Cisco IPS Software Control-Plane MainApp拒绝服务漏洞

Bugtraq ID:65667 CVE ID:CVE-2014-0719 Cisco IPS Software是一款思科开发的入侵防御系统。 Cisco IPS Software上的Control-plane访问列表实现中存在漏洞，允许未验证远程攻击者使MainApp进程变得不稳定。 漏洞是由于不正确处理发送给受影响系统的管理IP地址的畸形TCP报文，向TCP 7000端口发送特制报文可使MainApp进程变得不稳定。 0 Cisco ASA 5505 Advanced Inspection and Prevention Security Services Card AIP SSC...

Cisco Unified Computing System 'copy'命令本地特权提升漏洞

Bugtraq ID:65638 CVE ID:CVE-2014-0730 Cisco Unified Computing System通过将统一计算、网络、存储访问和虚拟化整合到一个系统中,简化IT管理并提高灵活性。 Cisco Unified Computing System local-mgmt上下文存在安全漏洞，允许本地通过验证的攻击者提升权限。漏洞是由于不正确校验copy命令的输入，允许攻击者提交特殊命令来获得对shell的访问。 0 Cisco Unified Computing System Central Software 厂商补丁： Cisco -----...

Apple Mac OS X及iOS 'IOReportHub'组件本地拒绝服务漏洞

BUGTRAQ ID: 65619 OS X（前称Mac OS X）是苹果公司为麦金塔电脑开发的专属操作系统的最新版本。 Apple Mac OS X及iOS在实现上存在本地拒绝服务漏洞，本地攻击者可利用此漏洞造成应用崩溃。 0 Apple Mac OS X 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.apple.com/support/downloads/...

Google Chrome内存破坏漏洞

BUGTRAQ ID: 65232 CVECAN ID: CVE-2014-1681 Google Chrome是由Google开发的一款Web浏览工具。 Chrome 32.0.1700.102之前版本存在安全漏洞，目前影响未知。 0 Google Chrome 32.0.1700.102 厂商补丁： Google ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.google.com http://googlechromereleases.blogspot.com/2014/01/stable-channel-update27.h...

Fedora 20 : kernel-3.12.8-300.fc20 (2014-1062)

The 3.12.8 stable update contains a number of important fixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...

Linux Kernel 'wanxl.c'本地信息泄露漏洞

BUGTRAQ ID: 64953 CVECAN ID: CVE-2014-1445 Linux Kernel是Linux操作系统的内核。 Linux kernel在实现上存在本地信息泄露漏洞，本地攻击者可利用此漏洞造成内存泄露敏感信息。 0 Linux kernel 厂商补丁： Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.kernel.org/...

Cisco WebExCollaboration Partner Access控制台跨站脚本漏洞

Bugtraq ID:64288 CVE ID:CVE-2013-6961 Cisco WebEx是一款网络会议解决方案。 Cisco WebEx Meeting Center Collaboration Partner Access Console CPAC存在一个跨站脚本漏洞，允许远程攻击者利用漏洞构建恶意URI，诱使用户解析，可获取敏感信息或劫持用户会话。 0 Cisco WebEx Meeting Center 厂商补丁： Cisco ----- 用户可参考如下厂商提供的安全公告获得补丁信息：...

Cisco WebEx Sales Center开放重定向漏洞

Bugtraq ID:64271 CVE ID:CVE-2013-6959 Cisco WebEx是一款网络会议解决方案。 Cisco WebEx Sales Center存在开放重定向漏洞，允许远程攻击者利用漏洞构建恶意URI，诱使用户解析，可重定向用户到攻击者指定WEB站点，进行网络钓鱼等攻击。 0 Cisco WebEx Sales Center 厂商补丁： IBM ----- 用户可参考如下厂商提供的安全公告获得补丁信息： http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-695...

Cisco WebEx Training Center注册ID泄漏漏洞

Bugtraq ID:64286 CVE ID:CVE-2013-6973 Cisco WebEx Training Center是一款互动式培训解决方案，可开展电子教学。 Cisco WebEx Training Center不正确处理用户输入，允许远程攻击者利用漏洞提交恶意请求，获取其他用户注册ID信息。 0 Cisco WebEx Training Center 厂商补丁： Cisco ----- 用户可参考如下厂商提供的安全公告获得补丁信息：...

PHP OpenSSL Extension 'openssl_x509_parse()'内存破坏漏洞

BUGTRAQ ID: 64225 CVECAN ID: CVE-2013-6420 PHP 5.3.27之前版本、5.4.22之前版本、5.5.6之前版本解析x.509证书时，"asn1timetotimet"函数ext/openssl/openssl.c出错，攻击者通过特制的x.509证书利用此漏洞可破坏内存。 0 PHP PHP 5.5.x PHP PHP 5.4.x PHP PHP 5.3.x 厂商补丁： PHP --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.php.net...

EMC Connectrix Manager Converged Network Edition远程代码执行漏洞

Bugtraq ID:64242 CVE ID:CVE-2013-6810 EMC Connectrix是一款网络交换机解决方案，EMC Connectrix Manager提供Connectrix server的接口，可对设备进行管理和保护。 EMC Connectrix Manager不正确限制对某些Servlet的访问，允许远程攻击者利用漏洞提交特殊的请求，可获取敏感文件信息，操作数据或执行任意代码。 0 EMC Connectrix Manager 12.x 厂商补丁： EMC ----- EMC Connectrix Manager Converged Network...

Linux Kernel KVM 'apic_get_tmcct()'函数拒绝服务漏洞

Bugtraq ID:64270 CVE ID:CVE-2013-6367 Linux Kernel是一款开源的操作系统。 Linux KVM LAPIC实现中的'apicgettmcct'函数存在一个除零错误，允许本地特权用户使宿主系统崩溃。 0 Linux Kernel 厂商补丁： redhat ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： https://rhn.redhat.com/errata/RHSA-2013-1801.html https://rhn.redhat.com/errata/RHSA-2013-1802.html...

Eaton Network Shutdown Module 3.21 PHP Code Injection

Eaton Network Shutdown module versions 3.21 and below suffer from a remote PHP code injection vulnerability. This is a python exploit for a previously disclosed finding. !/usr/bin/env python Quick 'n' Dirty - Metasploit module didn't do it for me 2013 - Filip Waeytens - http://www.wsec.be Usage...

Eaton Network Shutdown Module 3.21 - Remote PHP Code Injection

Eaton Network Shutdown Module 3.21 - Remote PHP Code Injection !/usr/bin/env python Quick 'n' Dirty - Metasploit module didn't do it for me 2013 - Filip Waeytens - http://www.wsec.be Usage Example: $ python eaton.py 192.168.1.9 "net user" User accounts for \...

Fedora 19 : python-keyring-3.3-1.fc19 (2013-22694)

======= CHANGES ======= Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable...

Fedora 20 : kernel-3.11.9-300.fc20 (2013-21967)

The stable 3.11.9 update contains a number of important fixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...

Fedora 20 : roundcubemail-0.9.5-1.fc20 (2013-19699)

Roundcubemail just released new 0.9.5 version with fixes for VCE2013-6172will be available soon. Hotfix: https://github.com/roundcube/roundcubemail/commit/4109bb26ce.diff Full announcement : Note that Tenable Network Security has extracted the preceding description block directly from the Fedora...

Fedora 20 : kernel-3.11.2-301.fc20 (2013-17982)

The 3.11.2 update contains a large number of fixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

IBM DB2 Content Manager eClient < 8.4.1.1 Unspecified Security Vulnerability

According to its version number, the IBM DB2 Content Manager eClient install hosted on the remote web server is a version prior to 8.4.1.1, and is, therefore, potentially affected by an unspecified security vulnerability. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Fedora 20 : systemd-207-4.fc20 (2013-17176)

Fixes polkit authentication issue. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300...