Cisco Patches Wireless Residential Gateway Vulnerabilities

US-CERT issued an advisory yesterday warning of a critical vulnerability in Cisco’s Wireless Residential Gateway. Cisco has patched the vulnerability and also released its own warning, informing customers of a remote code execution vulnerability in the web server used by the gateway that is prese...

Omeka 2.2 - CSRF And Stored XSS Vulnerability

Omeka version 2.2 suffers from cross site request forgery and cross site scripting vulnerabilities. !-- Omeka 2.2 CSRF And Stored XSS Vulnerability Vendor: Omeka Team CHNM GMU Product web page: http://www.omeka.org Affected version: 2.2 Summary: Omeka is a free, flexible, and open source...

Omeka 2.2 Cross Site Request Forgery / Cross Site Scripting

Omeka...

Omeka 2.2 - Cross-Site Request Forgery / Persistent Cross-Site Scripting

Omeka 2.2 CSRF And Stored XSS Vulnera...

Cisco Wireless Residential Gateway Remote Code Execution Vulnerability

A vulnerability in the web server used in multiple Cisco Wireless Residential Gateway products could allow an unauthenticated, remote attacker to exploit a buffer overflow and cause arbitrary code execution. The vulnerability is due to incorrect input validation for HTTP requests. An attacker cou...

D-Link info.cgi POST Request Buffer Overflow

No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::Remote::HttpClient include...

Elipse E3 Scada PLC Denial Of Service

VSLA Security Advisory FIRE-SCADA-DOS-2013-001: Http DoS Requests Flooding Crash Device Vulnerabilities Elipse E3 Scada PLC. LEVEL: EXTREME In our tests authorized by the customer, we can stop the entire plant. Published: 10/29/2013 Version: 1.0 Vendor: Elipse...

InvGate Service Desk 4.2.36 SQL Injection Vulnerability

InvGate Service Desk version 4.2.36 suffers from multiple remote SQL injection vulnerabilities. InvGate Service Desk v4.2.36 multiple vulnerabilities http://www.invgate.com/en/service-desk/ http://www.invgate.com/en/service-desk/on-premise-trial/ Invgate Service Desk suffers from many SQL...

Ericom AccessNow Server Stack Buffer Overflow (CVE-2014-3913)

A stack buffer overflow vulnerability exists in Ericom AccessNow Server. The vulnerability is due to improper handling of specially crafted HTTP requests for non-existent files. A remote attacker can exploit this vulnerability by sending a crafted HTTP request...

SchneiderWEB Server Directory Traversal Vulnerability

OVERVIEW Independent researcher Billy Rios has identified a directory traversal vulnerability in Schneider Electric’s SchneiderWEB, a web HMI. Schneider Electric has produced a firmware update that mitigates this vulnerability. Billy Rios has tested the update to validate that it resolves the...

Whale Communications e-Gap Security Appliance 2.5 Login Page Source Code Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/9431/info The e-GAP appliance has been reported prone to a source code disclosure vulnerability. It has been reported that, when the affected appliance handles unexpected HTTP requests it may divulge the source code of th...

Microsoft IIS 4.0/5.0 Executable File Parsing Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1912/info When Microsoft IIS receives a valid request for an executable file, the filename is then passed onto the underlying operating system which executes the file. In the event that IIS receives a specially formed...

SiteWare 2.5/3.0/3.1 Editor Desktop Directory Traversal Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2868/info Screaming Media is a provider for custom web content. SiteWare Editor Desktop is the web-based administration tool for managing Screaming Media content. SiteWare Editor Desktop is prone to directory traversal...

Mailtraq 2.2 Webmail Utility Path Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7815/info A vulnerability has been reported for Mailtraq that may result in the disclosure of path information. The vulnerability exists due to insufficient sanitization of HTTP requests. Specifically, a request for...

LifeSize Room Command Injection

No description provided by source. require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient def initializeinfo = superupdateinfoinfo, 'Name' = 'LifeSize Room Command Injection', 'Description' = %q This module exploits a vulnerable...

Simple Machines Forum <= 1.1.6 (LFI) Code Execution Exploit

No description provided by source. !/usr/bin/perl @title: Simple Machines Forum Code Execution @versn: = 1.1.6 @authr: elmysterio a.k.a us @stats: DROPPED!!!!!!! @descp: In loving memory of the rare bone marrow disease that killed rgod. We can't thank you enough for killing a bug killer. @bug :...

Edimax EW-7206-APg and EW-7209APg - Multiple Vulnerabilities

No description provided by source. Device Name: EW-7206APg / EW-7209APg Vendor: Edimax ============ Vulnerable Firmware Releases: ============ Device: EW-7206APg Hardware Version Rev. A Runtime Code Version v1.32 Runtime Code Version V1.33 Device: EW-7209APg Hardware Version Rev. A Runtime Code...

Mod_NTLM 0.x Authorization Format String Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7393/info A format string vulnerability has been reported for the modntlm Apache module. The problem occurs when logging authentication strings passed in HTTP requests. By passing malicious format specifiers in a request,...

MiniShare Server 1.3.2 - Remote Denial of Service Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/10417/info Minishare is affected by a remote denial of service vulnerability. This issue is due to a failure of the application to handle improperly formed HTTP requests. This issue will allow an attacker to cause the...

Website Directory 'index.php' Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/31562/info Website Directory is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data. An attacker may leverage this issue to execute arbitrary script code in the...