TVMOBiLi 2.1.0.3557 - Denial of Service

Advisory ID: HTB23120 Product: TVMOBiLi media server Vendor: TVMOBiLi Vulnerable Versions: 2.1.0.3557 and probably prior version Tested Version: 2.1.0.3557 in Windows XP SP3 32 bits Vendor Notification: October 15, 2012 Vendor Patch: November 21, 2012 Public Disclosure: December 5, 2012...

SumatraPDF 2.1.1/MuPDF 1.0 - Integer Overflow

Sumatra 2.1.1/MuPDF 1.0 Integer Overflow ======================================= There is an integer overflow on the MuPDF in the lexnumber function which can be triggered using a corrupt PDF file with ObjStm. I'm attaching a file that reproduces the problem with the original unmodified file. The...

Achievo 1.4.5 - Multiple Vulnerabilities (2)

Advisory ID: HTB23126 Product: Achievo Vendor: www.achievo.org Vulnerable Versions: 1.4.5 and probably prior Tested Version: 1.4.5 Vendor Notification: November 14, 2012 Public Disclosure: December 5, 2012 Vulnerability Type: SQL Injection CWE-89, Cross-Site Scripting CWE-79 CVE References:...

[security bulletin] HPSBPI02807 SSRT100928 rev.1 - HP LaserJet Pro 400 Multi Function Printers, Remote Unauthorized Access

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03464042 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03464042 Version: 1 HPSBPI02807...

Achievo 1.4.5 - Multiple Vulnerabilities (2)

Achievo 1.4.5 - Multiple Vulnerabilities 2 Advisory ID: HTB23126 Product: Achievo Vendor: www.achievo.org Vulnerable Versions: 1.4.5 and probably prior Tested Version: 1.4.5 Vendor Notification: November 14, 2012 Public Disclosure: December 5, 2012 Vulnerability Type: SQL Injection CWE-89,...

[security bulletin] HPSBMU02816 SSRT100949 rev.1 - HP Network Node Manager i (NNMi) for HP-UX, Linux, Solaris, and Windows, Remote Unauthorized Access

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03507416 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03507416 Version: 1 HPSBMU02816...

[security bulletin] HPSBHF02821 SSRT100934 rev.1 - HP Integrated Lights-Out iLO3 and iLO4, Remote Disclosure of Information

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03515413 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03515413 Version: 1 HPSBHF02821...

RHEL 6 : mysql (RHSA-2012:1551)

Updated mysql packages that fix one security issue are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Clipbucket 2.6 Revision 738 - Multiple SQL Injections

Advisory ID: HTB23125 Product: ClipBucket Vendor: clip-bucket.com Vulnerable Versions: 2.6 Revision 738 and probably prior Tested Version: 2.6 Revision 738 Vendor Notification: November 7, 2012 Vendor Patch: November 28, 2012 Public Disclosure: December 5, 2012 Vulnerability Type: SQL Injection...

Nagios3 history.cgi Host Command Execution

This module abuses a command injection vulnerability in the Nagios3 history.cgi script. Module Options msf use exploit/unix/webapp/nagios3/historycgi msf undefinedhistorycgi show actions ...actions... msf undefinedhistorycgi set ACTION msf undefinedhistorycgi show options ...show and set options...

CVE-2012-4687

The CVE-2012-4687 issue affects the Post Oak AWAM Bluetooth Reader Traffic System, where the authentication/host key generation uses insufficient entropy. This weakness enables potential remote MitM attacks by predicting private keys, potentially compromising confidentiality and integrity. Affect...

CVE-2012-3297

CVE-2012-3297 affects IBM Tivoli Monitoring; the embedded HTTP server in the Service Console is vulnerable to XSS via a crafted URI. Affected versions are 6.2.2 before 6.2.2-TIV-ITM-FP0009 and 6.3.2 before 6.2.3-TIV-ITM-FP0001. The vulnerability allows remote attackers to inject arbitrary web scr...

CVE-2012-4857

CVE-2012-4857 affects IBM Informix Server: 11.50 up to 11.50.xC9W2 and 11.70 up to 11.70.xC7. A buffer overflow in the handling of unspecified SQL statements allows an authenticated user who can connect to the Informix database server (locally or remotely) to crash the server or execute arbitrary...

CVE-2012-4690

The CVE-2012-4690 vulnerability affects Rockwell Automation Allen-Bradley MicroLogix devices (1100/1200/1400/1500) and the SLC 500 and PLC‑5 controller platforms. When Static status is not enabled, attackers can remotely send crafted messages that modify status bits, causing the controller to fau...

[SECURITY] [DSA 2584-1] iceape security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2584-1 [email protected] http://www.debian.org/security/ Yves-Alexis Perez December 08, 2012 http://www.debian.org/security/faq -...

CVE-2012-3546 Apache Tomcat Bypass of security constraints

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2012-3546 Apache Tomcat Bypass of security constraints Severity: Important Vendor: The Apache Software Foundation Versions Affected: - - Tomcat 7.0.0 to 7.0.29 - - Tomcat 6.0.0 to 6.0.35 Earlier unsupported versions may also be affected Descriptio...

CentOS 5 : kernel (CESA-2012:1540)

Updated kernel packages that fix multiple security issues, two bugs, and add two enhancements are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which...

Wireshark Multiple Dissector Multiple DoS Vulnerabilities (Dec 2012) - Mac OS X

Wireshark is prone to multiple denial of service vulnerabilities. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Fedora 18 : kernel-3.6.9-4.fc18 (2012-19804)

Update to latest stable upstream release, Linux v3.6.9. Various bugfixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible...

ClipBucket 2.6 Revision 738 SQL Injection

Advisory ID: HTB23125 Product: ClipBucket Vendor: clip-bucket.com Vulnerable Versions: 2.6 Revision 738 and probably prior Tested Version: 2.6 Revision 738 Vendor Notification: November 7, 2012 Vendor Patch: November 28, 2012 Public Disclosure: December 5, 2012 Vulnerability Type: SQL Injection...