groovy: remote execution of untrusted code in class MethodClosure

A flaw was discovered in the way applications using Groovy used the standard Java serialization mechanism. A remote attacker could use a specially crafted serialized object that would execute code directly when deserialized. All applications which rely on serialization and do not isolate the code...

Apple MAC OS X XPC entitlements elevation of privilege vulnerability

Apple Mac OS X is a commercial operating system. Apple Mac OS X checks for a security vulnerability in XPC entitlements, which allows attackers to exploit the vulnerability to gain administrative privileges without authentication...

DEBIAN-CVE-2015-4163

GNTTABOPswapgrantref in Xen 4.2 through 4.5 does not check the grant table operation version, which allows local guest domains to cause a denial of service NULL pointer dereference via a hypercall without a GNTTABOPsetuptable or GNTTABOPsetversion...

Debian Security Advisory DSA 3238-1 (chromium-browser - security update)

Several vulnerabilities were discovered in the chromium web browser. CVE-2015-1235 A Same Origin Policy bypass issue was discovered in the HTML parser. CVE-2015-1236 Amitay Dobo discovered a Same Origin Policy bypass in the Web Audio API. CVE-2015-1237 Khalil Zhani discovered a use-after-free iss...

USN-2531-1 requests vulnerability

Matthew Daley discovered that Requests incorrectly handled cookies without host values when being redirected. A remote attacker could possibly use this issue to perform session fixation or cookie stealing attacks...

UBUNTU-CVE-2015-2296

The resolveredirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect...

eCryptfs crypto vulnerabilities

Passphrase hash is stored without salt...

CVE-2013-7401

The parserequest function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service crash via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method...

EmFTP may insecurely load executable files

Overview EmFTP contains a flaw when loading files, where an unitended executable file may be loaded when attempting to open a file without an extension. For example, if a text file named "exmaple" without an extension and an executable "example.exe" are in the same directory, attemtping to open t...

jetAudio 7.1.9.4030 plus vx - (.m3u) Local Stack Overflow (SEH)

No description provided by source. + Vulnerability : jetAudio v 7.1.9.4030 plus vx .m3u Local Stack Overflow + Detected by : HACK4LOVE http://www.milw0rm.com/exploits/9359 + Product : jetAudio + Versions affected : 7.1.9.4030 plus vx +...

Oracle Sun GlassFish Enterprise Server - Stored XSS Vulnerability

No description provided by source. Sense of Security - Security Advisory - SOS-11-009 Release Date. 19-Jul-2011 Last Update. - Vendor Notification Date. 23-Mar-2011 Product. Oracle Sun GlassFish Enterprise Server Platform. Java EE Affected versions. 2.1.1 v2.1 Patch069.102 Patch12 build b31g-fcs...

IrfanView 4.28 - ICO Without Transparent Colour DoS & RDoS

No description provided by source. done by BraniX [email protected] www.hackers.org.pl found: 2011.04.07 published: 2011.04.10 tested on: Windows XP SP3 Home Edition tested on: Windows XP SP3 Professional App: IrfanView 4.28 App Url: http://www.irfanview.com iview32.exe MD5:...

Lanius CMS <= 0.5.2 - Remote Arbitrary File Upload Exploit

No description provided by source. ?php / -------------------------------------------------------- Lanius CMS = 0.5.2 Remote Arbitrary File Upload Exploit -------------------------------------------------------- author...: EgiX mail.....: n0b0d13satgmaildotcom link.....: http://www.laniuscms.org/...

chkrootkit LTS security update

Package : chkrootkit Version : 0.49-4+deb6u1 CVE ID : CVE-2014-0476 Thomas Stangner discovered a vulnerability in chkrootkit, a rootkit detector, which may allow local attackers to gain root access when /tmp is mounted without the noexec option...

KesionCMS V9.5一处xss无限制盲打后台管理

简要描述： 呵呵 详细说明： 首先说明一下，测试的这个站是百度关键词来的 关键词：版本号：KesionCMS V9.5 因为电脑问题，本地搭建不了环境，搜索到这个网站，默认密码登录后台 所以就拿这个网站测试了！对不起了，站长！ 测试站点 http://www.bjlqzx.com/ 首先要注册一个会员（这个默认注册是不需要审核的，所以说是无限制盲打后台管理） 进入会员中心-投诉建议+发布 在投诉标题插入xss代码 投诉之后会返回我的投诉，然后弹窗了 用google浏览器进入后台查看投诉-弹窗 查看下源码入库了，是投诉标题没过滤好！ 漏洞证明： 详细说明...

DEBIAN-CVE-2013-4471

The Identity v3 API in OpenStack Dashboard Horizon before 2013.2 does not require the current password when changing passwords for user accounts, which makes it easier for remote attackers to change a user password by leveraging the authentication token for that user...

MS14-028: Description of the security update for iSCSI for systems that do not have update 2919355 installed: May 13, 2014

None None...

VMSA-2014-0004 VMware product updates address OpenSSL security vulnerabilities

VMware product updates address OpenSSL security vulnerabilities. OpenVAS Vulnerability Test $Id: gbVMSA-2014-0004.nasl 6759 2017-07-19 09:56:33Z teissa $ VMSA-2014-0004: VMware product updates address OpenSSL security vulnerabilities Authors: Michael Meyer Copyright: Copyright c 2014 Greenbone...

BELL-CVE-2014-2672 CVE-2014-2672 does not affect BellSoft software

Bulletin has no description...

UBUNTU-CVE-2012-6615

The ffasssplitoverridecodes function in libavcodec/asssplit.c in FFmpeg before 1.0.2 allows remote attackers to cause a denial of service NULL pointer dereference and crash via a subtitle dialog without text...