Code injection

IBM Tivoli Endpoint Manager Mobile Device Management MDM before 9.0.60100 uses the same secret HMAC token across different customers' installations, which allows remote attackers to execute arbitrary code via crafted marshalled Ruby objects in cookies to 1 Enrollment and Apple iOS Management...

SOL15876 - PHP vulnerability CVE-2013-2110

Recommended Action If the previous table lists a version in the Versions known to be not vulnerable column, you can eliminate this vulnerability by upgrading to the listed version. If the listed version is older than the version you are currently running, or if the table does not list any version...

SOL15877 - Apache vulnerability CVE-2013-1862

Recommended Action If the previous table lists a version in the Versions known to be not vulnerable column, you can eliminate this vulnerability by upgrading to the listed version. If the listed version is older than the version you are currently running, or if the table does not list any version...

SOL15880 - Libpng vulnerability CVE-2008-6218

Recommended action ARX If the previous table lists a version in the Versions known to be not vulnerable column, you can eliminate this vulnerability by upgrading to the listed version. If the table does not list any version in the column, then no upgrade candidate currently exists. To mitigate th...

CentOS 6 : trousers (CESA-2014:1507)

Updated trousers packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a...

Microsoft Windows TCP/IP CVE-2014-4076 Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability. A local attacker can exploit this issue to execute arbitrary code with elevated privileges. Technologies Affected Microsoft Windows Server 2003 SP2 Microsoft Windows Server 2003 x64 Edition Service Pack 2...

Microsoft Internet Information Services CVE-2014-8985 Security Bypass Vulnerability

Description Microsoft Internet Information Services is prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and gain unauthorized access; this may aid in launching further attacks. Note: This issue was previously titled 'Microsoft...

[SECURITY] Fedora 21 Update: shim-0.8-1.fc22

Initial UEFI bootloader that handles chaining to a trusted full bootloader under secure boot environments...

SOL15722 - OpenSSL DTLS SRTP Memory Leak CVE-2014-3513

Recommended Action If the previous table lists a version in the Versions known to be not vulnerable column, you can eliminate this vulnerability by upgrading to the listed version. If the listed version is older than the version you are currently running, or if the table does not list any version...

Microsoft SQL Server SQLi Escalate Db_Owner

This module can be used to escalate SQL Server user privileges to sysadmin through a web SQL Injection. In order to escalate, the database user must to have the dbowner role in a trustworthy database owned by a sysadmin user. Once the database user has the sysadmin role, the mssqlpayloadsqli modu...

Microsoft Windows FAT32 Disk Partition Driver CVE-2014-4115 Local Privilege Escalation Vulnerability

Description Microsoft Windows FAT32 Disk Partition Driver is prone to a local privilege-escalation vulnerability. A local attacker can exploit this issue to execute arbitrary code with elevated privileges. Successful exploits will result in the complete compromise of affected computers...

Microsoft Windows Kernel 'Win32k.sys' CVE-2014-4113 Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability. A local attacker can exploit this issue to execute arbitrary code with elevated privileges and gain access to kernel memory. Technologies Affected Microsoft Exchange Server 2003 SP2 Microsoft Windows 7 for 32-bi...

RHEL 6 : trousers (RHSA-2014:1507)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2014:1507 advisory. TrouSerS is an implementation of the Trusted Computing Group's Software Stack TSS specification. You can use TrouSerS to write applications that make...

CMS Made Simple 1.11.9 - Multiple Vulnerabilities

Vulnerabilities in CMS Made Simple, version 1.11.9 Discovered by Pedro Ribeiro [email protected] of Agile Information Security Reported to [email protected] and [email protected] Disclosure: 28/02/2014 / Last updated: 12/10/2014 CMS Made Simple, an open source content management...

CMS Made Simple 1.11.9 - Multiple Vulnerabilities

CMS Made Simple 1.11.9 - Multiple Vulnerabilities Vulnerabilities in CMS Made Simple, version 1.11.9 Discovered by Pedro Ribeiro [email protected] of Agile Information Security Reported to [email protected] and [email protected] Disclosure: 28/02/2014 / Last updated: 12/10/2014 CMS...

Telefonica O2 Connection Manager 8.7 Service Trusted Path Privilege Escalation

Summary O2 Connection Manager will help you to manage your internet connections by getting you connected to the fastest available network. Automatically connect you to the fastest available network including your home broadband if you have a wireless router. Description The O2 Connection Manager'...

SOL15623 - GnuTLS vulnerability CVE-2009-5138

Recommended Action For affected ARX systems, F5 recommends that you expose the management interface only on trusted networks. Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custom RSS feed to view new and updated documents. SOL4602:...

Debian DSA-3033-1 : nss - security update

Antoine Delignat-Lavaud from Inria discovered an issue in the way NSS the Mozilla Network Security Service library was parsing ASN.1 data used in signatures, making it vulnerable to a signature forgery attack. An attacker could craft ASN.1 data to forge RSA certificates with a valid certification...

DSA-3034-1 iceweasel - security update

Bulletin has no description...

Full TrustZone

A vulnerability in a modified kernel means that a series of exploits can be used to obtain access to the Trusted Execution Environment...