GoAutoDial CE 3.3 SQL Injection / Command Injection

Title : GoAutoDial CE 3.3 Multiple SQL injections, Command Injection Date : 06/12/2015 Author : R-73eN Tested on : goautodial-32bit-ce-3.3-final Software : http://goautodial.org/ | | / | / | / \ | | | || ' | | / | | / \ ' \ / \ | | | || | | | | | || | / | | | / | | ||| ||| / ||| || // \|...

GetHead - HTTP Header Analysis Vulnerability Tool

gethead.py is a Python HTTP Header Analysis Vulnerability Tool. It identifies security vulnerabilities and the lack of protection in HTTP Headers. Usage: $ python gethead.py http://domain.com Changelog Version 0.1 - Initial Release Written in Python 2.7.5 Performs HTTP Header Analysis Reports...

OracleVM 3.3 : kernel-uek (OVMSA-2015-0144)

The remote OracleVM system is missing necessary patches to address critical security updates : - virtio-net: drop NETIFFFRAGLIST Jason Wang Orabug: 22145600 CVE-2015-5156 - netdev: fix NETIFFGSOUDPTUNNELBIT enum shift in i40e driver import Todd Vierling Orabug: 22066176 - xen/blkfront: remove...

Internet Bug Bounty: Python 3.3 - 3.5 product_setstate() Out-of-bounds Read

http://bugs.python.org/issue25021...

WordPress Powerplay Gallery Plugin Arbitrary File Upload Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL server set up a personal blog site.Powerplay Gallery is one of the gallery plug-ins for displaying images. An arbitrary file upload vulnerability exists ...

OracleVM 3.3 : curl (OVMSA-2015-0107)

The remote OracleVM system is missing necessary patches to address critical security updates : - require credentials to match for NTLM re-use CVE-2015-3143 - close Negotiate connections when done CVE-2015-3148 - reject CRLFs in URLs passed to proxy CVE-2014-8150 - use only full matches for hosts...

OracleVM 3.3 : bind (OVMSA-2015-0105)

The remote OracleVM system is missing necessary patches to address critical security updates : - Fix CVE-2015-5477 - Fix CVE-2015-4620 - Resolves: 1215687 - DNS resolution failure in high load environment with SERVFAIL and 'out of memory/success' in the log - Fix CVE-2015-1349 - Enable RPZ-NSIP a...

OracleVM 3.3 : xen (OVMSA-2015-0095)

The remote OracleVM system is missing necessary patches to address critical security updates : - ide: Clear DRQ after handling all expected accesses This is additional hardening against an endtransferfunc that fails to clear the DRQ status bit. The bit must be unset as soon as the PIO transfer ha...

Drupal Path Breadcrumbs Module Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Path Breadcrumbs is one of the website breadcrumb path modules. A cross-site scripting vulnerability exists in the Drupal Path Breadcrumbs module in versions 7.x-3.3 prior to 7.x-3.x. T...

OracleVM 3.3 : kernel-uek (OVMSA-2015-0094)

The remote OracleVM system is missing necessary patches to address critical security updates : - ipv6: Don't reduce hop limit for an interface D.S. Ljungmark Orabug: 21444790 CVE-2015-2922 - ipv4: Missing sknullsnodeinit in pingunhash. David S. Miller Orabug: 21444687 CVE-2015-3636 %NASLMINLEVEL...

Cross-Site Request Forgery Vulnerability in Joomla!

Joomla! is an open source content management system CMS. A cross-site request forgery vulnerability exists in Joomla! versions 3.2.0 through 3.3.x, and 3.4.x before 3.4.2, which allows remote attackers to hijack requests to upload code via unknown vectors...

Design/Logic Flaw

TPInt.dll in VMware Workstation 10.x before 10.0.6 and 11.x before 11.1.1, VMware Player 6.x before 6.0.6 and 7.x before 7.1.1, and VMware Horizon Client 3.2.x before 3.2.1, 3.3.x, and 5.x local-mode before 5.4.2 on Windows does not properly allocate memory, which allows guest OS users to execute...

OracleVM 3.3 : xen (OVMSA-2015-0067)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86/traps: loop in the correct direction in compatiret This is XSA-136. CVE-2015-4164 - pcnet: force the buffer access to be in bounds during tx 4096 is the maximum length per TMD and it is also...

Type confusion

Xen 3.3.x through 4.5.x does not properly restrict write access to the host MSI message data field, which allows local x86 HVM guest administrators to cause a denial of service host interrupt handling confusion via vectors related to qemu and accessing spanning multiple fields...

CVE-2015-4105

Xen 3.3.x through 4.5.x enables logging for PCI MSI-X pass-through error messages, which allows local x86 HVM guests to cause a denial of service host disk consumption via certain invalid operations...

Potential unintended writes to host MSI message data field via qemu

ISSUE DESCRIPTION Logic is in place to avoid writes to certain host config space fields when the guest must nevertheless be able to access their virtual counterparts. A bug in how this logic deals with accesses spanning multiple fields allows the guest to write to the host MSI message data field...

OracleVM 3.3 : kernel-uek (OVMSA-2015-0060)

The remote OracleVM system is missing necessary patches to address critical security updates : - crypto: aesni - fix memory usage in GCM decryption Stephan Mueller Orabug: 21077385 CVE-2015-3331 - xen/pciback: Don't disable PCICOMMAND on PCI device reset. Konrad Rzeszutek Wilk Orabug: 20807438...

GoAutoDial 3.3 multiple vulnerabilities

Affected software: GoAutoDial Affected version: 3.3-1406088000 GoAdmin and previous releases of GoAutodial 3.3 Associated CVEs: CVE-2015-2842, CVE-2015-2843, CVE-2015-2844, CVE-2015-2845 Vendor advisory: http://goautodial.org/news/21 Abstract: Multiple vulnerabilties exist in the GoAutodial 3.3...

Vulnerabilities of the Red Hat Linux operating system that allow malicious actors to compromise the confidentiality, integrity, and accessibility of protected information

The multiple vulnerabilities in the dev-3.3 operating system package of Red Hat Linux can lead to breaches of confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited locally...

Vulnerabilities of the Red Hat Enterprise Linux operating system, which allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The multiple vulnerabilities in the libtasn1-devel-3.3 package of the Red Hat Enterprise Linux operating system can lead to violations of confidentiality, integrity, and accessibility of protected information. Exploitation of these vulnerabilities can be carried out remotely...