Unsupported Brocade Fabric OS

According to its version, the installation of Fabric OS on the remote host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities. TRUSTED...

Unsupported Fortinet Hardware and Operating System

According to its version, the remote Fortinet hardware or operating system is obsolete and is no longer being maintained or supported by Fortinet. Lack of support for the hardware implies that future hardware will not be supported in fixes, replacements and that current and future operating syste...

[CVE-2013-6835] - iOS 7.0.6 Safari/Facetime-Audio Privacy issue

Affected Vendor: https://www.apple.com/ - Affected Software: Safari/Facetime on iOS - Affected Version: iOS 7 prior to 7.1 - Issue Type: Lack of user confirmation leading to a call being established, revealing the user's identity phone number or email address - Release Date: March 10, 2014 -...

PT-2014-3232

Name of the Vulnerable Software and Affected Versions Belkin WeMo Home Automation firmware versions prior to 3949 Description The issue concerns the lack of SSL use for the distribution feed, allowing man-in-the-middle attackers to install arbitrary firmware by spoofing a distribution server...

WordPress Buddypress 1.9.1 Privilege Escalation

Vulnerability: Wordpress plugin Buddypress 2 Visit the url http://example.com/groups/create/step/group-details/ 3 Enjoy the power -Pietro Oliva-...

Attacking ICS Systems 'Like Hacking in the 1980s'

PUNTA CANA–Here’s how nuts the world of ICS security is: Jonathan Pollet, a security consultant who specializes in ICS systems, was at a Texas amusement park recently and the ride he was waiting for was malfunctioning. The operator told him the ride used a Siemens PLC as part of the control syste...

PT-2014-1040

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 6 through 8 Description The issue is related to memory corruption, allowing remote attackers to execute arbitrary code or cause a denial of service. This is due to improper access to objects in memory, whic...

CVE-2013-6141

Unspecified vulnerability in op5 Monitor before 6.1.3 allows attackers to read arbitrary files via unknown vectors related to lack of authorization...

CVE-2013-6141: Undefined Security Weakness

Unspecified vulnerability in op5 Monitor before 6.1.3 allows attackers to read arbitrary files via unknown vectors related to lack of authorization...

PT-2014-3030

Name of the Vulnerable Software and Affected Versions op5 Monitor versions prior to 6.1.3 Description The issue is related to a lack of authorization, allowing attackers to read arbitrary files. Recommendations For versions prior to 6.1.3, update to version 6.1.3 or later to resolve the issue...

PT-2014-3348

Name of the Vulnerable Software and Affected Versions e107 versions through 1.0.4 Description The issue concerns the lack of validation for the user ban field in the fpw.php file. This oversight allows remote attackers to reset passwords by sending a 'pwsubmit' request, provided they have access ...

PT-2014-3347

Name of the Vulnerable Software and Affected Versions Check Point Endpoint Security MI Server versions through R73 3.0.0 HFA2.5 Description The issue allows man-in-the-middle attackers to spoof SSL servers by presenting an arbitrary certificate during a session established by a client, due to the...

Sierra Wireless industrial gateways security vulnerabilities

A wireless gateway suitable for a number of industrial applications is vulnerable to remote exploit because of a lack of encryption in its update and reprogramming processes, an advisory from the Industrial Control Systems Cyber Emergency Response Team said yesterday. The Sierra Wireless AirLink...

ProjectForge跨站请求伪造和跨站脚本漏洞

ProjectForge是一个基于Web的项目管理解决方案包括:工时表Timesheet、费用管理、项目甘特图,控制和管理工程分解结构。 1 某些未明输入在用于JSON自动完成响应前未能正确过滤，攻击者可以在用户访问恶意数据时，利用漏洞在用户浏览器会话上下文中注入任意HTML和脚本代码。 2程序允许用户不进行适当的有效性检查，通过HTTP请求执行某些操作。当登录的用户访问特制的网页时，攻击者可以执行某些未指定的操作。 0 ProjectForge 5.x ProjectForge 5.3版本以修复此漏洞，建议用户下载使用： http://www.projectforge.org/...

PT-2013-3132 · Matplotlib · Matplotlib

Name of the Vulnerable Software and Affected Versions: matplotlib affected versions not specified Description: The issue is related to a buffer overrun in matplotlib. No additional details are provided about the nature of the issue, affected devices, or real-world incidents. Recommendations: At t...

Byword 2.x File Overwrite

Affected Vendor: http://metaclassy.com/ - Affected Software: Byword for iOS - Affected Version: 2.x prior to 2.1 - Issue Type: Lack of validation/user confirmation leading to destruction of data - Release Date: 29 Sept 2013 - Discovered by: Guillaume Ross - CVE Identifier: CVE-2013-5725 - Issue...

CVE-2013-5035

Multiple race conditions in HtmlCleaner before 2.6, as used in Open-Xchange AppSuite 7.2.2 before rev13 and other products, allow remote authenticated users to read the private e-mail of other persons in opportunistic circumstances by leveraging lack of thread safety and performing a rapid series...

CVE-2013-4967

Puppet Enterprise before 3.0.1 allows remote attackers to obtain the database password via vectors related to how the password is "seeded as a console parameter," External Node Classifiers, and the lack of access control for /nodes...

INSTEON Hub 2242-222 - Lack of Web and API Authentication

INSTEON Hub 2242-222 - Lack of Web and API Authentication Trustwave SpiderLabs Security Advisory TWSL2013-023: Lack of Web and API Authentication Vulnerability in INSTEON Hub Published: 8/01/13 Version: 1.0 Vendor: INSTEON http://www.INSTEON.com/ Product: Hub Version affected: 2242-222 model...

PT-2013-5254

Name of the Vulnerable Software and Affected Versions Verizon Wireless Network Extender versions SCS-26UC4 and SCS-2U01 Description The issue allows remote attackers to obtain ESN and MIN values from arbitrary phones by sniffing the network for registration packets, making it easier to conduct...