CVE-2013-6030

Directory traversal vulnerability on the Emerson Network Power Avocent MergePoint Unity 2016 aka MPU2016 KVM switch with firmware 1.9.16473 allows remote attackers to read arbitrary files via unspecified vectors, as demonstrated by reading the /etc/passwd file...

CVE-2013-6030

CVE-2013-6030 affects the Emerson Network Power Avocent MergePoint Unity 2016 KVM Switch (MPU2016). A directory traversal vulnerability exists in the download.php handler due to insufficient sanitization of the filename parameter, enabling reading of arbitrary files (e.g., “/etc/passwd”). Affecte...

CVE-2013-7308

The CVE-2013-0149 family covers OSPF LSA handling flaws across multiple vendors where duplicates of Link State ID in LSAs are not validated before LSA database operations, enabling DoS or information disclosure via crafted LSAs. Concrete examples from connected docs include: Cisco IOS/IOS-XE/NX-O...

CVE-2013-7308

The OSPF implementation on the D-Link DES-3810-28 switch with firmware R2.20.B017 does not consider the possibility of duplicate Link State ID values in Link State Advertisement LSA packets before performing operations on the LSA database, which allows remote attackers to cause a denial of servic...

Design/Logic Flaw

Use-after-free vulnerability in the OnWindowRemovingFromRootWindow function in content/browser/webcontents/webcontentsviewaura.cc in Google Chrome before 32.0.1700.76 on Windows and before 32.0.1700.77 on Mac OS X and Linux allows user-assisted remote attackers to cause a denial of service or...

CVE-2013-6645

Use-after-free vulnerability in the OnWindowRemovingFromRootWindow function in content/browser/webcontents/webcontentsviewaura.cc in Google Chrome before 32.0.1700.76 on Windows and before 32.0.1700.77 on Mac OS X and Linux allows user-assisted remote attackers to cause a denial of service or...

CVE-2013-6645

CVE-2013-6645 is a use-after-free in Chromium’s OnWindowRemovingFromRootWindow (web_contents_view_aura.cc) that can allow user-assisted remote denial of service via speech-input related vectors. Public references show Chromium/Chromium-based browsers were fixed in updates: openSUSE notes Chromium...

CVE-2013-6645

Use-after-free vulnerability in the OnWindowRemovingFromRootWindow function in content/browser/webcontents/webcontentsviewaura.cc in Google Chrome before 32.0.1700.76 on Windows and before 32.0.1700.77 on Mac OS X and Linux allows user-assisted remote attackers to cause a denial of service or...

CVE-2013-6645: Use After Free

Use-after-free vulnerability in the OnWindowRemovingFromRootWindow function in content/browser/webcontents/webcontentsviewaura.cc in Google Chrome before 32.0.1700.76 on Windows and before 32.0.1700.77 on Mac OS X and Linux allows user-assisted remote attackers to cause a denial of service or...

Huawei CloudEngine系列交换机安全绕过漏洞

BUGTRAQ ID: 64634 CloudEngine系列是华为公司面向下一代数据中心和高端园区推出的“云”级高性能交换机。 Huawei CloudEngine系列交换机的HWTACACS模块在实现上存在多个安全限制绕过漏洞。若攻击者拥有低权限的用户名称和密码并能够登录受影响设备，则可以利用这些漏洞绕过服务器身份验证检查，提升用户权限并执行任意命令。 0 Huawei CloudEngine Series Switches CE6800 Huawei CloudEngine Series Switches CE5800 Huawei CloudEngine Series...

CVE-2013-4776

NETGEAR ProSafe GS724Tv3 and GS716Tv2 with firmware 5.4.1.13 and earlier, GS748Tv4 5.4.1.14, and GS510TP 5.0.4.4 allows remote attackers to cause a denial of service reboot or crash via a crafted HTTP request to filesystem/...

EMC Connectrix Manager Converged Network Edition远程代码执行漏洞

Bugtraq ID:64242 CVE ID:CVE-2013-6810 EMC Connectrix是一款网络交换机解决方案，EMC Connectrix Manager提供Connectrix server的接口，可对设备进行管理和保护。 EMC Connectrix Manager不正确限制对某些Servlet的访问，允许远程攻击者利用漏洞提交特殊的请求，可获取敏感文件信息，操作数据或执行任意代码。 0 EMC Connectrix Manager 12.x 厂商补丁： EMC ----- EMC Connectrix Manager Converged Network...

UBUNTU-CVE-2013-4495

The sendthemail function in server/svrmail.c in Terascale Open-Source Resource and Queue Manager aka TORQUE Resource Manager before 4.2.6 allows remote attackers to execute arbitrary commands via shell metacharacters in the email -M switch to qsub...

CVE-2013-5556

Cisco Nexus 1000V CVE-2013-5556 is a local-authenticated command-execution vulnerability in the license-installation module. Crafted input to the install all iso command can let an authenticated local attacker gain privileges and run arbitrary shell commands. Affected are Cisco Nexus 1000V switch...

CVE-2013-5556: Undefined Security Weakness

The license-installation module on the Cisco Nexus 1000V switch 4.21SV15.2b and earlier for VMware vSphere, Cisco Nexus 1000V switch 5.21SM15.1 for Microsoft Hyper-V, and Cisco Virtual Security Gateway 4.21VSG11 for Nexus 1000V switches allows local users to gain privileges and execute arbitrary...

PT-2013-5637

Name of the Vulnerable Software and Affected Versions Cisco Nexus 1000V switch versions 4.21SV15.2b and earlier for VMware vSphere Cisco Nexus 1000V switch version 5.21SM15.1 for Microsoft Hyper-V Cisco Virtual Security Gateway version 4.21VSG11 for Nexus 1000V switches Description The issue allo...

Cisco Catalyst 3750-X Series Switch Default Credentials Vulnerability (CSCue92286)

The remote Cisco device potentially contains an issue which, due to default credentials on the Cisco Service Module, could allow a local attacker to gain unauthorized root access. TRUSTED...

postgresql: Insecure switch parsing

Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows remote attackers to cause a denial of service file corruption, and allows remote authenticated users to modify configuration settings and execute arbitrary code, via a connection...

New home for the Security Group blog

News New home for the Security Group blog Share October 31st, 2013 Welcome to the new home of the Opera Security Group. We have changed our blogging platform. For more more information regarding the switch, please see this post. If you received this blog post in your feed reader, you do not need ...

Cisco Catalyst 3750-X Series Switch Default Credentials Vulnerability

A vulnerability in the Service Module for Cisco Catalyst 3750-X Series Switches could allow an authenticated, local attacker to gain root access to the kernel running on the Cisco Service Module. The vulnerability is due to default credentials on the Cisco Service Module. An attacker could exploi...