"I love Naked Security"

2022-10-14 22:26:15

IncidentsSecurity NewsArticlesSecurity AdvisoriesCVE DatabaseMalwareBotNetsExploitsAsk the expertThe goal of this project is to make virtual world a safer and better place without child pornography, major computer crime and RIAA.Security Bulletins2013-10-18 - [slackware-security] hplip (SSA:2013-291-01)10/19/20132013-10-18 - [slackware-security] libtiff (SSA:2013-290-01)10/18/20132013-10-14 - [slackware-security] xorg-server (SSA:2013-287-05)10/15/20132013-10-14 - [slackware-security] libgpg-error (SSA:2013-287-04)10/15/20132013-10-14 - [slackware-security] gnutls (SSA:2013-287-03)10/15/2013Latest Malware UpdatesDownloader.Busadom!g102/27/2015Infostealer.Posteal02/26/2015Downloader.Busadom02/26/2015Trojan.Ladocosm02/26/2015SONAR.SuspDocRun02/25/2015SONAR.SuspHelpRun02/25/2015W32.Tempedreve.D!inf02/25/2015SONAR.PUA!AlnadInsta02/25/2015SONAR.Infostealer!g502/25/2015SONAR.Infostealer!g402/25/2015Security NewsCVE-2019-6149An unquoted search path vulnerability was identified in Lenovo Dynamic Power Reduction Utility prior to version 2.2.2.0 that could allow a malicious user with local access to execute code with administrative privileges.03/17/2019CVE-2018-15509Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control (issue 2 of 2).03/17/2019CVE-2018-20806Phamm (aka PHP LDAP Virtual Hosting Manager) 0.6.8 allows XSS via the login page (the /public/main.php action parameter).03/17/2019CVE-2019-9835The receiver (aka bridge) component of Fujitsu Wireless Keyboard Set LX901 GK900 devices allows Keystroke Injection. This occurs because it accepts unencrypted 2.4 GHz packets, even though all legitimate communication uses AES encryption.03/15/2019CVE-2019-9834The Netdata web application through 1.13.0 allows remote attackers to inject their own malicious HTML code into an imported snapshot, aka HTML Injection. Successful exploitation will allow attacker-supplied HTML to run in the context of the affected browser, potentially allowing the attacker to steal authentication credentials or to control how the site is rendered to the user.03/15/2019CVE-2019-9833The Screen Stream application through 3.0.15 for Android allows remote attackers to cause a denial of service via many simultaneous /start-stop requests.03/15/2019CVE-2019-9832The AirDrop application through 2.0 for Android allows remote attackers to cause a denial of service via a client that makes many socket connections through a configured port.03/15/2019CVE-2019-9831The AirMore application through 1.6.1 for Android allows remote attackers to cause a denial of service (system hang) via many simultaneous /?Key=PhoneRequestAuthorization requests.03/15/2019CVE-2019-5616CircuitWerkes Sicon-8, a hardware device used for managing electrical devices, ships with a web-based front-end controller and implements an authentication mechanism in JavaScript that is run in the context of a user\'s web browser.03/15/2019CVE-2018-20182rdesktop versions up to and including v1.8.3 contain a Buffer Overflow over the global variables in the function seamless_process_line() that results in memory corruption and probably even a remote code execution.03/15/2019CVE-2018-20181rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function seamless_process() and results in memory corruption and probably even a remote code execution.03/15/2019CVE-2018-20180rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function rdpsnddbg_process() and results in memory corruption and probably even a remote code execution.03/15/2019CVE-2018-20179rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function lspci_process() and results in memory corruption and probably even a remote code execution.03/15/2019CVE-2018-20178rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in the function process_demand_active() that results in a Denial of Service (segfault).03/15/2019CVE-2018-20177rdesktop versions up to and including v1.8.3 contain an Integer Overflow that leads to a Heap-Based Buffer Overflow in the function rdp_in_unistr() and results in memory corruption and possibly even a remote code execution.03/15/2019CVE-2018-20176rdesktop versions up to and including v1.8.3 contain several Out-Of- Bounds Reads in the file secure.c that result in a Denial of Service (segfault).03/15/2019CVE-2018-20175rdesktop versions up to and including v1.8.3 contains several Integer Signedness errors that lead to Out-Of-Bounds Reads in the file mcs.c and result in a Denial of Service (segfault).03/15/2019CVE-2018-20174rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in the function ui_clip_handle_data() that results in an information leak.03/15/2019CVE-2018-20106In yast2-printer up to and including version 4.0.2 the SMB printer settings don\'t escape characters in passwords properly. If a password with backticks or simliar characters is supplied this allows for executing code as root. This requires tricking root to enter such a password in yast.03/15/2019CVE-2018-19394Cobham Satcom Sailor 800 and 900 devices contained persistent XSS, which required administrative access to exploit. The vulnerability was exploitable by acquiring a copy of the device\'s configuration file, inserting an XSS payload into a relevant field (e.g., Satellite name), and then restoring the malicious configuration file.03/15/2019Security News 1 - 20 of 156797First|Prev.|12345|Next|Last|AllSecurity Advisories DatabaseRemote Code Execution Vulnerability in Microsoft OpenType Font DriverA remote attacker can execute arbitrary code on the target system.07/21/2015Multiple Vulnerabilities in Linux kernel03/04/2015SQL Injection Vulnerability in PiwigoSQL inection vulnerability has been discovered in Piwigo.02/05/2015Cross-site Scripting Vulnerability in DotNetNukeA cross-site scripting (XSS) vulnerability has been discovered in DotNetNuke.02/05/2015Cross-site Scripting Vulnerability in Hitachi Command SuiteA cross-site scripting vulnerability was found in Hitachi Command Suite.02/02/2015Denial of service vulnerability in FreeBSD SCTP RE_CONFIG Chunk HandlingAn attacker can perform a denial of service attack.01/30/2015Denial of service vulnerability in Apache Traffic Server HTTP TRACE Max-ForwardsAn attacker can perform a denial of service attack.01/30/2015Denial of service vulnerability in MalwareBytes Anti-Exploit "mbae.sys"An attacker can perform a denial of service attack.01/30/2015Denial of service vulnerability in Linux Kernel spliceAn attacker can perform a denial of service attack.01/29/2015Denial of service vulnerability in Python Pillow Module PNG Text Chunks DecompressionAn attacker can perform a denial of service attack.01/20/2015Naked Security © 2011Powered by Bitrix Site ManagerContactsAbout projectRSSIncidentsBulletingsAdvisoriesMalwareCVE DatabaseSecurity Alerts!