OWASP SSL audit: O-Saft

O-Saft is an easy to use tool to show informations about SSL certificate and tests the SSL connection according given list of ciphers and various SSL configurations. It’s designed to be used by penetration testers, security auditors or server administrators. The idea is to show the important...

TP-link TL-WR840N router series there is a CSRF vulnerability, you can modify any of the configuration containing the POC-the exploit-warning-the black bar safety net

TP-Link routers in the domestic volume of users is very large, the recent foreign security researchers found that the TP-Link a series of routers there is a CSRF vulnerability, an attacker can modify the router in any configuration, including DNS, etc. Vulnerability TP-Link TL-WR840N router...

Microsoft Windows Server Local Elevation of Privilege Vulnerability

Microsoft Windows is a family of operating systems from Microsoft. A vulnerability exists in Microsoft Windows User Profile Service ProfSvc checksum user privileges, which can be exploited by an authenticated attacker to load registry configuration units associated with other accounts, which can...

Crimson-Editor-r3.70-SEH

Exploit Title : Crimson Editor r3.70 SEH Overwrite Vulnerability PoC exploit Date : 21/03/2010 Author : mrme Bug found by : sharpe Version : 3.70 Release header =...

CVE-2011-5299

Multiple cross-site scripting XSS vulnerabilities in poMMo Aardvark PR16.1 allow remote attackers to inject arbitrary web script or HTML via 1 the referer parameter to index.php, 2 the sitename parameter to admin/setup/config/general.php, 3 the groupname parameter to...

Hospira MedNet Vulnerabilitie

OVERVIEW Independent researcher Billy Rios has identified four vulnerabilities in Hospira’s MedNet server software. Hospira has released a new version of the MedNet software and provided mitigation recommendations that mitigate the reported vulnerabilities. Three of the four vulnerabilities could...

SOL15936 - NTP vulnerability CVE-2014-9295

Vulnerability Recommended Actions If the previous table lists a version in the Versions known to be not vulnerable column, you can eliminate this vulnerability by upgrading to the listed version. If the listed version is older than the version you are currently running, or if the table does not...

ntp: Multiple buffer overflows via specially-crafted packets

Multiple buffer overflow flaws were discovered in ntpd's cryptorecv, ctlputdata, and configure functions. A remote attacker could use either of these flaws to send a specially crafted request packet that could crash ntpd or, potentially, execute arbitrary code with the privileges of the ntp user...

Fedora 20 : libuv-0.10.29-1.fc20 / nodejs-0.10.33-1.fc20 (2014-15379) (POODLE)

This release handles the recent POODLE vulnerability by disabling SSLv2/SSLv3 by default for the most predominate uses of TLS in Node.js. It took longer than expected to get this release accomplished in a way that would provide appropriate default security settings, while minimizing the surface...

phpTrafficA 2.3 SQL Injection Vulnerability

phpTrafficA versions 2.3 and below suffer from a remote SQL injection vulnerability. Product: phpTrafficA Product page: http://soft.zoneo.net/phpTrafficA/ Affected versions: Up to and including 2.3 latest as of writing. Description: An SQL injection exists in Php/Functions/logfunction.php, line...

phpTrafficA 2.3 SQL Injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Product: phpTrafficA Product page: http://soft.zoneo.net/phpTrafficA/ Affected versions: Up to and including 2.3 latest as of writing. Description: An SQL injection exists in Php/Functions/logfunction.php, line 933: $sql3 ="INSERT INTO $tablehost SET...

OracleVM 3.3 : cups (OVMSA-2014-0035)

The remote OracleVM system is missing necessary patches to address critical security updates : - Revert change to whitelist /rss/ resources, as this was not used upstream. - More STR 4461 fixes from upstream: make rss feeds world-readable, but cachedir private. - Fix icon display in web interface...

OracleVM 2.1 : kernel (OVMSA-2009-0009)

The remote OracleVM system is missing necessary patches to address critical security updates : CVE-2008-4307 Race condition in the dosetlk function in fs/nfs/file.c in the Linux kernel before 2.6.26 allows local users to cause a denial of service crash via vectors resulting in an interrupted RPC...

Mandriva Linux Security Advisory : asterisk (MDVSA-2014:218)

Multiple vulnerabilities has been discovered and corrected in asterisk : Remote crash when handling out of call message in certain dialplan configurations CVE-2014-6610. Asterisk Susceptibility to POODLE Vulnerability CVE-2014-3566. Mixed IP address families in access control lists may permit...

CVE-2014-5395

Multiple cross-site request forgery CSRF vulnerabilities in Huawei HiLink E3276 and E3236 TCPU before V200R002B470D13SP00C00 and WebUI before V100R007B100D03SP01C03, E5180s-22 before 21.270.21.00.00, and E586Bs-2 before 21.322.10.00.889 allow remote attackers to hijack the authentication of users...

CVE-2014-8580

Citrix NetScaler Application Delivery Controller and NetScaler Gateway 10.5.50.10 before 10.5-52.11, 10.1.122.17 before 10.1-129.11, and 10.1-120.1316.e before 10.1-129.1105.e, when using unspecified configurations, allows remote authenticated users to access "network resources" of other users vi...

Oracle Linux 6 : kernel (ELSA-2014-1392)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1392 advisory. - kernel futex: Fix errors in nested key ref-counting Denys Vlasenko 1094458 CVE-2014-0205 Tenable has extracted the preceding description block direct...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in innovaphone PBX 10.00 sr11 and earlier allow remote attackers to hijack the authentication of administrators for requests that modify configurations or user accounts, as demonstrated by 1 changing the administrator password via a crafted...

CVE-2014-5335

Multiple cross-site request forgery CSRF vulnerabilities in innovaphone PBX 10.00 sr11 and earlier allow remote attackers to hijack the authentication of administrators for requests that modify configurations or user accounts, as demonstrated by 1 changing the administrator password via a crafted...

Windows Server IoT/Windows Storage Server — Support Statement

Support Statement At Veeam, we understand that some customers may have hardware that comes pre-installed with Windows Server IoT or Windows Storage Server, and they may want to use these to fill the role of Veeam-product component servers. While Windows Server IoT and Windows Storage Server are...