CVE-2013-5935

The Hazelcast cluster API in Open-Xchange AppSuite 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16 does not properly restrict the set of network interfaces that can receive API calls, which makes it easier for remote attackers to obtain access by sending network traffic from an unintended...

CVE-2013-5935

Open-Xchange AppSuite (Hazelcast cluster API) is affected in 7.0.x before 7.0.2-rev15 and 7.2.x before 7.2.2-rev16. The root cause is that the Hazelcast-based cluster API does not properly restrict the network interfaces that can receive API calls, and REST/memcache interfaces do not require auth...

CVE-2013-5156

The Telephony subsystem in Apple iOS before 7 does not require API conformity for access to telephony-daemon interfaces, which allows attackers to bypass intended restrictions on phone calls via a crafted app that sends direct requests to the daemon...

[SECURITY] Fedora 18 Update: graphite-web-0.9.12-1.fc18

Graphite consists of a storage backend and a web-based visualization fronte nd. Client applications send streams of numeric time-series data to the Graphite backend called carbon, where it gets stored in fixed-size database files similar in design to RRD. The web frontend provides user interfaces...

Open-Xchange AppSuite 7.2.2 Improper Authentication / Information Disclosure

Product: Open-Xchange AppSuite Vendor: Open-Xchange GmbH Internal reference: 28260 Bug ID Vulnerability type: CWE-16: Configuration, CWE-287: Improper Authentication, CWE-200: Information Exposure Vulnerable version: 7.0.0 to 7.2.2 Vulnerable component: backend default configuration Fixed version...

Important: Red Hat Security Advisory: mongodb and pymongo security and enhancement update

Updated mongodb and pymongo packages that fix two security issues and add one enhancement are now available for Red Hat Enterprise MRG 2.3 for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring...

Juniper Junos OSPF Protocol Vulnerability (JSA10582)

According to its self-reported version number, the remote Juniper Junos device has a flaw in its OSPF implementation. A rogue router in the same autonomous system AS could exploit this to control the routing tables of all other routers in the AS. Note that this issue does not affect device with o...

[SECURITY] Fedora 19 Update: clutter-1.14.4-4.fc19

Clutter is an open source software library for creating fast, visually rich graphical user interfaces. The most obvious example of potential usage is in media center type applications. We hope however it can be used for a lot more...

RUCKUS ADVISORY ID 031813-2: User authentication bypass vulnerability in ZoneDirector administrative web interface

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 RUCKUS ADVISORY ID 031813-2 Customer release date: March 25, 2013 Public release date: May 27, 2013 TITLE User authentication bypass vulnerability in ZoneDirector administrative web interface SUMMARY An user authentication bypass vulnerability has bee...

[Sanewall 1.0.0] Making sense of firewalling

Sanewall is a firewall builder for Linux which uses an elegant language abstracted to just the right level. This makes it powerful as well as easy to use, audit, and understand. It allows you to create very readable configurations even for complex stateful firewalls. Sanewall can be used for almo...

LiquidXML Studio 2010 ActiveX Remote 0-day

Exploit for windows platform in category local exploits var sofa = "..\..\..\..\..\..\..\..\..\Documents and Settings\All Users\Start Menu\Programs\Startup\thedoctorisin.hta"; var king = "Oh noz, Look what DrIDE did... var x=new ActiveXObject"WScript.Shell"; x.Exec"CALC.EXE"; ";...

Fedora Update for gnome-online-accounts FEDORA-2013-3414

Check for the Version of gnome-online-accounts OpenVAS Vulnerability Test Fedora Update for gnome-online-accounts FEDORA-2013-3414 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it...

Security fix for the ALT Linux 10 package dnsmasq version 2.65-alt1

March 6, 2013 Mikhail Efremov 2.65-alt1 - Patch from Fedora: + Fix for CVE-2013-0198 checking of TCP connection interfaces - Improved resolvconf support. - Added dnsmasq.service. - Added dnsmasq-helper script. - Drop 'build without resolvconf' support. - Updated to 2.65...

DEBIAN-CVE-2012-3411

Dnsmasq before 2.63test1, when used with certain libvirt configurations, replies to requests from prohibited interfaces, which allows remote attackers to cause a denial of service traffic amplification via a spoofed DNS query...

DEBIAN-CVE-2013-0198

Dnsmasq before 2.66test2, when used with certain libvirt configurations, replies to queries from prohibited interfaces, which allows remote attackers to cause a denial of service traffic amplification via spoofed TCP based DNS queries. NOTE: this vulnerability exists because of an incomplete fix...

CVE-2013-0198

Dnsmasq before 2.66test2, when used with certain libvirt configurations, replies to queries from prohibited interfaces, which allows remote attackers to cause a denial of service traffic amplification via spoofed TCP based DNS queries. NOTE: this vulnerability exists because of an incomplete fix...

CVE-2012-3411

Dnsmasq before 2.63test1, when used with certain libvirt configurations, replies to requests from prohibited interfaces, which allows remote attackers to cause a denial of service traffic amplification via a spoofed DNS query...

Kaspersky Internet Security 2013 - Denial of Service

Kaspersky Internet Security 2013 - Denial of Service I usually do not write security advisories unless absolutely necessary. This time I should, however I have neither the time, nor the desire to do so. But Kaspersky did not react, so ... quick and dirty: Kaspersky Internet Security 2013 and any...

CVE-2012-3411

Dnsmasq before 2.63test1, when used with certain libvirt configurations, replies to requests from prohibited interfaces, which allows remote attackers to cause a denial of service traffic amplification via a spoofed DNS query...

Novell GroupWise HTTP Interfaces Arbitrary File Retrieval (CVE-2012-0419)

A directory traversal vulnerability has been reported in the HTTP interfaces of Novell GroupWise Post Office Agent, Message, Transfer Agent and Internet Agent. The vulnerability is due to a failure to sanitize the request URI for directory traversal characters. A remote unauthenticated attacker c...