WordPress MaxButtons 1.26.0 Cross Site Scripting

Advisory ID: HTB23237 Product: MaxButtons WordPress plugin Vendor: Max Foundry Vulnerable Versions: 1.26.0 and probably prior Tested Version: 1.26.0 Advisory Publication: September 24, 2014 without technical details Vendor Notification: September 24, 2014 Vendor Patch: October 2, 2014 Public...

CVE-2014-7206: Improper Link Resolution Before File Access

The changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a symlink attack on the changelog file...

WordPress EWWW Image Optimizer 2.0.1 Cross Site Scripting Vulnerability

WordPress EWWW Image Optimizer plugin version 2.0.1 suffers from a cross site scripting vulnerability. Product: EWWW Image Optimizer WordPress plugin Vendor: Shane Bishop Vulnerable Versions: 2.0.1 and probably prior Tested Version: 2.0.1 Advisory Publication: September 17, 2014 without technical...

WordPress Contact Form DB 2.8.13 Cross Site Scripting Vulnerability

WordPress Contact Form DB plugin version 2.8.13 suffers from a cross site scripting vulnerability. Product: Contact Form DB WordPress plugin Vendor: Michael Simpson Vulnerable Versions: 2.8.13 and probably prior Tested Version: 2.8.13 Advisory Publication: September 17, 2014 without technical...

WordPress EWWW Image Optimizer 2.0.1 Cross Site Scripting

Advisory ID: HTB23234 Product: EWWW Image Optimizer WordPress plugin Vendor: Shane Bishop Vulnerable Versions: 2.0.1 and probably prior Tested Version: 2.0.1 Advisory Publication: September 17, 2014 without technical details Vendor Notification: September 17, 2014 Vendor Patch: September 24, 2014...

[SECURITY] [DSA 3048-1] apt security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3048-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst October 08, 2014 http://www.debian.org/security/faq -...

USN-2370-1: APT vulnerability

Guillem Jover discovered that APT incorrectly created a temporary file when handling the changelog command. A local attacker could use this issue to overwrite arbitrary files. In the default installation of Ubuntu, this should be prevented by the kernel link restrictions...

PT-2014-7838

Name of the Vulnerable Software and Affected Versions Apt versions prior to 1.0.9.2 Description The issue allows local users to write to arbitrary files via a symlink attack on the changelog file. This is related to the changelog command. Recommendations For versions prior to 1.0.9.2, update to...

CVE-2014-7206

The changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a symlink attack on the changelog file...

UBUNTU-CVE-2014-7206

The changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a symlink attack on the changelog file...

DSA-3048-1 apt - security update

Bulletin has no description...

Updated mariadb packages fix CVE-2014-4274

Updated mariadb packages fix security vulnerability: MyISAM temporary files could be used to mount a code-execution attack CVE-2014-4274. The mariadb package has been updated to version 5.5.39, which fixes this and several other issues. Refer to the upstream Changelog for more details...

CS-Cart 4.2.0 Session Hijacking Vulnerability

CS-Cart version 4.2.0 suffers from a session hijacking vulnerability due to weakly minted session identifiers. Vendor: CS-Cart Homepage: https://www.cs-cart.com Fixed in: v4.2.1 Released: July 22nd 2014 CS-Cart is 127MB of shitty PHP and HTML code that is supposed to function as a secure e-commer...

WordPress dsIDXpress IDX Plugin Cross Site Scripting Vulnerability

WordPress dsIDXpress IDX Plugin is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

tomcat security update

0:7.0.42-8 - Resolves: CVE-2013-4590 - Resolves: CVE-2014-0119 0:7.0.42-7 - Related: CVE-2014-0099 incrementing release so rpmdiff doesn't complain about - no new entries in the changelog 0:7.0.42-6 - Resolves: CVE-2014-0099 Fix possible overflow when parsing - long values from byte array -...

Updated owncloud packages fix an unspecified security vulnerability

Updated owncloud package fixes security vulnerability: Owncloud versions 5.0.17 and 6.0.4 fix an unspecified security vulnerability, as well as many other bugs. See the upstream Changelog for more information...

OpenVPN Private Tunnel Core Service Unquoted Service Path Elevation Of Privilege

Summary Private Tunnel is a new approach to true Internet security creating a Virtual Private Tunnel VPT or Virtual Private Network VPN that encrypts, privatizes, and protects your Internet traffic. Description Private Tunnel application suffers from an unquoted search path issue impacting the Co...

[SECURITY] [DSA 2976-1] eglibc security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2976-1 [email protected] http://www.debian.org/security/ Florian Weimer July 10, 2014 http://www.debian.org/security/faq -...

LinPHA <= 1.3.3 (maps plugin) Remote Command Execution Exploit

No description provided by source. ?php / -------------------------------------------------------------- LinPHA = 1.3.3 maps plugin Remote Command Execution Exploit -------------------------------------------------------------- author...: EgiX mail.....: n0b0d13satgmaildotcom link.....:...

phpBB <= 2.0.18 Remote Bruteforce/Dictionary Attack Tool (updated)

No description provided by source. !/usr/bin/perl Title: PhpBB = 2.0.18 Remote Bruteforce/Dictionary Attack Tool Type: Bruteforce / Dictionary attack New demo: http://rapidshare.de/files/13694254/phpbbbtr.avi.html 1.06 mb Php Email Script data: ? mail$destinataire, $objet, $contenu, From:...