CVE-2012-5697

CVE-2012-5697 relates to the Smartphone Pentest Framework (SPF) web GUI in frameworkgui/, where the btinstall script sets world-writable permissions (777) on all files. This permits a local attacker to read sensitive files and potentially inject arbitrary Perl code via direct access to the files,...

CVE-2012-5701

Multiple SQL injection vulnerabilities in dotProject before 2.1.7 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 searchstring or 2 where parameter in a contacts action, 3 deptid parameter in a departments action, 4 projectid parameter in a project action, or...

[SECURITY] [DSA 3054-1] mysql-5.5 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3054-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso October 20, 2014 http://www.debian.org/security/faq -...

CVE-2012-5701

DotProject 2.x is vulnerable to SQL injection via multiple parameters (search_string, where, dept_id, project_id[], company_id) in index.php, enabling remote authenticated admins to run arbitrary SQL (and CSRF may enable exploitation). Root cause: insufficient input sanitization in those GET para...

CVE-2012-5866

CVE-2012-5866 is an XSS vulnerability in Achievo 1.4.5, caused by an input sanitation error in include.php when handling the HTTP GET parameter field. An attacker can inject arbitrary HTML/JavaScript into a user’s browser. A PoC demonstrates script execution via include.php?field=... The HTB advi...

CVE-2012-5865

CVE-2012-5865 concerns Achievo 1.4.5 where a SQL injection flaw exists in the dispatch.php script via the GET parameter activityid in the stats action. The vulnerability can be exploited by remote authenticated users to inject arbitrary SQL commands into the database, with the PoC indicating the ...

CVE-2012-5244

Banana Dance is affected by CVE-2012-5244 and likely earlier, affecting version B.2.6 and prior. The advisory bundle shows multiple vulnerabilities in Banana Dance (Banana Dance is a PHP/MySQL app): (1) SQL Injection in /functions/suggest.php (parameters return, display, table, search), (2) SQL I...

CVE-2012-2413

The CVE-2012-2413 issue affects Joomla! 1.5.26 and earlier, specifically the ja_purity template. A reflected XSS can be triggered via the Mod* cookie parameter used in html/modules.php, where user-provided cookie data is echoed without proper encoding. This allows injection of arbitrary web scrip...

CVE-2014-7567

The iMig 2012 aka com.webges.imig application 1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The iMig 2012 aka com.webges.imig application 1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7567

The iMig 2012 aka com.webges.imig application 1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7567

The CVE-2014-7567 entry concerns the Android client iMig 2012 (com.webges.imig) 1.0.0, which fails to verify X.509 certificates from SSL servers. This enables man-in-the-middle attackers to spoof legitimate servers and extract sensitive information via a crafted certificate. Root cause: lack of c...

Fedora Update for glibc FEDORA-2014-9830

Check the version of glibc SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.868418";...

Oracle MySQL Server <= 5.5.38 / 5.6 <= 5.6.19 Security Update (cpuoct2014) - Windows

Oracle MySQL Server is prone to multiple unspecified vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

MS14-060 Microsoft Windows OLE Package Manager Code Execution

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "MS14-060 Microsoft Windows OLE Package Manager Code Execution", 'Description' = %q This module exploits a vulnerability found in...

Remote code execution

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object in an Office document, as exploited in the wild with a...

Oracle Solaris Critical Patch Update : jan2013_SRU11_1_2_5_0

This Solaris system is missing necessary patches to address a critical security update : - Vulnerability in the Solaris component of Oracle Sun Products Suite subcomponent: Kernel. The supported version that is affected is 11. Easily exploitable vulnerability requiring logon to Operating System...

Microsoft Windows Kernel-Mode Driver Privilege Escalation and RCE Vulnerabilities (3000061)

This host is missing a critical security update according to Microsoft Bulletin MS14-058. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

[ MDVSA-2014:170 ] jakarta-commons-httpclient

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:170 http://www.mandriva.com/en/support/security/ Package : jakarta-commons-httpclient Date : September 2, 2014 Affected: Business Server 1.0 Problem Description: Updated jakarta-commons-httpclient and...

Security Update for Microsoft .NET Framework 4.5, 4.5.1 and 4.5.2 on Windows 8 and Windows Server 2012 x64 (KB2978042)

A security issue has been identified in a Microsoft software product that could affect your system. You can help protect your system by installing this update from Microsoft. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article...