Subrion CMS 3.2.2 Cross Site Scripting

Information -------------------- Advisory by Netsparker. Name: XSS Vulnerability in Subrion CMS Affected Software : Subrion CMS Affected Versions: 3.2.2 and possibly below Vendor Homepage : http://www.subrion.org/ Vulnerability Type : Cross-site Scripting Severity : Important CVE-ID: CVE-2014-912...

Splunk Enterprise 5.0.x < 5.0.10 / 6.1.x < 6.1.4 Multiple Vulnerabilities

According to its version number, the Splunk Enterprise hosted on the remote web server is 5.0.x prior to 5.0.10 or 6.1.x prior to 6.1.4. It is, therefore, affected by the following vulnerabilities : - The included OpenSSL library contains a TLS downgrade weakness. By using fragmented ClientHello...

WordPress < 3.7.5 / 3.8.5 / 3.9.3 / 4.0.1 Multiple Vulnerabilities

According to its version number, the WordPress application installed on the remote web server is affected by multiple vulnerabilities : - Multiple unspecified errors exist that could allow cross-site scripting attacks. - An unspecified error exists that could allow cross-site request forgery...

Symantec Endpoint Protection Manager < 12.1 RU5 Multiple Vulnerabilities (SYM14-015)

The version of Symantec Endpoint Protection Manager SEPM installed on the remote host is 12.1 prior to 12.1 RU5. It is, therefore, affected by the following vulnerabilities : - An XML external entity XXE injection vulnerability due to improper validation of XML external entities. A remote attacke...

Oracle Linux 5 : php (ELSA-2014-1824)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1824 advisory. - core: fix integer overflow in unserialize CVE-2014-3669 - exif: fix heap corruption issue in exifthumbnail CVE-2014-3670 Tenable has extracted the...

LiteCart Security Advisory - Multiple XSS Vulnerabilities - CVE-2014-7183

Information ----------- Advisory by Netsparker. Name: Multiple XSS Vulnerabilities in LiteCart Affected Software : LiteCart Affected Versions: 1.1.2.1 and possibly below Vendor Homepage : http://www.litecart.net Vulnerability Type : Cross-site Scripting Severity : Important CVE-ID: CVE-2014-7183...

VMware vSphere Replication Bash Environment Variable Command Injection Vulnerability (VMSA-2014-0010) (Shellshock)

The VMware vSphere Replication installed on the remote host is version 5.1.x prior to 5.1.2.2, 5.5.x prior to 5.5.1.3, 5.6.x prior to 5.6.0.2, or 5.8.x prior to 5.8.0.1. It is, therefore, affected by a command injection vulnerability in GNU Bash known as Shellshock, which is due to the processing...

Oracle Adaptive Access Manager Server Detection

Binary data oracleadaptiveaccessmanagerinstalled.nbin...

phpMyAdmin 4.0.x < 4.0.10.5 / 4.1.x < 4.1.14.6 / 4.2.x < 4.2.10.1 Multiple XSS (PMASA-2014-12)

Binary data 8564.prm...

Cisco TelePresence Video Communication Server Bash Remote Code Execution (Shellshock)

According to its self-reported version number, the version of Cisco TelePresence Video Communication Server is affected by a command injection vulnerability known as Shellshock in its included GNU Bash shell. The vulnerability is due to the processing of trailing strings after function definition...

LiteCart 1.1.2.1 Cross Site Scripting

Information ----------- Advisory by Netsparker. Name: Multiple XSS Vulnerabilities in LiteCart Affected Software : LiteCart Affected Versions: 1.1.2.1 and possibly below Vendor Homepage : http://www.litecart.net Vulnerability Type : Cross-site Scripting Severity : Important CVE-ID: CVE-2014-7183...

Osclass Security Advisory - Multiple XSS Vulnerabilities - CVE-2014-6280

Information ------------ Advisory by Netsparker. Name: XSS Vulnerability in OsClass Affected Software : OsClass Affected Versions: 3.4.1 and possibly below Vendor Homepage : http://osclass.org/ Vulnerability Type : Cross-site Scripting Severity : Critical CVE-ID: CVE-2014-6280 Netsparker Advisory...

Osclass Security Advisory - LFI Vulnerability - CVE-2014-6308

Information ----------- Advisory by Netsparker. Name : LFI Vulnerability in OsClass Affected Software : OsClass Affected Versions: 3.4.1 and possibly below Vendor Homepage : http://osclass.org/ Vulnerability Type : Local File Inclusion Severity : Critical CVE-ID: CVE-2014-6308 Netsparker Advisory...

MS14-058: Vulnerabilities in Kernel-Mode Driver Could Allow Remote Code Execution (3000061)

The remote Windows host is affected by multiple vulnerabilities : - A privilege escalation vulnerability allows an attacker to run arbitrary code in kernel mode due to the kernel-mode driver improperly handling objects in memory. CVE-2014-4113 - A remote code execution vulnerability allows a remo...

Amazon Linux AMI : jakarta-commons-httpclient (ALAS-2014-410)

Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service FPS merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle...

Buffalo NAS Login Utility

This module simply attempts to login to a Buffalo NAS instance using a specific username and password. It has been confirmed to work on version 1.68 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require...

F5 Networks BIG-IP : OpenSSL vulnerability (K15356)

The dtls1reassemblefragment function in d1both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows remote attackers to execute arbitrary code or cause a denial of service buffer overflow a...

FreeBSD : chromium -- multiple vulnerabilities (d2bbcc01-4ec3-11e4-ab3f-00262d5ed8ee)

Google Chrome Releases reports : 159 security fixes in this release, including 113 found using MemorySanitizer : - 416449 Critical CVE-2014-3188: A special thanks to Juri Aedla for a combination of V8 and IPC bugs that can lead to remote code execution outside of the sandbox. - 398384 High...

OSClass 3.4.1 - index.php Local File Inclusion

OSClass 3.4.1 - index.php Local File Inclusion Information ----------- Advisory by Netsparker. Name : LFI Vulnerability in OsClass Affected Software : OsClass Affected Versions: 3.4.1 and possibly below Vendor Homepage : http://osclass.org/ Vulnerability Type : Local File Inclusion Severity :...

UDP Empty Prober

Detect UDP services that reply to empty probes This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'UDP Empty Prober', 'Description' = 'Detect UDP services that reply to empty probes', 'Author' = 'J...