The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a vigilance database and tools to fix them.
History of vulnerabilities analyzed by Vigil@nce:
IBM DB2 10.1: four vulnerabilities
An attacker can use four vulnerabilities of IBM DB2, in order to create a denial of service or to elevate his privileges...
libvirt: denial of service via RPC
A network attacker can send invalid queries to the libvirtd daemon, in order to stop it...
libxslt: using freed memory via XPath/generate-id
An attacker can use XSLT data with XPath or generate-id(), in order to stop applications linked to libxslt, and possibly to execute code...
libxslt: buffer overflow via Namespace
An attacker can use XSLT data with a Namespace selection, in order to stop applications linked to libxslt, and possibly to execute code...
AIX: incorrect processing of NFSv4 groups
The NFSv4 service of AIX does not correctly manage users' groups, so an attacker can bypass access restrictions...
Siemens SIMATIC S7-1200: generating malicious web certificates
An attacker can sign a web certificate with the Siemens SIMATIC S7-1200 PLC v2.x certification authority, so that the victim's web browser does not display a warning during the connexion to a malicious web site...
Webmin: Cross Site Request Forgery via file/show.cgi
An attacker can invite a Webmin user to display a web document, in order to execute operations on the Webmin site via file/show.cgi...
ISC DHCP: denial of service via IPv6 Lease Expiration
An attacker can send to ISC DHCP an IPv6 lease renewal query, with a malicious expiration date, in order to stop it...
FortiGate: several Cross Site Scripting
An attacker can use several vulnerabilities of FortiGate appliances, in order to execute script code in privileged contexts...
FortiGate: several Cross Site Scripting
An attacker can use several vulnerabilities of FortiGate appliances, in order to execute script code in privileged contexts...
ISC BIND: denial of service via RDATA 65535
When the ISC BIND DNS server processes a record with a RDATA larger than 65535 bytes it stops...
Cisco ASA-CX, PRSM: denial of service via /var/log
An attacker can send malicious IPv4 packets, in order to fill the /var/log partition, and then to create a denial of service on Cisco ASA CX Context-Aware Security and Cisco Prime Security Manager...
dbus: privilege elevation via autolaunch
A local attacker can use a suid root program linked to libdbus, and start dbus-launch, in order to gain root privileges...
icclib, Ghostscript: integer overflows via ICC
An attacker can invite the victim to open a malicious PDF or PS file with Ghostscript in order to execute code with victim's privileges...
Citrix Receiver, Online Plug-in: code execution via DLL Preload
An attacker can create a malicious DLL and invite the victim to open a document with Citrix Online Plug-in in the same directory, in order to execute code...
Windows, IE: vulnerabilities of ActiveX
An attacker can create an HTML page calling vulnerable ActiveX, and then invite the victim to display this page, in order to execute code on his computer...
Microsoft System Center Configuration Manager, SMS: Cross Site Scripting
An attacker can generate a Cross Site Scripting in Microsoft System Center Configuration Manager (and Microsoft Systems Management Server), in order to execute JavaScript code in the context of the web site...
Visual Studio Team Foundation Server: Cross Site Scripting
An attacker can generate a Cross Site Scripting in Visual Studio Team Foundation Server, in order to execute JavaScript code in the context of the web site...
Siemens SIMATIC PCS7, WinCC: vulnerabilities de WebNavigator
An attacker can use several vulnerabilities of WinCC WebNavigator, in order to obtain information, or to operate actions...
Java JRE: memory reading via Arrays.fill
When a Java application uses an integer array, and the Arrays.fill() method, the array memory area is not initialized to zero by the JRE, so an attacker can obtain a fragment memory...
MySQL: SQL injection via quote
An attacker, who is authenticated on MySQL and who is allowed to alter tables, can use a special character, which is saved in the Binary Log, and which is then used to execute SQL code during the replication...
FreeRADIUS: buffer overflow via X.509
When FreeRADIUS is configured to authenticate users with 802.1X, an attacker can send a malicious client certificate, in order to generate an overflow, leading to code execution...
Zope: vulnerabilities of AccessControl
An attacker can use two vulnerabilities of AccessControl, in order access to Zope...
glibc: buffer overflow via strcoll
When an attacker can create strings which are transmitted to the strcoll() function, he can generate an overflow, in order to create a denial of service in the application linked to the glibc, or to execute code...
F5 BIG-IP ASM: Cross Site Scripting via Traffic Overview
An attacker can generate a Cross Site Scripting in the Traffic Overview page of BIG-IP ASM, in order to execute JavaScript code in the web site context...
Webmin: three vulnerabilities
An authenticated attacker can use three vulnerabilities of Webmin, in order to execute Perl code, or to read a file with root privileges...
Xen: privilege elevation via QEMU Monitor
An administrator of a guest system can use a keyboard shortcut, in order to access to the QEMU Monitor console, so he can elevate his privileges on the host...
HP Business Availability Center: three vulnerabilities
An attacker can use three vulnerabilities of the web interface of HP Business Availability Center...
XnView: vulnerability via TIFF
An attacker can invite the victim to open a malicious TIFF (or JPEG) image with XnView, in order to stop it or to execute code...

   

Direct access to page 1 21 41 61 81 101 121 141 161 181 201 221 241 261 281 301 321 341 345 346 347 348 349 350 351 352 353 355 357 358 359 360 361 362 363 364 365 381 401 421 441 461 481 501 521 541 561 581 601 621 641 661 681 701 721 741 761 781 801 821 841 861 881 901 921 941 961 981 1001 1021