[security bulletin] HPSBHF03310 rev.1 - HP Thin Clients running Windows Embedded Standard 7 (WES7) or Windows Embedded Standard 2009 (WES09) with HP Easy Deploy, Remote Elevation of Privilege, Execution of Code

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04629160 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04629160 Version: 1 HPSBHF03310 rev....

HPSBHF03310 rev.2 - HP Thin Clients running Windows Embedded Standard 7 (WES7) or Windows Embedded Standard 2009 (WES09) with HP Easy Deploy, Remote Elevation of Privilege, Execution of Code

Potential Security Impact Remote elevation of privilege, execution of code VULNERABILITY SUMMARY Potential security vulnerabilities have been identified with certain HP Thin Clients running Windows Embedded Standard 7 WES7 and Windows Embedded Standard 2009 WES09 and all versions of HP Easy Deplo...

PT-2014-8821

Name of the Vulnerable Software and Affected Versions Digital Zoom Studio DZS Video Gallery plugin for WordPress affected versions not specified Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web...

CVE-2014-9094: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in deploy/designer/preview.php in the Digital Zoom Studio DZS Video Gallery plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 swfloc or 2 designrand parameter...

CVE-2014-6074

IBM UrbanCode Deploy 6.1.0.2 before IF1 allows remote authenticated users to read keystore secret keys via a direct request to a UI page...

Design/Logic Flaw

IBM UrbanCode Deploy 6.1.0.2 before IF1 allows remote authenticated users to read keystore secret keys via a direct request to a UI page...

CVE-2014-6074

IBM UrbanCode Deploy 6.1.0.2 before IF1 is affected. The flaw allows remote authenticated users to read keystore secret keys via direct access to a UI page, potentially exposing all encrypted values and SSL communications between server and agents. The IBM security bulletin notes the affected pro...

CVE-2014-6074

IBM UrbanCode Deploy 6.1.0.2 before IF1 allows remote authenticated users to read keystore secret keys via a direct request to a UI page...

PT-2014-7024

Name of the Vulnerable Software and Affected Versions IBM UrbanCode Deploy version 6.1.0.2 before IF1 Description The issue allows remote authenticated users to read keystore secret keys via a direct request to a UI page. Recommendations For IBM UrbanCode Deploy version 6.1.0.2, apply the IF1 pat...

CVE-2014-6074: Undefined Security Weakness

IBM UrbanCode Deploy 6.1.0.2 before IF1 allows remote authenticated users to read keystore secret keys via a direct request to a UI page...

DZS Video Gallery - deploy/preview_skin_overlay.swf logoLink Parameter Reflected XSS

The dzs-videogallery WordPress plugin was affected by a deploy/previewskinoverlay.swf logoLink Parameter Reflected XSS security vulnerability...

JBoss JMX Console Beanshell Deployer WAR Upload and Deployment

This module can be used to install a WAR file payload on JBoss servers that have an exposed "jmx-console" application. The payload is put on the server by using the jboss.system:BSHDeployer's createScriptDeployment method. This module requires Metasploit: https://metasploit.com/download Current...

Symantec Workspace Streaming - Arbitrary File Upload (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rexml/document' class Metasploit3 'Symantec Workspace Streaming Arbitrary File Upload', 'Description' = %q This module exploits a code executio...

Symantec Workspace Streaming Arbitrary File Upload Exploit

This Metasploit module exploits a code execution flaw in Symantec Workspace Streaming. The vulnerability exists in the ManagementAgentServer.putFile XMLRPC call exposed by the asagent.exe service, which allows for uploading arbitrary files under the server root. This Metasploit module abuses the...

CVE-2013-2034

Multiple cross-site request forgery CSRF vulnerabilities in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1 allow remote attackers to hijack the authentication of administrators for requests that 1 execute arbitrary code or 2 initiat...

Symantec Workspace Streaming ManagementAgentServer.putFile XMLRPC Request Arbitrary File Upload

This module exploits a code execution flaw in Symantec Workspace Streaming. The vulnerability exists in the ManagementAgentServer.putFile XMLRPC call exposed by the asagent.exe service, which allows for uploading arbitrary files under the server root. This module abuses the auto deploy feature in...

Apache Tomcat 5.5.25 - Cross-Site Request Forgery

Apache Tomcat 5.5.25 - Cross-Site Request Forgery +--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Apache Tomcat 5.5.25 CSRF Vulnerabilities Date : 10-24-2013 Author : Ivano Binetti...

Apache Tomcat 5.5.25 Cross Site Request Forgery

+--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Apache Tomcat 5.5.25 CSRF Vulnerabilities Date : 10-24-2013 Author : Ivano Binetti http://ivanobinetti.com Author : Gianmarco Pirozzi...

Apache Tomcat 5.5.25 - Cross-Site Request Forgery

+--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Apache Tomcat 5.5.25 CSRF Vulnerabilities Date : 10-24-2013 Author : Ivano Binetti http://ivanobinetti.com Author : Gianmarco Pirozzi...

Honeywell HscRemoteDeploy.dll ActiveX Control vulnerability

Added: 04/19/2013 CVE: CVE-2013-0108 BID: 58134 OSVDB: 90583 Background Honeywell offers software solutions which integrate different systems and devices such as HVAC, security, safety, lighting, and energy into a common platform. Problem A vulnerability in multiple Honeywell products allows...