SiteCore XML Control Script Insertion

Hey All, Sitecores “special way” of displaying XML Controls directly allows for a Cross Site Scripting Attack – more can be achieved with these XML Controls and will be documented in another vulnerability report http://target/?xmlcontrol=body20onload=alert123...

MW6 Technologies ActiveX Multiple Buffer Overflows

The remote Windows host has one or more ActiveX controls from MW6 Technologies ActiveX controls that are affected by multiple buffer overflow vulnerabilities. Specifically, these involve the 'Data' parameter as used in the Aztec, DataMatrix, and MaxiCode controls, and successful exploitation coul...

Mozilla Thunderbird 17.0.6 - Input Validation Filter Bypass

Document Title: =============== Mozilla Bug Bounty 5 - WireTap Remote Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=953 Mozilla Bug Tracking ID: 875818 Video: http://www.vulnerability-lab.com/getcontent.php?id=1182 Partner News...

Cisco MediaSense Search and Play Authorization Vulnerability

A vulnerability in the Search and Play interface of Cisco MediaSense could allow an authenticated, remote attacker to access recordings in the Search and Play interface. The vulnerability is due to insufficient authorization controls. An attacker could exploit this vulnerability by accessing the...

nss: CERT_VerifyCert returns SECSuccess (saying certificate is good) even for bad certificates (MFSA 2013-103)

The CERTVerifyCert function in lib/certhigh/certvfy.c in Mozilla Network Security Services NSS 3.15 before 3.15.3 provides an unexpected return value for an incompatible key-usage certificate when the CERTVerifyLog argument is valid, which might allow remote attackers to bypass intended access...

CVE-2013-6040

MW6 Aztec, DataMatrix, and MaxiCode ActiveX controls before version 4.0 vulnerable to arbitrary code via a crafted HTML document. Latest versions 4.0 of MW6 Aztec, DataMatrix, and MaxiCode ActiveX controls have resolved the issue...

CVE-2013-6040

MW6 Aztec, DataMatrix, and MaxiCode ActiveX controls before version 4.0 vulnerable to arbitrary code via a crafted HTML document. Latest versions 4.0 of MW6 Aztec, DataMatrix, and MaxiCode ActiveX controls have resolved the issue...

Hardcoded credentials

Multiple unspecified vulnerabilities in the MW6 Aztec, DataMatrix, and MaxiCode ActiveX controls allow remote attackers to execute arbitrary code via a crafted HTML document...

CVE-2013-6040 MW6 Aztec, DataMatrix, and MaxiCode ActiveX controls versions before 4.0 are vulnerable to arbitrary code via crafted HTML document.

MW6 Aztec, DataMatrix, and MaxiCode ActiveX controls before version 4.0 vulnerable to arbitrary code via a crafted HTML document. Latest versions 4.0 of MW6 Aztec, DataMatrix, and MaxiCode ActiveX controls have resolved the issue...

CVE-2013-6040 MW6 Aztec, DataMatrix, and MaxiCode ActiveX controls versions before 4.0 are vulnerable to arbitrary code via crafted HTML document.

MW6 Aztec, DataMatrix, and MaxiCode ActiveX controls before version 4.0 vulnerable to arbitrary code via a crafted HTML document. Latest versions 4.0 of MW6 Aztec, DataMatrix, and MaxiCode ActiveX controls have resolved the issue...

MW6 Technologies ActiveX controls contain multiple vulnerabilities

Overview MW6 Technologies' MaxiCode, Aztec, and DataMatrix ActiveX controls contain multiple vulnerabilities. Description MW6 Technologies' MaxiCode, Aztec, and DataMatrix ActiveX controls are used for processing barcodes. The ActiveX controls contain multiple vulnerabilities that may lead to...

Microsoft Sharepoint - Bypass & Persistent Vulnerability

Document Title: =============== Microsoft Sharepoint - Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1024 Microsoft Security Response Center MSRC ID: 15181 Release Date: ============= 2014-01-13 Vulnerability Laborator...

Microsoft Internet Explorer mergeAttribues Property Handling Memory Corruption - Ver2 (CVE-2007-0945)

Microsoft Internet Explorer is the most widely used Internet browser. Multiple remote code execution vulnerabilities have been reported in Microsoft Internet Explorer. The vulnerabilities are due to several memory corruption errors in Microsoft Internet Explorer when instantiating the vulnerable...

UBUNTU-CVE-2013-7081

The old Form Content Element component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated editors to generate arbitrary HMAC signatures and bypass intended access restrictions via unspecified vectors...

[USN-2061-1] OpenStack Keystone vulnerability

========================================================================== Ubuntu Security Notice USN-2061-1 December 19, 2013 keystone vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

DOE Breach Report Blasts Poor Patching, IT Management

The U.S. Department of Energy has thrown back the covers on a July breach that exposed the personal information of more than 104,000 individuals, painting a less than flattering portrait of IT and agency management failures around vulnerability management, access controls and a general lack of...

CVE-2013-7043

Multiple cross-site request forgery CSRF vulnerabilities on Cisco Scientific Atlanta DPR2320R2 routers with software 2.0.2r1262-090417 allow remote attackers to hijack the authentication of administrators for requests that 1 change a password via the Password parameter to goform/RgSecurity; 2...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities on Cisco Scientific Atlanta DPR2320R2 routers with software 2.0.2r1262-090417 allow remote attackers to hijack the authentication of administrators for requests that 1 change a password via the Password parameter to goform/RgSecurity; 2...

CVE-2013-7043

Multiple cross-site request forgery CSRF vulnerabilities on Cisco Scientific Atlanta DPR2320R2 routers with software 2.0.2r1262-090417 allow remote attackers to hijack the authentication of administrators for requests that 1 change a password via the Password parameter to goform/RgSecurity; 2...

IG Report Shows DHS Making Progress, But Still Has Room to Improve on Information Security

Although there are still a number of issues that need to be addressed with the Department of Homeland Security’s information security efforts, the department is improving in many areas and making strong progress toward implementing better security controls, a new report from the Inspector General...