CVE-2014-6074

IBM UrbanCode Deploy 6.1.0.2 before IF1 is affected. The flaw allows remote authenticated users to read keystore secret keys via direct access to a UI page, potentially exposing all encrypted values and SSL communications between server and agents. The IBM security bulletin notes the affected pro...

CVE-2014-6074: Undefined Security Weakness

IBM UrbanCode Deploy 6.1.0.2 before IF1 allows remote authenticated users to read keystore secret keys via a direct request to a UI page...

PT-2014-7024

Name of the Vulnerable Software and Affected Versions IBM UrbanCode Deploy version 6.1.0.2 before IF1 Description The issue allows remote authenticated users to read keystore secret keys via a direct request to a UI page. Recommendations For IBM UrbanCode Deploy version 6.1.0.2, apply the IF1 pat...

DZS Video Gallery - deploy/preview_skin_overlay.swf logoLink Parameter Reflected XSS

The dzs-videogallery WordPress plugin was affected by a deploy/previewskinoverlay.swf logoLink Parameter Reflected XSS security vulnerability...

JBoss JMX Console Beanshell Deployer WAR Upload and Deployment

This module can be used to install a WAR file payload on JBoss servers that have an exposed "jmx-console" application. The payload is put on the server by using the jboss.system:BSHDeployer's createScriptDeployment method. This module requires Metasploit: https://metasploit.com/download Current...

Symantec Workspace Streaming - Arbitrary File Upload (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rexml/document' class Metasploit3 'Symantec Workspace Streaming Arbitrary File Upload', 'Description' = %q This module exploits a code executio...

Symantec Workspace Streaming Arbitrary File Upload Exploit

This Metasploit module exploits a code execution flaw in Symantec Workspace Streaming. The vulnerability exists in the ManagementAgentServer.putFile XMLRPC call exposed by the asagent.exe service, which allows for uploading arbitrary files under the server root. This Metasploit module abuses the...

CVE-2013-2034

Multiple cross-site request forgery CSRF vulnerabilities in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1 allow remote attackers to hijack the authentication of administrators for requests that 1 execute arbitrary code or 2 initiat...

Symantec Workspace Streaming ManagementAgentServer.putFile XMLRPC Request Arbitrary File Upload

This module exploits a code execution flaw in Symantec Workspace Streaming. The vulnerability exists in the ManagementAgentServer.putFile XMLRPC call exposed by the asagent.exe service, which allows for uploading arbitrary files under the server root. This module abuses the auto deploy feature in...

Apache Tomcat 5.5.25 - Cross-Site Request Forgery

+--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Apache Tomcat 5.5.25 CSRF Vulnerabilities Date : 10-24-2013 Author : Ivano Binetti http://ivanobinetti.com Author : Gianmarco Pirozzi...

Apache Tomcat 5.5.25 Cross Site Request Forgery

+--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Apache Tomcat 5.5.25 CSRF Vulnerabilities Date : 10-24-2013 Author : Ivano Binetti http://ivanobinetti.com Author : Gianmarco Pirozzi...

Apache Tomcat 5.5.25 - Cross-Site Request Forgery

Apache Tomcat 5.5.25 - Cross-Site Request Forgery +--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Apache Tomcat 5.5.25 CSRF Vulnerabilities Date : 10-24-2013 Author : Ivano Binetti...

Honeywell HscRemoteDeploy.dll ActiveX Control vulnerability

Added: 04/19/2013 CVE: CVE-2013-0108 BID: 58134 OSVDB: 90583 Background Honeywell offers software solutions which integrate different systems and devices such as HVAC, security, safety, lighting, and energy into a common platform. Problem A vulnerability in multiple Honeywell products allows...

rhev: vds_installer is prone to MITM when downloading 2nd stage installer

The vdsinstaller in Red Hat Enterprise Virtualization Manager RHEV-M before 3.1, when adding a host, uses the -k curl parameter when downloading deployUtil.py and vdsbootstrap.py, which prevents SSL certificates from being validated and allows remote attackers to execute arbitrary Python code via...

Mandriva Linux Security Advisory : busybox (MDVSA-2012:129-1)

Multiple vulnerabilities was found and corrected in busybox : The decompress function in ncompress allows remote attackers to cause a denial of service crash, and possibly execute arbitrary code, via crafted data that leads to a buffer underflow CVE-2006-1168. A missing DHCP option checking /...

Mandriva Update for busybox MDVSA-2012:129-1 (busybox)

Check for the Version of busybox OpenVAS Vulnerability Test Mandriva Update for busybox MDVSA-2012:129-1 busybox Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

Mandriva Update for busybox MDVSA-2012:129 (busybox)

Check for the Version of busybox OpenVAS Vulnerability Test Mandriva Update for busybox MDVSA-2012:129 busybox Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...

Astaro Command Center v2.x - Multiple Web Vulnerabilities

Title: ====== Astaro Command Center v2.x - Multiple Web Vulnerabilities Date: ===== 2012-04-03 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=4 VL-ID: ===== 4 Introduction: ============= We are pleased to announce the General Availability of the Astaro Command Center...

[SECURITY] Fedora 17 Update: python-paste-script-1.7.5-4.fc17

Paster is pluggable command-line frontend, including commands to setup pack age file layouts Built-in features: Creating file layouts for packages. For instance a setuptools-ready file layout. Serving up web applications, with configuration based on paste.deploy...

[SECURITY] CVE-2009-2901 Apache Tomcat insecure partial deploy after failed undeploy

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2009-2901: Apache Tomcat insecure partial deploy after failed undeploy Severity: Low Vendor: The Apache Software Foundation Versions Affected: Tomcat 5.5.0 to 5.5.28 Tomcat 6.0.0 to 6.0.20 The unsupported Tomcat 3.x, 4.x and 5.0.x versions may be...