WordPress XML-RPC PingBack vulnerability analysis-vulnerability warning-the black bar safety net

! Screen Shot 2014-03-12 at 9.47.56 AM A recent article outlines how to use the WordPress XML-RPC pingback functionDDosattack. This article will be on the attack for analysis, while for the site administrator to provide information to protect their website. This is not a new vulnerability WordPre...

[security bulletin] HPSBHF02981 rev.1 - HP Integrated Lights-Out 2, 3, and 4 (iLO2, iLO3, iLO4), IPMI 2.0 RCMP+ Authentication Remote Password Hash Vulnerability (RAKP)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04197764 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04197764 Version: 1 HPSBHF02981 rev....

WordPress Disable Comments插件跨站请求伪造漏洞

WordPress是一款内容管理系统。 由于应用程序允许用户通过未经验证的HTTP请求执行某些操作，攻击者可以利用漏洞当登录的管理员访问一个恶意网站时禁用注释。 0 WordPress Disable Comments Plugin 1.x WordPress Disable Comments 1.0.4版本以修复此漏洞，建议用户下载使用： http://wordpress.org/plugins/disable-comments/changelog/...

CVE-2012-5650

Cross-site scripting XSS vulnerability in the Futon UI in Apache CouchDB before 1.0.4, 1.1.x before 1.1.2, and 1.2.x before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters to the browser-based test suite...

PT-2014-2769 · Gilles Lamiral · Imapsync

Name of the Vulnerable Software and Affected Versions: imapsync versions 1.564 and earlier Description: The issue concerns the default behavior of performing a release check, which results in sending sensitive information, including imapsync version, operating system, and Perl version, to the...

Fedora 20 : xen-4.3.2-1.fc20 (2014-2802)

update to xen-4.3.2 includes fix for 'Excessive time to disable caching with HVM guests with PCI passthrough', use-after-free in xccpupoolgetinfo under memory pressure Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory...

PT-2014-2155 · Debian · Apt

Name of the Vulnerable Software and Affected Versions: apt versions prior to 0.8.11 Description: The issue allows man-in-the-middle attackers to obtain repository credentials via unspecified vectors when the certificate host name fails validation and Verify-Host is enabled. Recommendations: For...

UBUNTU-CVE-2014-0033

org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct session fixation attacks via a crafted URL...

DNP3/TCP 'Disable Unsolicited Messages' Function Code Detection

Binary data 7097.pasl...

PT-2014-2786 · None +1 · Libtar +1

Name of the Vulnerable Software and Affected Versions: libtar versions 1.2.20 and earlier Description: The issue concerns multiple directory traversal vulnerabilities in the tar extract glob and tar extract all functions. These vulnerabilities allow remote attackers to overwrite arbitrary files b...

Netgear DGN2200 N300 Wireless Router - Multiple Vulnerabilities

Title: Multiple vulnerabilities in NETGEAR N300 WIRELESS ADSL2+ MODEM ROUTER DGN2200 ==================================================================================== Notification Date: 11 February 2014 Affected Vendor: NetGear Affected Hardware: NetGear DGN2200 N300 Wireless ADSL2+ Modem Rout...

SA-CONTRIB-2014-009 - Tagadelic - Information Disclosure

This module provides an API and a few simple turnkey modules, which allows you to easily create tagclouds, weighted lists, search-clouds and such. The 6.x-1.x version does not account for node access modules, thus leading to information being disclosed. This vulnerability is mitigated by the fact...

McAfee VirusScan Enterprise 8.8 < 8.8 Patch 1 DoS

The remote Windows host has a version of McAfee VirusScan Enterprise VSE 8.8 prior to 8.8 Patch 1. It is, therefore, affected by a denial of service vulnerability due to a flaw in Self Protection. Malicious software can change the NTFS folder permissions on VSE folders and disable the software. C...

McAfee VirusScan Enterprise 8.5 / 8.7 hcp:// Security Bypass (SB10012)

The remote Windows host has McAfee VirusScan Enterprise version 8.5 or 8.7. It is, therefore, affected by a security bypass vulnerability due to a failure to properly interact with the processing of 'hcp://' URLs. This can lead to malware execution prior to detection. C Tenable Network Security,...

reuse of wrong HTTP NTLM connection

libcurl can in some circumstances reuse the wrong connection when asked to do an NTLM-authenticated HTTP or HTTPS request. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criterion...

haneWIN DNS Server Denial Of Service Vulnerability

This host is running haneWIN DNS server and is prone to denial of service vulnerability. OpenVAS Vulnerability Test $Id: gbhanewindnsserverdosvuln.nasl 6769 2017-07-20 09:56:33Z teissa $ haneWIN DNS Server Denial Of Service Vulnerability Authors: Antu Sanadi Copyright: Copyright c 2014 Greenbone...

PT-2014-1964 · Libxml2 +2 · Libxml2 +2

Name of the Vulnerable Software and Affected Versions: libxml2 versions prior to 2.9.2 Description: The issue is related to the handling of external entities expansion in libxml2, which can be exploited by remote attackers to cause a denial of service, send HTTP requests to intranet servers, or...

TA14-013A: NTP Amplification Attacks Using CVE-2013-5211

NCCIC / US-CERT National Cyber Awareness System: TA14-013A: NTP Amplification Attacks Using CVE-2013-5211 01/13/2014 05:51 PM EST Original release date: January 13, 2014 | Last revised: January 14, 2014 Systems Affected NTP servers Overview A Network Time Protocol NTP Amplification attack is an...

Debian DSA-2835-1 : asterisk - buffer overflow

Jan Juergens discovered a buffer overflow in the parser for SMS messages in Asterisk. An additional change was backported, which is fully described in http://downloads.asterisk.org/pub/security/AST-2013-007.html With the fix for AST-2013-007, a new configuration option was added in order to allow...

MongoDB 2.x REST Interface RCE Vulnerability (Nov 2012) - Active Check

MongoDB is prone to a remote code execution RCE vulnerability because it fails to properly sanitize user-supplied input. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...