Oracle Solaris Third-Party Patch Update : logilab-common (multiple_symlink_attack_vulnerabilities_in)

The remote Solaris system is missing necessary patches to address security updates : - The 1 extractkeysfrompdf and 2 fillpdf functions in pdfext.py in logilab-commons before 0.61.0 allows local users to overwrite arbitrary files and possibly have other unspecified impact via a symlink attack on...

Mozilla Firefox < 35.0 Multiple Vulnerabilities

Binary data 8624.prm...

Ubuntu 12.04 LTS : linux vulnerabilities (USN-2463-1)

A race condition with MMIO and PIO transactions in the KVM Kernel Virtual Machine subsystem of the Linux kernel was discovered. A guest OS user could exploit this flaw to cause a denial of service guest OS crash via a specially crafted application. CVE-2014-7842 The KVM kernel virtual machine...

FreeBSD : cURL -- URL request injection vulnerability (caa98ffd-0a92-40d0-b234-fd79b429157e)

cURL reports : When libcurl sends a request to a server via a HTTP proxy, it copies the entire URL into the request and sends if off. If the given URL contains line feeds and carriage returns those will be sent along to the proxy too, which allows the program to for example send a separate HTTP...

Morfeus Security Scanner

Morfeus is a vulnerability scanning product. Remote attackers can use Morfeus to detect vulnerabilities on a target server...

Centreon < 2.5.3 Multiple Vulnerabilities

According to its version number, the Centreon application hosted on the remote web server is affected by multiple vulnerabilities : - Multiple unauthenticated SQL injection vulnerabilities. CVE-2014-3828 - A remote, unauthenticated command injection vulnerability in the 'sessionid' and 'templatei...

TWiki Security Advisory - XSS Vulnerability - CVE-2014-9325

Information -------------------- Advisory by Netsparker. Name: XSS Vulnerability with QUERYSTRING and QUERYPARAMSTRING in TWiki Affected Software : TWiki Affected Versions: 6.0.1 and possibly below Vendor Homepage : http://www.twiki.org/ Vulnerability Type : Cross-site Scripting Severity :...

Subrion CMS 3.2.2 Cross Site Scripting

Information -------------------- Advisory by Netsparker. Name: XSS Vulnerability in Subrion CMS Affected Software : Subrion CMS Affected Versions: 3.2.2 and possibly below Vendor Homepage : http://www.subrion.org/ Vulnerability Type : Cross-site Scripting Severity : Important CVE-ID: CVE-2014-912...

Splunk Enterprise 5.0.x < 5.0.10 / 6.1.x < 6.1.4 Multiple Vulnerabilities

According to its version number, the Splunk Enterprise hosted on the remote web server is 5.0.x prior to 5.0.10 or 6.1.x prior to 6.1.4. It is, therefore, affected by the following vulnerabilities : - The included OpenSSL library contains a TLS downgrade weakness. By using fragmented ClientHello...

WordPress < 3.7.5 / 3.8.5 / 3.9.3 / 4.0.1 Multiple Vulnerabilities

According to its version number, the WordPress application installed on the remote web server is affected by multiple vulnerabilities : - Multiple unspecified errors exist that could allow cross-site scripting attacks. - An unspecified error exists that could allow cross-site request forgery...

Symantec Endpoint Protection Manager < 12.1 RU5 Multiple Vulnerabilities (SYM14-015)

The version of Symantec Endpoint Protection Manager SEPM installed on the remote host is 12.1 prior to 12.1 RU5. It is, therefore, affected by the following vulnerabilities : - An XML external entity XXE injection vulnerability due to improper validation of XML external entities. A remote attacke...

Oracle Linux 5 : php (ELSA-2014-1824)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1824 advisory. - core: fix integer overflow in unserialize CVE-2014-3669 - exif: fix heap corruption issue in exifthumbnail CVE-2014-3670 Tenable has extracted the...

LiteCart Security Advisory - Multiple XSS Vulnerabilities - CVE-2014-7183

Information ----------- Advisory by Netsparker. Name: Multiple XSS Vulnerabilities in LiteCart Affected Software : LiteCart Affected Versions: 1.1.2.1 and possibly below Vendor Homepage : http://www.litecart.net Vulnerability Type : Cross-site Scripting Severity : Important CVE-ID: CVE-2014-7183...

VMware vSphere Replication Bash Environment Variable Command Injection Vulnerability (VMSA-2014-0010) (Shellshock)

The VMware vSphere Replication installed on the remote host is version 5.1.x prior to 5.1.2.2, 5.5.x prior to 5.5.1.3, 5.6.x prior to 5.6.0.2, or 5.8.x prior to 5.8.0.1. It is, therefore, affected by a command injection vulnerability in GNU Bash known as Shellshock, which is due to the processing...

Oracle Adaptive Access Manager Server Detection

Binary data oracleadaptiveaccessmanagerinstalled.nbin...

phpMyAdmin 4.0.x < 4.0.10.5 / 4.1.x < 4.1.14.6 / 4.2.x < 4.2.10.1 Multiple XSS (PMASA-2014-12)

Binary data 8564.prm...

Cisco TelePresence Video Communication Server Bash Remote Code Execution (Shellshock)

According to its self-reported version number, the version of Cisco TelePresence Video Communication Server is affected by a command injection vulnerability known as Shellshock in its included GNU Bash shell. The vulnerability is due to the processing of trailing strings after function definition...

LiteCart 1.1.2.1 Cross Site Scripting

Information ----------- Advisory by Netsparker. Name: Multiple XSS Vulnerabilities in LiteCart Affected Software : LiteCart Affected Versions: 1.1.2.1 and possibly below Vendor Homepage : http://www.litecart.net Vulnerability Type : Cross-site Scripting Severity : Important CVE-ID: CVE-2014-7183...

Osclass Security Advisory - Multiple XSS Vulnerabilities - CVE-2014-6280

Information ------------ Advisory by Netsparker. Name: XSS Vulnerability in OsClass Affected Software : OsClass Affected Versions: 3.4.1 and possibly below Vendor Homepage : http://osclass.org/ Vulnerability Type : Cross-site Scripting Severity : Critical CVE-ID: CVE-2014-6280 Netsparker Advisory...

Osclass Security Advisory - LFI Vulnerability - CVE-2014-6308

Information ----------- Advisory by Netsparker. Name : LFI Vulnerability in OsClass Affected Software : OsClass Affected Versions: 3.4.1 and possibly below Vendor Homepage : http://osclass.org/ Vulnerability Type : Local File Inclusion Severity : Critical CVE-ID: CVE-2014-6308 Netsparker Advisory...