JVN#67792023: Multiple improper data validation vulnerabilities in Syslink driver for Texas Instruments OMAP mobile processors

The OMAP mobile processor provided by Texas Instruments is used in some Android tablets, smartphones and other devices. The Syslink driver for some OMAP mobile processors is used to implement the communication of processes between the host and slave processors. The Syslink driver contains multipl...

OracleVM 3.2 : kernel-uek (OVMSA-2013-0003)

The remote OracleVM system is missing necessary patches to address critical security updates : - bonding: fixup typo in rlb mode of bond and bridge fix Guru Anbalagane Orabug: 16069448 - bonding: rlb mode of bond should not alter ARP originating via bridge zheng.li Orabug: 14650975 - compilation...

xEpan 1.0.1 - Cross-Site Request Forgery

xEpan 1.0.1 - Cross-Site Request Forgery Advisory ID: HTB23240 Product: xEpan Vendor: Xavoc Technocrats Pvt. Ltd. Vulnerable Versions: 1.0.1 and probably prior Tested Version: 1.0.1 Advisory Publication: October 22, 2014 without technical details Vendor Notification: October 22, 2014 Public...

OracleVM 3.2 : xen (OVMSA-2013-0004)

The remote OracleVM system is missing necessary patches to address critical security updates : - Xen Security Advisory CVE-2012-5634 / XSA-33 v3 VT-d interrupt remapping source validation flaw The patch supplied for Xen 4.1 xsa33-4.1.patch contained a build error. A corrected patch is attached. T...

xEpan 1.0.1 Cross Site Request Forgery Vulnerability

xEpan version 1.0.1 suffers from a cross site request forgery vulnerability. Product: xEpan Vendor: Xavoc Technocrats Pvt. Ltd. Vulnerable Versions: 1.0.1 and probably prior Tested Version: 1.0.1 Advisory Publication: October 22, 2014 without technical details Vendor Notification: October 22, 201...

xEpan 1.0.1 - Cross-Site Request Forgery

Advisory ID: HTB23240 Product: xEpan Vendor: Xavoc Technocrats Pvt. Ltd. Vulnerable Versions: 1.0.1 and probably prior Tested Version: 1.0.1 Advisory Publication: October 22, 2014 without technical details Vendor Notification: October 22, 2014 Public Disclosure: November 26, 2014 Vulnerability...

Joomla Simple Email Form 1.8.5 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Product: Simple Email Form Joomla Extension Vendor: Doug Bierer Vulnerable Versions: 1.8.5 and probably prior Tested Version: 1.8.5 Advisory Publication: October 29, 2014 without technical details Vendor Notification: October 29, 2014 Public...

RHEL 5 : rhev-hypervisor (RHSA-2011:1408)

An updated rhev-hypervisor package that fixes several security issues is now available. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available for each...

HelpDEZk 1.0.1 Unrestricted File Upload Vulnerability

HelpDEZk version 1.0.1 suffers from a remote unrestricted file upload vulnerability. Product: HelpDEZk Vendor: HelpDEZk Vulnerable Versions: 1.0.1 and probably prior Tested Version: 1.0.1 Advisory Publication: October 15, 2014 without technical details Vendor Notification: October 15, 2014 Public...

MODx CMS 2.2.14 - Cross-Site Request Forgery Bypass / Reflected Cross-Site Scripting / Persistent Cross-Site Scripting

Advisory ID: 92152 Product: MODX Revolution Vendor: MODX Vulnerable Versions: 2.0.0–2.2.14 Tested Version: 2.2.14 Advisory Publication: 16 July, 2014 without technical details Vendor Notification: 16 July, 2014 Vendor Patch: 15 July, 2014 Public Disclosure: 2 November , 2014 Vulnerability Type:...

MODx CMS 2.2.14 - Cross-Site Request Forgery Bypass Reflected Cross-Site Scripting Persistent Cross-Site Scripting

MODx CMS 2.2.14 - Cross-Site Request Forgery Bypass Reflected Cross-Site Scripting Persistent Cross-Site Scripting Advisory ID: 92152 Product: MODX Revolution Vendor: MODX Vulnerable Versions: 2.0.0–2.2.14 Tested Version: 2.2.14 Advisory Publication: 16 July, 2014 without technical details Vendor...

Forma Lms 1.2.1 Cross Site Scripting

Advisory ID: HTB23226 Product: Forma Lms Vendor: http://www.formalms.org/ Vulnerable Versions: 1.2.1 and probably prior Tested Version: 1.2.1 Advisory Publication: August 6, 2014 without technical details Vendor Notification: August 6, 2014 Vendor Patch: November 4, 2014 Public Disclosure: Novemb...

HelpDEZk 1.0.1 Unrestricted File Upload

Advisory ID: HTB23239 Product: HelpDEZk Vendor: HelpDEZk Vulnerable Versions: 1.0.1 and probably prior Tested Version: 1.0.1 Advisory Publication: October 15, 2014 without technical details Vendor Notification: October 15, 2014 Public Disclosure: November 5, 2014 Vulnerability Type: Unrestricted...

EspoCRM 2.5.2 XSS / LFI / Access Control Vulnerabilities

EspoCRM version 2.5.2 suffers from cross site scripting, local file inclusion, and improper access control vulnerabilities. Product: EspoCRM Vendor: http://www.espocrm.com Vulnerable Versions: 2.5.2 and probably prior Tested Version: 2.5.2 Advisory Publication: October 8, 2014 without technical...

PHP Patches Buffer Overflow Vulnerabilities

UPDATE Developers at PHP recently pushed out a series of patches to fix a handful of vulnerabilities, including one that can lead to a heap-based buffer overflow. Researchers at the Swiss firm High-Tech Bridge dug up the vulnerabilities in versions 5.6.1, 5.5.17, and 5.4.33 of the framework. The...

Multiple Cross-Site Scripting (XSS) in WP Google Maps WordPress Plugin

Advisory ID: HTB23236 Product: WP Google Maps WordPress plugin Vendor: WP Google Maps Vulnerable Versions: 6.0.26 and probably prior Tested Version: 6.0.26 Advisory Publication: September 24, 2014 without technical details Vendor Notification: September 24, 2014 Vendor Patch: September 29, 2014...

WordPress MaxButtons 1.26.0 Cross Site Scripting

Advisory ID: HTB23237 Product: MaxButtons WordPress plugin Vendor: Max Foundry Vulnerable Versions: 1.26.0 and probably prior Tested Version: 1.26.0 Advisory Publication: September 24, 2014 without technical details Vendor Notification: September 24, 2014 Vendor Patch: October 2, 2014 Public...

SQL Injection in Е2

Advisory ID: HTB23222 Product: Е2 Vendor: Ilya Birman Vulnerable Versions: v2844 and probably prior Tested Version: v2844 Advisory Publication: July 2, 2014 without technical details Vendor Notification: July 2, 2014 Vendor Patch: July 3, 2014 Public Disclosure: July 23, 2014 Vulnerability Type:...

Cross-Site Scripting (XSS) in Photo Gallery WordPress plugin

Advisory ID: HTB23232 Product: Photo Gallery WordPress plugin Vendor: http://web-dorado.com/ Vulnerable Versions: 1.1.30 and probably prior Tested Version: 1.1.30 Advisory Publication: September 10, 2014 without technical details Vendor Notification: September 10, 2014 Vendor Patch: September 10,...

Reflected Cross-Site Scripting (XSS) in MyWebSQL

Advisory ID: HTB23221 Product: MyWebSQL Vendor: http://mywebsql.net/ Vulnerable Versions: 3.4 and probably prior Tested Version: 3.4 Advisory Publication: June 25, 2014 without technical details Vendor Notification: June 25, 2014 Public Disclosure: September 3, 2014 Vulnerability Type: Cross-Site...