Important: Red Hat Security Advisory: cfme security, bug fix, and enhancement update

Updated cfme packages that fix several security issues, multiple bugs, and add one enhancement are now available for Red Hat CloudForms 3.0. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which gi...

TweetDeck Taken Down in Wake of XSS Attacks

TweetDeck services have been disabled for the time being as Twitter tries to get a handle on a cross-site scripting vulnerability that caused mountains of consternation on the social networking platform this morning. We've temporarily taken TweetDeck services down to assess today's earlier securi...

Low: Red Hat Security Advisory: python-django-horizon security update

Updated python-django-horizon packages that fix one security issue are now available for Red Hat Enterprise Linux OpenStack Platform 4.0. The Red Hat Security Response Team has rated this update as having Low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a...

HP Release Control Authenticated XXE Exploit

Exploit for windows platform in category web applications This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'HP Release Control Authenticated XXE', 'Description' = %q This module take...

HP Release Control 9.20.0000 Build 395 XXE

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'HP Release Control Authenticated XXE', 'Description' = %q This module take advantage of three separate vulnerabilities in order to re...

CVE-2013-4471

The Identity v3 API in OpenStack Dashboard Horizon before 2013.2 does not require the current password when changing passwords for user accounts, which makes it easier for remote attackers to change a user password by leveraging the authentication token for that user...

CVE-2013-4471

CVE-2013-4471 concerns the Identity v3 API in OpenStack Dashboard (Horizon) prior to 2013.2, where the password-change flow does not require the current password, allowing an attacker with a valid authentication token to change a user’s password. Affected component: Horizon’s Identity v3 password...

Openfiler 2.99.1 Arbitrary Code Execution Vulnerability

Openfiler version 2.99.1 suffers from a remote arbitrary code execution vulnerability. Exploit Title: Arbitrary Code Execution in Openfiler Exploit author: Dolev Farhi @f1nhack Date 07/05/2014 Vendor homepage: http://www.openfiler.com Affected Software version: 2.99.1 Alerted vendor: 7.5.14...

Puppet Dashboard Multiple XSS Vulnerabilities

According to its self-reported version number, the Puppet Dashboard install on the remote host is later than version 1.0 but prior to 1.2.5. It is, therefore, affected by multiple cross-site scripting vulnerabilities. Multiple cross-site scripting flaws exist where unspecified input is not...

Moderate: Red Hat Security Advisory: Django security update

Updated Django packages that fix three security issues are now available for Red Hat Enterprise Linux OpenStack Platform 4.0. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed...

Moderate: Red Hat Security Advisory: Django security update

Updated Django packages that fix three security issues are now available for Red Hat Enterprise Linux OpenStack Platform 3.0. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed...

CVE-2014-0157

CVE-2014-0157 is an XSS in Horizon (OpenStack Dashboard) via the Heat template description field, affecting OpenStack Horizon 2013.2 before 2013.2.4 and Icehouse before icehouse-rc2. Consequence: remote attacker could inject arbitrary script/HTML. Remediation: apply the Horizon fixes (e.g., updat...

PT-2014-3506

Name of the Vulnerable Software and Affected Versions OpenStack Dashboard aka Horizon versions 2013.2 before 2013.2.4 OpenStack Dashboard aka Horizon versions icehouse before icehouse-rc2 Description A cross-site scripting XSS issue exists in the Horizon Orchestration dashboard, allowing remote...

OpenStack Horizon Orchestration Dashboard栈模版描述字段存储型跨站脚本漏洞

CVE ID:CVE-2014-0157 OpenStack Horizon用于为所有OpenStack服务提供一个模块化的基于页面的用户接口。 OpenStack Horizon Orchestration dashboard没有校验栈模版的描述符字段输入，允许远程攻击者利用漏洞注入恶意脚本或HTML代码，当恶意数据被查看时，可获取敏感信息或劫持用户会话。 0 OpenStack Horizon 2013.2 OpenStack Horizon 2013.2.3 目前厂商已经发布了升级补丁以修复漏洞，请下载使用： https://review.openstack.org/86054...

Confluence OnDemand dashboard - popular tab - user is shown links to pages they are restricted from viewing

Children of restricted pages do not get hidden from users who do not have permission to see the parent. Steps to reproduce: Create an unrestricted page. Create a child page, also unrestricted. Create a second user. Confirm the user can see the two new pages in their dashboard. Restrict viewing of...

Confluence OnDemand dashboard - popular tab - user is shown links to pages they are restricted from viewing

Children of restricted pages do not get hidden from users who do not have permission to see the parent. Steps to reproduce: Create an unrestricted page. Create a child page, also unrestricted. Create a second user. Confirm the user can see the two new pages in their dashboard. Restrict viewing of...

Moderate: Red Hat Security Advisory: python-django-horizon security and bug fix update

Updated python-django-horizon packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux OpenStack Platform 3.0. The Red Hat Security Response Team has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base...

Facebook Bug Bounty Submissions Dramatically Increase

Facebook today reported a dramatic increase in 2013 submissions to its bug bounty program, and said that despite reports from researchers that it’s becoming difficult to find severe bugs on its various properties, the social network plans to increase rewards for critical bugs. “The volume of...

SonicWall Dashboard Backend Server - Client Side Cross Site Scripting Web Vulnerability

Document Title: =============== SonicWall Dashboard Backend Server - Client-Side Cross Site Scripting Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1100 Release Date: ============= 2014-03-06 Vulnerability Laboratory ID VL-ID:...

CVE-2014-2118

Multiple cross-site scripting XSS vulnerabilities in dashboard-related HTML documents in Cisco Prime Security Manager aka PRSM 9.2.1-2 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCun50687...