MS15-028: Vulnerability in Windows Task Scheduler could allow security feature bypass: March 10, 2015

None None...

Microsoft Windows Task Scheduler CVE-2015-0084 Security Bypass Vulnerability

Description Microsoft Windows Kernel is prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions; this may aid in launching further attacks. Technologies Affected Avaya CallPilot 5.0 Avaya CallPilot 5.0.1...

BEWARE! μTorrent Silently Installing Bitcoin Mining Software

If you have recently installed or updated the popular BitTorrent client μTorrent 3.4.2 Build 28913 on your computer, then you read this warning post right now. Users of the μTorrent file-sharing service are complaining that the latest update of software used for torrent downloading is silently...

XSRF - complete task request omits atl-token

Potential XSRF vulnerability in tasks. No atl-token is present in the request to complete a task which suggests an attacker may be able to craft a cross site request forgery and action a task without the correct authorisation...

XSRF - complete task request omits atl-token

Potential XSRF vulnerability in tasks. No atl-token is present in the request to complete a task which suggests an attacker may be able to craft a cross site request forgery and action a task without the correct authorisation...

XSRF - complete task request omits atl-token

Potential XSRF vulnerability in tasks. No atl-token is present in the request to complete a task which suggests an attacker may be able to craft a cross site request forgery and action a task without the correct authorisation...

PYSEC-2015-37

OpenStack Image Registry and Delivery Service Glance 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service disk consumption by creating a large number of images using the task v2 API and then deleting them before the uploads...

CVE-2014-9684

OpenStack Image Registry and Delivery Service Glance 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service disk consumption by creating a large number of images using the task v2 API and then deleting them before the uploads...

CVE-2015-1881: Undefined Security Weakness

OpenStack Image Registry and Delivery Service Glance 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service disk consumption by creating a large number of images using the task v2 API and then deleting them, a different...

CVE-2014-9684: Undefined Security Weakness

OpenStack Image Registry and Delivery Service Glance 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service disk consumption by creating a large number of images using the task v2 API and then deleting them before the uploads...

OpenStack Glance Denial of Service Vulnerability (CNVD-2015-01203)

Glance provides restful APIs to query the metadata of a virtual machine image, and can obtain the image. A denial of service vulnerability exists in OpenStack Glance, as the OpenStack Glance import task fails to update the image, allowing an attacker to exploit the vulnerability to crash the...

IBM Business Process Manager Search REST API Access Bypass Vulnerability

IBM Business Process Manager is a comprehensive BPM platform that integrates WebSphere Lombardi, the industry's leading human-centric business process management platform, and WPS, a business process management platform centered on SOA integration. A security vulnerability exists in IBM BPM's...

Sql injection

SQL injection vulnerability in the CMSJunkie J-ClassifiedsManager component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a viewad task to classifieds/offerring-ads...

CVE-2015-1477: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the CMSJunkie J-ClassifiedsManager component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a viewad task to classifieds/offerring-ads...

Unbreakable Enterprise kernel security and bugfix update

2.6.39-400.246.2 - net: sctp: fix NULL pointer dereference in af-fromaddrparam on malformed packet Daniel Borkmann Orabug: 20425333 CVE-2014-7841 2.6.39-400.246.1 - sched: Fix possible divide by zero in avgatom calculation Mateusz Guzik Orabug: 20148169 - include/linux/math64.h: add div64ul Alex...

Apple Mac OSX networkd - effective_audit_token XPC Type Confusion Sandbox Escape

Apple Mac OSX networkd - effectiveaudittoken XPC Type Confusion Sandbox Escape // Requires Lorgnette: https://github.com/rodionovd/liblorgnette // clang -o networkdexploit networkdexploit.c liblorgnette/lorgnette.c -framework CoreFoundation // ianbeer include include include include include inclu...

KPPW最新版SQL注入漏洞八(全局问题导致12处注入及越权操作)

简要描述： KPPW最新版SQL注入漏洞八，从一处问题找出罪魁祸首，全局文件问题导致12处注入及越权操作 详细说明： KPPW最新版SQL注入漏洞八，从一处问题找出罪魁祸首，全局文件问题导致12处注入及越权操作 文件/control/pubgoods.php sysconfig'indexseodesc'; $id = intval$id; $step = strvaltrim$step; ...... $strUrl = "index.php?do=pubgoods&id=".$id; $SESSION'spread' = 'index.php?do=pubgoods'; requir...

Linux Kernel libfutex Local Root for RHEL/CentOS 7.0.1406 Exploit

Exploit for linux platform in category local exploits / CVE-2014-3153 exploit for RHEL/CentOS 7.0.1406 By Kaiqu Chen email protected Based on libfutex and the expoilt for Android by GeoHot. Usage: $gcc exploit.c -o exploit -lpthread $./exploit / include include include include include include...

KLA10601 Multiple vulnerabilities in Microsoft products

Multiple serious vulnerabilities have been found in Microsoft products. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service gain privileges, execute arbitrary code or obtain sensitive information. Below is a complete list of vulnerabilities 1...

Information disclosure

The SomTodo - Task/To-do widget aka com.somcloud.somtodo application 2.0.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...