PT-2014-3232

Name of the Vulnerable Software and Affected Versions Belkin WeMo Home Automation firmware versions prior to 3949 Description The issue concerns the lack of SSL use for the distribution feed, allowing man-in-the-middle attackers to install arbitrary firmware by spoofing a distribution server...

Content Spoofing in the createrssfeed action

A third party scan found that createrssfeed action is vulnerable to content spoofing|https://www.owasp.org/index.php/ContentSpoofing, in specific text injection. In this case the content spoofing may be used to perform a phishing attack on users. How to reproduce: 1. go to...

Content Spoofing in the createrssfeed action

A third party scan found that createrssfeed action is vulnerable to content spoofing|https://www.owasp.org/index.php/ContentSpoofing, in specific text injection. In this case the content spoofing may be used to perform a phishing attack on users. How to reproduce: 1. go to...

Content Spoofing in the createrssfeed action

A third party scan found that createrssfeed action is vulnerable to content spoofing|https://www.owasp.org/index.php/ContentSpoofing, in specific text injection. In this case the content spoofing may be used to perform a phishing attack on users. How to reproduce: 1. go to...

Satellite/Spacewalk: header injection flaw

CRLF injection vulnerability in spacewalk-java before 2.1.148-1 and Red Hat Network RHN Satellite 5.6 allows remote attackers to inject arbitrary HTTP headers, and conduct HTTP response splitting attacks and cross-site scripting XSS attacks, via the returnurl parameter...

Fedora 20 : ikiwiki-3.20140125-1.fc20 (2014-1747)

Update to the latest stable version. Changes in ikiwiki 3.20140125 : - inline: Allow overriding the title of the feed. Closes: http://bugs.debian.org/735123 Thanks, Christophe Rhodes - osm: Escape name parameter. Closes: http://bugs.debian.org/731797 Changes in ikiwiki 3.20140102 : - aggregate:...

Digi International OpenSSL Vulnerability

OVERVIEW Digi International has identified five products that are vulnerable to the OpenSSL Heartbleed bug. Digi International has produced downloadable firmware upgrade versions that mitigate this vulnerability. This vulnerability could be exploited remotely. Exploits that target this...

Important: Red Hat Security Advisory: thunderbird security update

An updated thunderbird package that fixes several security issues is now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

SOL14969 - BIG-IP Edge and FirePass client information leakage vulnerability CVE-2013-6024

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

SOL14919 - Socat vulnerabilities CVE-2010-2799, CVE-2012-0219, and CVE-2013-3571

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

SOL14930 - PHP vulnerability CVE-2011-4718

Recommended action None Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custom RSS feed to view new and updated documents...

SOL14909 - OpenSSL vulnerability CVE-2013-4248

Recommended Action None Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custom RSS feed to view new and updated documents. SOL4602: Overview of the F5 security vulnerability response policy...

SOL14901 - SASL vulnerability CVE-2013-4122

Recommended Action None Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custom RSS feed to view new and updated documents. SOL4602: Overview of the F5 security vulnerability response policy SOL4918: Overview of the F5 critical issue...

CVE-2013-2629

Leed Light Feed, possibly before 1.5 Stable, allows remote attackers to bypass authorization via vectors related to the 1 importForm, 2 importFeed, 3 addFavorite, or 4 removeFavorite actions in action.php...

Authorization

Leed Light Feed, possibly before 1.5 Stable, allows remote attackers to bypass authorization via vectors related to the 1 importForm, 2 importFeed, 3 addFavorite, or 4 removeFavorite actions in action.php...

CVE-2013-2629

Leed Light Feed, possibly before 1.5 Stable, allows remote attackers to bypass authorization via vectors related to the 1 importForm, 2 importFeed, 3 addFavorite, or 4 removeFavorite actions in action.php...

CVE-2013-2629

Leed (Light Feed) before 1.5 Stable is affected by CVE-2013-2629 through an authentication bypass in action.php, enabling remote attackers to access functions such as importForm, importFeed, addFavorite, and removeFavorite without proper user verification. The issue is part of a set of vulnerabil...

CVE-2013-2629: Improper Input Validation

Leed Light Feed, possibly before 1.5 Stable, allows remote attackers to bypass authorization via vectors related to the 1 importForm, 2 importFeed, 3 addFavorite, or 4 removeFavorite actions in action.php...

CVE-2013-2628

Multiple cross-site request forgery CSRF vulnerabilities in action.php in Leed Light Feed, possibly before 1.5 Stable, allow remote attackers to hijack the authentication of administrators for unspecified requests, related to the lack of an anti-CSRF token...

Sql injection

SQL injection vulnerability in action.php in Leed Light Feed, possibly before 1.5 Stable, allows remote attackers to execute arbitrary SQL commands via the id parameter in a removeFolder action...