Oracle: Security Advisory (ELSA-2015-0674)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

A New Company Called Alphabet Now Owns Google; Sundar Pichai Becomes New CEO

Well, this was a very unexpected move by Google. Google Co-Founder Larry Page announced a restructuring of the whole company, revealing the creation of the umbrella "Alphabet" corporation. But, don’t worry… Google isn’t dead! Rather, Google will become part of Alphabet. Why Google Rebrands As...

Kguard Digital Video Recorder Bypass Issues

CVEID: CVE-2015-4464 SUBJECT: Insufficient Authorization Checks Request Handling Remote Authentication Bypass for Kguard Digital Video Recorders DESCRIPTION: A deficiency in handling authentication and authorization has been found with Kguard 104/108/v2 models. While password-based authentication...

TinySRP Buffer Overflow

Dear Fulldisclosure, I submitted the below vulnerability to the HP Zero Day Initiative. They responded that they are not interested in vulnerabilities in this "product". Further, I tried to contact one of the authors Eric A. Young; the email bounced. I am busy with my day job and do not have the...

Moderate: Red Hat Security Advisory: docker security update

Updated docker packages that fix one security issue are now available for Red Hat Enterprise Linux 7 Extras. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available...

Ubuntu: Security Advisory (USN-2543-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress Plugin Easy Social Icons 1.2.2 - Cross-Site Request Forgery

WordPress Plugin Easy Social Icons 1.2.2 - Cross-Site Request Forgery ==================================================== Product: Easy Social Icons WordPress plugin Vendor: CyberNetikz Tested Version: 1.2.2 Vulnerability Type: XSS CWE-79 and CSRF CWE-352 Risk Level: Medium Solution Status: Solv...

WordPress Plugin Easy Social Icons 1.2.2 - Cross-Site Request Forgery

==================================================== Product: Easy Social Icons WordPress plugin Vendor: CyberNetikz Tested Version: 1.2.2 Vulnerability Type: XSS CWE-79 and CSRF CWE-352 Risk Level: Medium Solution Status: Solved in version 1.2.3 Discovered and Provided: Eric Flokstra - ITsec...

WordPress Easy Social Icons 1.2.2 CSRF / XSS

==================================================== Product: Easy Social Icons WordPress plugin Vendor: CyberNetikz Tested Version: 1.2.2 Vulnerability Type: XSS CWE-79 and CSRF CWE-352 Risk Level: Medium Solution Status: Solved in version 1.2.3 Discovered and Provided: Eric Flokstra - ITsec...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2014-3108)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-3108 advisory. - net: guard tcpsetkeepalive to tcp sockets Eric Dumazet Orabug: 20224099 CVE-2012-6657 - isofs: Fix unbounded recursion when processing relocated...

Aztech Modem Routers - Session Hijacking

source: https://www.securityfocus.com/bid/69811/info Multiple Aztech Modem Routers are prone to a session-hijacking vulnerability. An attacker can exploit this issue to gain unauthorized access to the affected device. !/usr/bin/perl Title: Aztech Modem Broken Session Management Exploit Author: Er...

USN-2317-1: Linux kernel (Trusty HWE) vulnerabilities

Eric W. Biederman discovered a flaw with the mediation of mount flags in the Linux kernel's user namespace subsystem. An unprivileged user could exploit this flaw to by-pass mount restrictions, and potentially gain administrative privileges. CVE-2014-5207 Kenton Varda discovered a flaw with...

Oracle Linux 6 / 7 : unbreakable enterprise kernel (ELSA-2014-3067)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-3067 advisory. - net: Use netlinknscapable to verify the permisions of netlink messages Eric W. Biederman Orabug: 19404231 CVE-2014-0181 Tenable has extracted the...

Apache Struts includeParams Remote Code Execution

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3...

Oracle Database Server <= 10.1.0.2 - Buffer Overflow Exploit

No description provided by source. / Advanced SQL Injection in Oracle databases Exploit for the buffer overflow vulnerability in procedure MDSYS.MD2.SDOCODESIZE of Oracle Database Server version 10.1.0.2 under Windows 2000 Server SP4. Fixes available at http://metalink.oracle.com. The exploit...

InterWorx Web Control Panel Cross Site Scripting Vulnerability

InterWorx Web Control Panel version 5.0.12 build 569 suffers from a cross site scripting vulnerability. ============================================== Product: InterWorx Web Control Panel Vendor: InterWorx LLC Tested Version: 5.0.12 build 569 Vulnerability Type: Cross-Site Scripting CWE-79 CVE...

InterWorx 5.0.13 Build 574 SQL Injection

================================================= Title: SQL injection in InterWorx Control Panel Product: InterWorx Web Control Panel Vendor: InterWorx LLC Tested Version: 5.0.13 build 574 Vulnerability Type: SQL Injection CWE-89 CVE Reference: CVE-2014-2531 Solution Status: Fixed in Version...

Researcher Eric Filiol Withdraws CanSecWest Presentation

A presenter at this week’s CanSecWest security conference has withdrawn his scheduled talk for fear the information could be used to attack critical infrastructure worldwide. Eric Filiol, scientific director of the Operational Cryptology and Virology lab. CTO/CSO of the ESIEA in France, pulled hi...

SA-CONTRIB-2014-006 - Language Switcher Dropdown - Open Redirect

The Language Switcher Dropdown module enables you to place a block with a convenient drop-down language switcher. After choosing a value the user is redirected to the url of the relevant language. The module doesn't check that the url provided is a valid internal path prior to redirecting. CVE...

nagios -- denial of service vulnerability

Eric Stanley reports: Most CGIs previously incremented the input variable counter twice when it encountered a long key value. This could cause the CGI to read past the end of the list of CGI variables...