Moab Dynamic Configuration Authentication Bypass

Moab Authentication Bypass : CVE-2014-5300 Software: Moab Affected Versions: All versions prior to Moab 7.2.9 and Moab 8 CVE Reference: CVE-2014-5300 Author: John Fitzpatrick, MWR Labs http://labs.mwrinfosecurity.com/ Severity: High Risk Vendor: Adaptive Computing Vendor Response: Resolved in Moa...

DSA-3032-1 bash - security update

Bulletin has no description...

DSA-3030-1 mantis - security update

Bulletin has no description...

DSA-3002-1 wireshark - security update

Bulletin has no description...

DSA-2993-1 tor - security update

Bulletin has no description...

DSA-2944-1 gnutls26 - security update

Bulletin has no description...

DSA-2932-1 qemu - security update

Bulletin has no description...

Hijacked authentication cookies vulnerability

More info at https://laravel.com/docs/5.1/upgradeupgrade-4.1.26...

Cisco ONS 15454控制卡HTTP URI拒绝服务漏洞

Bugtraq ID:66686 CVE ID:CVE-2014-2142 Cisco ONS 15454是一款多业务传输平台。 Cisco ONS 15454控制卡WEB接口存在安全漏洞，由于不正确解析HTTP URI，允许攻击者发送特制的HTTP请求，可使控制卡重载。 0 Cisco ONS 15454 System Software 目前厂商已经发布了升级补丁以修复漏洞，请下载使用： http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2142...

XSRF Protection Disables Basic URL Rest Authorization

According to this REST page: https://developer.atlassian.com/display/BAMBOODEV/Using+the+Bamboo+REST+APIs You should be able to login to REST via a URL request by using the following scheme: "http://host:8085/rest/api/latest/plan?osauthType=basic&osusername=&ospassword=" This worked fine for us...

JVN#33382534: AutoCAD vulnerable to arbitrary VBScript execution

AutoCAD provided by Autodesk, Inc. is an application for comuputer-aided design CAD. AutoCAD loads specific FAS files when opening files. AutoCAD contains an issue with the FAS file search path, which may lead to arbitrary VBScript code execution. Impact Arbitrary VBScript code may be executed wi...

DSA-2844-1 djvulibre - arbitrary code execution

Bulletin has no description...

DSA-2833-1 openssl - several

Bulletin has no description...

DSA-2823-1 pixman - integer underflow

Bulletin has no description...

DSA-2803-1 quagga - several

Bulletin has no description...

DSA-2764-1 libvirt - programming error

Bulletin has no description...

DSA-2737-1 swift - several

Bulletin has no description...

DSA-2730-1 gnupg - information leak

Bulletin has no description...

Apache Struts2 多个前缀参数远程命令执行漏洞(CVE-2013-2251)

CVE-2013-2251 Struts2 是第二代基于Model-View-Controller MVC模型的java企业级web应用框架。它是WebWork和Struts社区合并后的产物 Apache Struts2的action:、redirect:和redirectAction:前缀参数在实现其功能的过程中使用了Ognl表达式，并将用户通过URL提交的内容拼接入Ognl表达式中，从而造成攻击者可以通过构造恶意URL来执行任意Java代码，进而可执行任意命令 redirect:和redirectAction:此两项前缀为Struts默认开启功能，目前Struts...

JVN#63901692: Internet Explorer vulnerable to information disclosure

Internet Explorer contains an issue in handling XML files, which may result in information disclosure. Impact If a user opens a specially crafted XML file as a local file, other local files may be disclosed. Solution Upgrade the software Users of Windows 7 and later, Windows Server 2008 R2 and...