SQL Injection vulnerability in extension CoolURI (cooluri)

It has been discovered that the extension "CoolURI" cooluri is vulnerable to SQL Injection. Release Date: February 19, 2012 Bulletin Update: November 06, 2014 added CVE Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Versio...

Several vulnerabilities in third party extensions

Several vulnerabilities have been found in the following third-party TYPO3 extensions: fed, myquizpoll, push2rss3ds, slideshare, wecdiscussion Release Date: February 19, 2013 Please read first: This Collective Security Bulletin CSB is a listing of vulnerable extensions with neither significant...

VMSA-2013-0001 : VMware vSphere security updates for the authentication service and third-party libraries

a. VMware vSphere client-side authentication memory corruption vulnerability VMware vCenter Server, vSphere Client, and ESX contain a vulnerability in the handling of the management authentication protocol. To exploit this vulnerability, an attacker must convince either vCenter Server, vSphere...

CVE-2013-0241

The QXL display driver in QXL Virtual GPU 0.1.0 allows local users to cause a denial of service guest crash or hang via a SPICE connection that prevents other threads from obtaining the qemumutex mutex. NOTE: some of these details are obtained from third party information...

Business Partners Give Hackers Easy Access to Secure Firms

As frequently targeted, high-value companies continue fortifying their defenses, FireEye researchers claim that attackers are increasingly setting their sights on the affiliated but not-as-well-protected third-party organizations that do business with them. By aiming phishing email campaigns at...

VMware ESXi/ESX security updates for the authentication service and third party libraries (VMSA-2013-0001)

The remote ESXi is missing one or more security related Updates from VMSA-2013-0001. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

VMSA-2013-0001 VMware vSphere security updates for the authentication service and third party libraries

The remote ESXi is missing one or more security related Updates from VMSA-2013-0001. Summary VMware vSphere security updates for for the authentication service and third party libraries Relevant releases vCenter Server 4.1 without Update 3a vSphere Client 4.1 without Update 3a ESXi 4.1 without...

CVE-2012-1541

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than other CVEs...

VMware vSphere security updates for the authentication service and third party libraries

a. VMware vSphere client-side authentication memory corruption vulnerabilityVMware vCenter Server, vSphere Client, and ESX contain a vulnerability in the handling of the management authentication protocol. To exploit this vulnerability, an attacker must convince either vCenter Server, vSphere...

CVE-2013-0241

The QXL display driver in QXL Virtual GPU 0.1.0 allows local users to cause a denial of service guest crash or hang via a SPICE connection that prevents other threads from obtaining the qemumutex mutex. NOTE: some of these details are obtained from third party information...

VMSA-2013-0001:VMware vSphere security updates for the authentication service and third party libraries

VMSA-2013-0001.5 VMware vSphere security updates for the authentication service and third party libraries VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2013-0001.5 VMware Security Advisory Synopsis: VMware vSphere security updates for the authentication service and third par...

Several vulnerabilities in third party extensions

Several vulnerabilities have been found in the following third-party TYPO3 extensions: attacalendar, attacpetition, eusubscribe, exinitjoboffer, fefilebrowser, jscssoptimizer, kkcsv2table, lonewsseo, mnmysql2json, newssearch, tipafriendplus, twitterauth, sofortueberweisung2commerce, sysmessages...

Android MDK Trojan Found Lurking in 11K Apps, Using AES Encryption

Android.Troj.mdk, the Trojan botnet that last week was reported to have infected one million devices, mainly Chinese Android phones, is a new variant of a separate strain of malware, Backscript, researchers say. Both variants of malware use the same certificate to sign APKs, yet Troj.mdk MDK uses...

Third Party Android App Store Doling Out Adware

Users looking for “cracked” Android files are in danger of running into a site that is peddling apps that are more or less a ploy to garner advertising clicks from unsuspecting users. The site, getwapi.com, boasts a collection of free, yet crooked looking downloads for Android phones including...

Twitter Bug Allowed Apps to Access Direct Messages Without Permission

Social networking sites such as Twitter and Facebook have become not just communication hubs, but also authentication mechanisms for third-party sites. Many sites and Web applications allow users to sign in with their Facebook or Twitter credentials rather than registering, which is a nice...

Buffer overflow

Buffer overflow in a third-party ActiveX component in Siemens SIMATIC RF-MANAGER 2008, and RF-MANAGER Basic 3.0 and earlier, allows remote attackers to execute arbitrary code via a crafted web site...

CVE-2013-0656

Buffer overflow in a third-party ActiveX component in Siemens SIMATIC RF-MANAGER 2008, and RF-MANAGER Basic 3.0 and earlier, allows remote attackers to execute arbitrary code via a crafted web site...

Android Botnet Infects 1M+ Phones in China

UPDATE Up to a million Android users in China could be part of a large mobile botnet according to research unveiled by Kingsoft Security, a Hong Kong-based security company, this week. The botnet has spread across phones running the Android operating system via Android.Troj.mdk, a Trojan that...

TYPO3 T3 jQuery Extension任意PHP代码执行漏洞

BUGTRAQ ID: 57280 Typo3是开源内容管理系统（CMS）和内容管理框架（CMF）。 TYPO3 T3 jQuery 2.2.0及之前版本对用户控制的输入使用了 "unserialize"，可被利用执行任意PHP代码。 0 TYPO3 T3 jQuery extension = 2.2.0 厂商补丁： TYPO3 ----- TYPO3已经为此发布了一个安全公告（typo3-ext-sa-2013-001）以及相应补丁: typo3-ext-sa-2013-001：TYPO3-EXT-SA-2013-001: Several vulnerabilities in thir...

Several vulnerabilities in third party extensions

Several vulnerabilities have been found in the following third-party TYPO3 extensions: news, onetimeaccount, phpunit, div2007, t3mootools, t3jquery, oneclicklogin Release Date: January 11, 2013 Please read first: This Collective Security Bulletin CSB is a listing of vulnerable extensions with...