The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a vigilance database and tools to fix them.
History of vulnerabilities analyzed by Vigil@nce:
BlackBerry Enterprise Server: file reading via Administration API
An attacker can use the BlackBerry Administration API, in order to read text files of the server...
QEMU: privileges not dropped with runas
When QEMU is called with the "-runas" option, it continues running with root supplementary groups...
Linux kernel: denial of service via gfs2_fallocate
A local attacker can call fallocate() on a GFS2 file system, in order to create a denial of service...
Apache httpd: SQL injection via mod_authnz_external
When Apache httpd uses the module mod_authnz_external, an attacker can use a malicious login name, in order to inject a SQL query in the MySQL database...
SquirrelMail: several vulnerabilities
Several vulnerabilities of SquirrelMail can be used by an attacker to access to the account of a user, or to generate a Cross Site Scripting...
Windows: privilege elevation via CSRSS
A local attacker can use five vulnerabilities of the CSRSS subsystem, in order to execute code with kernel privileges...
Windows: multiple vulnerabilities of Win32k.sys
A local attacker can use several vulnerabilities of Win32k.sys, in order to create a denial of service or to elevate his privileges...
Windows: code execution via Bluetooth
An attacker, who is located near the computer, can send malicious Bluetooth packets, in order to execute code in the Bluetooth 2.1 stack of Windows, with system privileges...
SAP: several vulnerabilities
Several vulnerabilities were announced in SAP products...
Linux kernel: denial of service via tc_fill_qdisc
A local attacker can use a RTM_GETQDISC message, in order to stop the kernel...
Sybase ASE: format string attack via bcksrvr
An attacker can create a format string attack in the bcksrvr service of Adaptive Server Enterprise, in order to stop it, and possibly to execute code...
Wireshark: denial of service via IKE/GTK
An attacker can send a special IKE packet, in order to create an error in the GTK display, which stops Wireshark...
FreeType: memory corruption via t1_decoder_parse_charstrings
An attacker can invite the victim to display a document using a malicious font with an application linked to FreeType, in order to execute code on his computer...
Ruby: repeatability of randoms
When a Ruby application creates child processes, their generated randoms can be the same...
Java JRE: code execution via .hotspotrc
An attacker can invite the victim to open an HTML page calling a Java applet located on a network share, in order to execute code on is computer...
Apache Santuario XML Security: buffer overflow via large keys
An attacker can use a large RSA key, in order to create a buffer overflow in C++ applications linked to Apache Santuario XML Security...
TLS, OpenSSL: overload via renegotiation
A malicious client can request several renegotiations to a SSL/TLS server, in order to overload it...
Microsoft Visio 2003: code execution via DLL Preload
An attacker can use a malicious mfc71enu.dll DLL in order to execute code in Microsoft Visio...
Symantec Web Gateway: SQL injection via forget.php
An attacker, who is allowed to connect to the web administration console of Symantec Web Gateway, can inject SQL data in the database...
libpng: denial of service via sCAL
An attacker can invite the victim to display a malicious PNG image, in order to generate a denial of service in applications linked to libpng...
ArubaOS: two vulnerabilities
An attacker can use two vulnerabilities of Aruba OS, in order to create a Cross Site Scripting, or to redirect Captive Portal users...
HP webOS: JavaScript injection via Contacts
An attacker can invite the victim to import a malicious contact with HP webOS, in order to execute JavaScript code...
RHEL 5: denial of service of Xen
The Xen package installed on Red Hat Enterprise Linux 5 can be used by a local attacker to create two denials of service...
Cisco Content Services Gateway: denial of service via ICMP
An attacker can send ICMP packets to a Cisco switch with SAMI and Content Services Gateway Second Generation, in order to stop it...
Linux kernel: denial of service via Intel Counters
A local attacker can disrupt computations of Intel processor counters, in order to create a denial of service...
QEMU-KVM: buffer overflow of virtqueue_pop
A local attacker in a guest system can use virtqueue_pop(), in order to create a buffer overflow in the host, which stops it, or leads to code execution...
XnView: code execution
An attacker can invite the victim to open a directory with XnView, in order to execute a malicious program...
Groff: several file corruptions
A local attacker can use several utilities of Groff in order to alter user's files...
HP-UX: privilege elevation via Dynamic Loader
A local attacker can use the Dynamic Loader, in order to create a denial of service or to elevate his privileges...
MIT krb5-appl: file access via ftpd
A remote attacker can read or modify some files hosted by the ftpd daemon of MIT krb5-appl...

   

Direct access to page 1 21 41 61 81 101 121 141 161 181 201 221 241 261 281 301 308 309 310 311 312 313 314 315 316 318 320 321 322 323 324 325 326 327 328 341 361 381 401 421 441 461 481 501 521 541 561 581 601 621 641 661 681 701 721 741 761 781 801 821 841 861 881 901 921 941 961 981 1001 1021 1022