deV!L`z Clanportal 1.5.2 - Remote File Include Vulnerability

No description provided by source. + deV!Lz Clanportal 1.5.2 Remote File Include Vulnerability + Discovered By: cr4wl3r + Download: http://www.dzcp.de/downloads/?action=download&id=131 x Code in dzcp1.5.2/inc/config.php REQUIRES requireonce$basePath./inc/mysql.php; --- RFI function show$tpl, $arr...

openSUSE Security Update : openstack (openSUSE-2013-237)

The Openstack Stack components were updated to Folsom level as of March 5th. Changes in openstack-cinder : - Update 12.3 packages to Folsom as of March 5th. This comes with security fixes and bug fixes that we need to have OpenStack work nicely. Fix bnc802278. - Update cinder-config-update.diff:...

An Overview of KB2871997

An Overview of KB2871997 Microsoft recently released KB2871997 for Windows 7, Windows 8, Windows Server 2008R2, and Windows Server 2012. This blog will give an overview of the feature changes, their impact, and some important configuration changes that can be made in conjunction with the update t...

Fedora Update for ndjbdns FEDORA-2014-5511

Check for the Version of ndjbdns OpenVAS Vulnerability Test Fedora Update for ndjbdns FEDORA-2014-5511 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

SNMP Version 3 Authentication Vulnerabilities (cisco-sa-20080610-snmpv3)

Multiple Cisco products contain either of two authentication vulnerabilities in the Simple Network Management Protocol version 3 SNMPv3 feature. These vulnerabilities can be exploited when processing a malformed SNMPv3 message. The vulnerabilities could allow the disclosure of network information...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in D-Link DIR865L router Rev. A1 with firmware before 1.05b07 allow remote attackers to hijack the authentication of administrators for requests that 1 change the administrator password or 2 enable remote management via a request to...

Huawei Datacard Information Disclosure Vulnerability

This module exploits an unauthenticated information disclosure vulnerability in Huawei SOHO routers. The module will gather information by accessing the /api pages where authentication is not required, allowing configuration changes as well as information disclosure, including any stored SMS...

GE Proficy Real-Time Information Portal Information Disclosure Vulnerabilities

Overview This advisory provides mitigation details for multiple vulnerabilities that impact the GE Intelligent Platforms Proficy Real-Time Information Portal. General Electric GE has addressed two vulnerabilities in the GE Intelligent Platforms Proficy Real-Time Information Portal. Exploitation o...

MGASA-2013-0296 Updated ssmtp package fixes security vulnerability

It was reported that ssmtp, an extremely simple MTA to get mail off the system to a mail hub, did not perform x509 certificate validation when initiating a TLS connection to server. A rogue server could use this flaw to conduct man-in- the-middle attack, possibly leading to user credentials leak...

Cisco Unified IP Phones Multiple Vulnerabilities (cisco-sa-20110601-phone)

According to its self-reported version, the version of the Cisco Unified IP Phone software running on the remote device has the following vulnerabilities : - Cisco Unified IP Phones 7900 series are prone to privilege escalation vulnerabilities. An authenticated attacker could exploit this issue t...

SEC Consult SA-20130805-0 :: Vodafone EasyBox Default WPS PIN Algorithm Weakness

SEC Consult Vulnerability Lab Security Advisory 20130805-0 ======================================================================= title: Vodafone EasyBox Default WPS PIN Algorithm Weakness product: EasyBox 802 & EasyBox 803 vulnerable version: EasyBox 802 - all versions EasyBox 803 - Production...

Windows 8 Phone Authentication Protocol Weakness

Microsoft issued a security advisory on Sunday, warning of a potential data leakage issue for Windows Phone users connecting to Wi-Fi hotspots. Hackers love to set traps for wireless users promising free Wi-Fi in airports, restaurants and other public areas. Once a mobile device connects to the...

PT-2013-2960 · Cisco · Cisco Firewall Services Module +1

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliances ASA devices affected versions not specified Cisco Firewall Services Module FWSM affected versions not specified Description: The Secure Shell SSH implementation does not properly terminate sessions, allowing...

Medium: cups

Issue Overview: It was discovered that CUPS administrative users members of the SystemGroups groups who are permitted to perform CUPS configuration changes via the CUPS web interface could manipulate the CUPS configuration to gain unintended privileges. Such users could read or write arbitrary...

D-Link DIR-300 Cross Site Scripting

Requirement 1. HTTPs Access to router 2. Ability to make configuration changes Access vector Remote Impact Persistent XSS / Script execution Vulnerable platform D-Link DIR-300 Firmware v1.3 Severity level High Steps to reproduce 1. Log in to D-link router. 2. Setup - LAN Setup - DHCP Client List ...

Private data can be disclosed to other computer users, or be modified by them – Opera Security Advisories

Private data such as cache, password files, and Opera’s configuration files are supposed to be visible only to the user who owns the Opera profile. Opera does not set the profile folder permissions correctly, allowing other computer users to read the sensitive contents of profile files. In some...

Thomson Wireless VoIP Cable Modem - Authentication Bypass

Thomson Wireless VoIP Cable Modem - Authentication Bypass Exploit Title: Thomson Wireless VoIP Cable Modem Auth Bypass Date: February 22, 2011 Authors: Glafkos Charalambous, George Nicolaou Product: TWG850-4 Wireless VoIP Cable Modem Software Version: ST9A.01.06 Severity: High Other...

bugzilla -- multiple vulnerabilities

A Bugzilla Security Advisory reports: The following security issues have been discovered in Bugzilla: LDAP Injection When the user logs in using LDAP, the username is not escaped when building the uid=$username filter which is used to query the LDAP directory. This could potentially lead to LDAP...

Scientific Linux Security Update : ipa on SL6.x i386/x86_64

This Identity Management Application is a centralized authentication, identity management and authorization solution for both traditional and cloud based enterprise environments. It integrates components of the Upstream Directory Server, MIT Kerberos, the Upstream Certificate System, NTP, and DNS...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the management interface in FreeIPA before 2.1.4 allows remote attackers to hijack the authentication of administrators for requests that make configuration changes...