Apache Fixes Information Disclosure Vuln in Shindig

The Apache Software Foundation released a new version of Shindig, a framework for Web applications yesterday, fixing what the collective has deemed an important information disclosure vulnerability. According to a post on Seclists.org by Ryan Baxter, an Apache Shindig committer, the problem affec...

Apache Struts Update Patches Two Vulnerabilities

The group behind Apache have pushed out a new version of Struts, fixing two issues in the framework that were giving developers difficulties over the past several weeks. The Apache Software Foundation posted version 2.3.15.3 of the framework online Tuesday. The release fixes an access control...

Adaudit Plus Online Demo CSRF / Poor Password Passing

================================================================================================================================================= ADAUDIT PLUS ON-LINE DEMO TomCat Directory Listing / CSRF / Password field Submited using GET Method / OPTIONS Method...

Microsoft Office Web Apps Remote Code Execution vulnerability (2834052)

This host is missing an important security update according to Microsoft Bulletin MS13-067. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE...

MS13-084: Vulnerabilities in Microsoft SharePoint Server Could Allow Remote Code Execution (2885089)

The versions of Office SharePoint Server, SharePoint Server, Windows SharePoint Services, SharePoint Foundation, or Office Web Apps installed on the remote host are affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the way that Microsoft Office Services and...

MS13-084: Description of the security update for Office Web Apps Server 2013: October 8, 2013

This security update corrects the way affected Microsoft software validates data when parsing specially crafted Office files. It also changes the configuration of SharePoint pages to provide additional protection against click-jacking attacks.INTRODUCTIONMicrosoft has released security bulletin...

Ice Cold Apps Servers Ultimate 6.0.2(12) Remote Command Execution

Ice Cold Apps Servers Ultimate version 6.0.212 for Android has no credentials by default and authentication is disabled for telnet/ssh/ftp, allowing remote access to the device's storage. Multiple vulnerabilities in Ice Cold Apps Servers Ulitmate Version 6.0.212 for Android 9/8/13 Larry W...

Ice Cold Apps Servers Ultimate 6.0.2(12) Remote Command Execution

Multiple vulnerabilities in Ice Cold Apps Servers Ulitmate Version 6.0.212 for Android 9/8/13 Larry W. Cashdollar, @larry0 http://www.amazon.com/Ice-Cold-Apps-Servers-Ultimate/dp/B00E00C44G/ref=sr11?s=mobile-apps&ie=UTF8&qid=1378688647 http://www.icecoldapps.com Vulnerabilities There are no...

Firefox For Android Same-Origin Bypass

Mozilla Firefox before 24.0 on Android allows attackers to bypass the Same Origin Policy, and consequently conduct cross-site scripting XSS attacks or obtain password or cookie information, by using a symlink in conjunction with a file: URL for a local file. CVE Number: CVE-2013-1727 Vender...

Firefox For Android Same-Origin Bypass

CVE Number: CVE-2013-1727 Vender Identifier: MFSA 2013-84 Title: Firefox for Android - Same-origin bypass through symbolic links Affected Software: Prior to v24 confirmed on v14 Credit: Takeshi Terada of Mitsui Bussan Secure Directions, Inc. Issue Status: v24 was released which fixes this...

Design/Logic Flaw

The Telephony subsystem in Apple iOS before 7 does not require API conformity for access to telephony-daemon interfaces, which allows attackers to bypass intended restrictions on phone calls via a crafted app that sends direct requests to the daemon...

CVE-2013-5156

The Telephony subsystem in Apple iOS before 7 does not require API conformity for access to telephony-daemon interfaces, which allows attackers to bypass intended restrictions on phone calls via a crafted app that sends direct requests to the daemon...

Tiendas Online SQL Injection

Tiendas Online SQL Injection Vulnerability ============================================================================= Last login: Sat Sep 14 01:59:02 on console / / / / / / / / / / / / / : / / / / / / / / / / / / / / / | / / / / / / / / / / / / / // / // / / / / --X-- / / / / / / / / / /...

CVE-2013-1330

The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP2, and Office Web Apps 2010 does not set the EnableViewStateMac attribute, which allows remote attackers to execute arbitrary code by leveraging an unassigned workflow, aka "MAC...

CVE-2013-3847

Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP3, Word 2010 SP1, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service memory...

CVE-2013-1315

Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office for Mac 2011; Excel Viewer; and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service...

CVE-2013-3848

Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP3, Word 2010 SP1, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service memory...

CVE-2013-3849

Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP3, Word 2010 SP1, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service memory...

CVE-2013-3857

Microsoft Word Automation Services in SharePoint Server 2010 SP1 and SP2, Word Web App 2010 SP1 and SP2 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP3, Word 2010 SP1 and SP2, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial o...

CVE-2013-3858

Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP3, Word 2010 SP1, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service memory...