / Author: Nytro Powered by: Romanian Security Team Price: Free. Educational. / errorreportingEALL; iniset'displayerrors', 1; // Get arguments $targeturl = isset$argv1 ? $argv1 : 'https://rstforums.com/v5'; $expression = strreplace'/', '\/', $targeturl; // Function to send a POST request...

SA-CONTRIB-2014-070 - Password Policy - Access Bypass

The Password Policy module enables you to define and enforce password policies with various constraints on allowable user passwords. Access Bypass 7.x only Password Policy has a Password Change Tab submodule which provides a tab for a user to change their password. Password Policy also has a...

SA-CONTRIB-2014-069 - Logintoboggan - Access Bypass and Cross Site Scripting (XSS)

This module enables you to customise the standard Drupal registration and login processes. Cross Site Scripting The module doesn't filter user-supplied information from the URL resulting in a reflected Cross Site Scripting XSS vulnerability. Access Bypass The module introduces a concept of a...

SA-CONTRIB-2014-067 - Meta Tags Quick - Multiple vulnerabilities

Meta tags quick adds meta tags editing to all non-administrative pages of Drupal site. Redirector abuse in path-based meta tag editing form When editing a path-based meta tag, module does not check destination parameter of the URL, allowing attacker to pass arbitrary URL to meta tag editing form...