Important: php54

Issue Overview: A use-after-free flaw was found in the way PHP's unserialize function processed data. If a remote attacker was able to pass crafted input to PHP's unserialize function, they could cause the PHP interpreter to crash or, possibly, execute arbitrary code. CVE-2015-0231 An integer...

PT-2015-3956

Name of the Vulnerable Software and Affected Versions Android versions prior to 5.1 Description The issue allows user-assisted remote attackers to bypass intended access restrictions via crafted Bluetooth packets after the tapping of a crafted NFC tag. This is due to the improper enforcement of t...

libFLAC 'src/flac/encode.c' Buffer Overflow Vulnerability

Libflac is a free lossless audio compression encoding and decoding program library. LibFLAC version 1.3.1 suffers from a stack buffer overflow vulnerability in the implementation of src/flac/encode.c, which can be exploited by an attacker to execute arbitrary code in an affected application...

Debian DSA-3164-1 : typo3-src - security update

Pierrick Caillon discovered that the authentication could be bypassed in the Typo 3 content management system. Please refer to the upstream advisory for additional information : %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

[SECURITY] [DSA 3164-1] typo3-src security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3164-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff February 21, 2015 http://www.debian.org/security/faq -...

CVE-2014-8690

Multiple cross-site scripting XSS vulnerabilities in Exponent CMS before 2.1.4 patch 6, 2.2.x before 2.2.3 patch 9, and 2.3.x before 2.3.1 patch 4 allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO, the 2 src parameter in a none action to index.php, or the 3 "First...

CVE-2014-8690

Multiple cross-site scripting XSS vulnerabilities in Exponent CMS before 2.1.4 patch 6, 2.2.x before 2.2.3 patch 9, and 2.3.x before 2.3.1 patch 4 allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO, the 2 src parameter in a none action to index.php, or the 3 "First...

PT-2015-4075

Name of the Vulnerable Software and Affected Versions Exponent CMS versions prior to 2.1.4 patch 6 Exponent CMS versions 2.2.x prior to 2.2.3 patch 9 Exponent CMS versions 2.3.x prior to 2.3.1 patch 4 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can b...

Updated libsndfile packages fix CVE-2014-9496

Updated libsndfile packages fix security vulnerabilities: libsndfile contains multiple buffer-overflow vulnerabilities in src/sd2.c because it fails to properly bounds-check user supplied input, which may allow an attacker to execute arbitrary code or cause a denial of service CVE-2014-9496...

phpThumb Server-Side Request Forgery Vulnerability

phpThumb is a PHP class used to generate thumbnails of images. Versions of phpThumb prior to 1.7.12 configure the disabledebug option with a default value of false, which allows remote attackers to perform server-side request forgery SSRF attacks via the src parameter...

CVE-2013-6919: Undefined Security Weakness

The default configuration of phpThumb before 1.7.12 has a false value for the disabledebug option, which allows remote attackers to conduct Server-Side Request Forgery SSRF attacks via the src parameter...

PT-2014-3216

Name of the Vulnerable Software and Affected Versions phpThumb versions prior to 1.7.12 Description The issue concerns the default configuration of phpThumb, where the disable debug option is set to false, allowing remote attackers to conduct Server-Side Request Forgery SSRF attacks. This is...

UBUNTU-CVE-2014-4465

WebKit in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1 allows remote attackers to bypass the Same Origin Policy via crafted Cascading Style Sheets CSS token sequences within an SVG file in the SRC attribute of an IMG element...

CVE-2014-4465: Improper Input Validation

WebKit in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1 allows remote attackers to bypass the Same Origin Policy via crafted Cascading Style Sheets CSS token sequences within an SVG file in the SRC attribute of an IMG element...

Minix 3.3.0 - Remote TCPIP Stack Denial of Service

Minix 3.3.0 - Remote TCPIP Stack Denial of Service / ------------------------------------------------------- ||------+ MINIX =--|| ||--= Nov 2014 =--|| ||--= Mexico =--|| -- MINIX IS PRONE TO DENIAL OF SERVICE IN THE TCP/IP STACK /service/inet BY SENDING A SINGLE TCP PACKET WITH A MALFORMED TCP...

PT-2014-8735

Name of the Vulnerable Software and Affected Versions DukaPress plugin versions prior to 2.5.4 Description The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability in the dp img resize function. This is achieved by providing a .. dot dot in the src...

CVE-2014-6635

Cross-site scripting XSS vulnerability in Exponent CMS 2.3.0 allows remote attackers to inject arbitrary web script or HTML via the src parameter in the search action to index.php...

CVE-2014-6635: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Exponent CMS 2.3.0 allows remote attackers to inject arbitrary web script or HTML via the src parameter in the search action to index.php...

PT-2014-7314

Name of the Vulnerable Software and Affected Versions Exponent CMS version 2.3.0 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the src parameter in the "search" action to "index.php". Recommendations For Exponent CMS version 2.3.0,...

CVE-2014-1575: Undefined Security Weakness

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 33.0 allow remote attackers to cause a denial of service memory corruption and application crash or possibly execute arbitrary code via vectors related to improper interaction between threading and garbage...