Mobile Devices C4 ODB2 dongle contains multiple vulnerabilities

Overview Mobile Devices C4 OBD2 dongle, and potentially other rebranded devices, contains multiple vulnerabilities Description The Mobile Devices C4 OBD2 dongle is the base model for several rebranded consumer devices, such as the Metromile pay-by-mile insurance dongle. These devices are plugged...

PT-2015-3362 · D Link · Dir-815

Name of the Vulnerable Software and Affected Versions: D-Link DIR-815 versions prior to 2.03.B02 Description: The issue is related to insufficient input validation in the remote administration interface, allowing remote attackers to execute arbitrary commands via specially crafted HTTP requests...

Path Traversal in Oracle GlassFish Server Open Source Edition

This module exploits an unauthenticated directory traversal vulnerability which exists in administration console of Oracle GlassFish Server 4.1, which is listening by default on port 4848/TCP. Module Options msf use auxiliary/scanner/http/glassfish/traversal msf undefinedtraversal show actions...

libuser security update

CentOS Errata and Security Advisory CESA-2015:1483 Updated libuser packages that fix two security issues are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, whic...

Drupal Administration Views Module Information Disclosure Vulnerability

Drupal is a free, open source content management system developed in PHP.Administration Views is a module for replacing administration overview or list pages. A security vulnerability exists in the Drupal Administration Views module that allows remote attackers to submit special requests to obtai...

Cisco WebEx Administration Site Stored Cross-Site Scripting Vulnerability

Cisco WebEx Meetings are web conferencing solutions. A cross-site scripting vulnerability exists in the implementation of admin site in Cisco WebEx Center, which can be exploited by a remote attacker to execute arbitrary script code in an affected site and access sensitive information by tricking...

jobsinwales.com XSS vulnerability

Vulnerable URL: http://www.jobsinwales.com/jobboard/cands/jobresults.asp?c=1=1=Administration"+%2F+Office +Work=Full+Time=Aberystwyth==asd Details: Description| Value ---|--- Patched:| Yes, at 24.08.2015 Latest check for patch:| 24.08.2015 01:24 GMT Vulnerability type:| XSS Vulnerability status:|...

KeyBox - A web-based SSH console that centrally manages administrative access to systems

KeyBox is a web-based SSH console that centrally manages administrative access to systems. Web-based administration is combined with management and distribution of user's public SSH keys. Key management and administration is based on profiles assigned to defined users. Administrators can login...

Novell GroupWise 2014 Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2015-021 Product: GroupWise Vendor: Novell Affected Versions: 2014 Tested Versions: 2014 Vulnerability Type: Cross-Site Scripting CWE-79 Risk Level: High Solution Status: Fixed Vendor Notification: 2015-05-04 Solution Date:...

Cisco Unified Communications Manager Denial of Service Vulnerability (CNVD-2015-04698)

Cisco Unified Communications Manager is a call processing component of a Cisco IP telephony solution. A security vulnerability exists in Cisco Unified Communications Manager that allows authenticated users to submit AVVID XML LAYER session requests at a special high rate, making the target...

Administration Views - Critical - Information Disclosure - SA-CONTRIB-2015-132

Administration Views module replaces overview/listing pages with actual views for superior usability. The module does not check access properly under certain circumstances. Anonymous users could get access to read information they should not have access to. CVE identifiers issued CVE-2015-7226...

EMC Isilon OneFS code execution

Command injection in web administration...

ESA-2015-112: EMC Isilon OneFS Command Injection Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2015-112: EMC Isilon OneFS Command Injection Vulnerability EMC Identifier: ESA-2015-112 CVE Identifier: CVE-2015-4525 Severity Rating: CVSS v2 Base Score: 9.0 AV:N/AC:L/Au:S/C:C/I:C/A:C Affected products: • EMC Isilon OneFS 7.2.0.0 - 7.2.0.1 • EMC...

Harvard Breach in June Hit Multiple Schools

Officials from Harvard University are warning some of its students that the school fell victim to a data breach last month and that it’s in the process of determining the scope of the attack. Anne Margulies, Harvard’s vice president and chief information officer, sent a memo to students and facul...

Stealthy PHP Web Shell Backdoor: Weevely

Stealthy PHP Web Shell Backdoor Weevely is a command line web shell dinamically extended over the network at runtime used for administration and pen testing of remote web accesses. It provides a weaponized telnet-like console through a PHP script running on the target, even in restricted...

Views Bulk Operations - Moderately critical - Access Bypass - SA-CONTRIB-2015-131

The Views Bulk Operations module enables you to add bulk operations to administration views, executing actions on multiple selected rows. The module doesn't sufficiently guard user entities against unauthorized modification. If a user has access to a user account listing view with VBO enabled suc...

The vulnerability of the Cisco VX Client allows a perpetrator to gain privileges necessary to execute system commands.

The vulnerability of the diagnostic subsystem in the web-based administration interface of Cisco VX Client exists due to the lack of measures taken to neutralize the special elements used in the operating system command set. Exploiting this vulnerability can allow an attacker, operating locally, ...

IBM Tivoli Security Directory Server Security Bypass Vulnerability

IBM Tivoli Security Directory Server now known as IBM Security Directory Server, ISDS is a suite of enterprise identity management software from IBM in the United States that uses the Lightweight Directory Access Protocol LDAP. The software provides a trusted identity data infrastructure for...

CVE-2015-1485

Cross-site request forgery CSRF vulnerability in the administration console in the Enforce Server in Symantec Data Loss Prevention DLP before 12.5.2 allows remote attackers to hijack the authentication of administrators...

CVE-2015-1485

Cross-site request forgery CSRF vulnerability in the administration console in the Enforce Server in Symantec Data Loss Prevention DLP before 12.5.2 allows remote attackers to hijack the authentication of administrators...