Design/Logic Flaw

The user.login function in Zabbix before 1.8.16 and 2.x before 2.0.5rc1 allows remote attackers to override LDAP configuration via the cnf parameter...

CVE-2013-1364

The user.login function in Zabbix before 1.8.16 and 2.x before 2.0.5rc1 allows remote attackers to override LDAP configuration via the cnf parameter...

CVE-2013-1364

The user.login function in Zabbix before 1.8.16 and 2.x before 2.0.5rc1 allows remote attackers to override LDAP configuration via the cnf parameter...

CVE-2013-1364

Summary: CVE-2013-1364 affects Zabbix prior to 1.8.16 and 2.x prior to 2.0.5rc1, where the user.login function can be abused to override LDAP configuration via the cnf parameter, enabling a remote attacker to modify LDAP settings. Root cause: insecure handling of the cnf parameter in user.login l...

CVE-2013-7091

Directory traversal vulnerability in /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zimbra 7.2.2 and 8.0.2 allows remote attackers to read arbitrary files via a .. dot dot in the skin parameter. NOTE: this can be leveraged to execute arbitrary code by obtaining LD...

Directory traversal

Directory traversal vulnerability in /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zimbra 7.2.2 and 8.0.2 allows remote attackers to read arbitrary files via a .. dot dot in the skin parameter. NOTE: this can be leveraged to execute arbitrary code by obtaining LD...

CVE-2013-7091

Directory traversal vulnerability in /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zimbra 7.2.2 and 8.0.2 allows remote attackers to read arbitrary files via a .. dot dot in the skin parameter. NOTE: this can be leveraged to execute arbitrary code by obtaining LD...

Zimbra邮件系统文件包含漏洞

CVE ID:CVE-2013-7091 Zimbra是一家提供专业的电子邮件软件开发供应商其产品在全球大型企业有广泛应用。 Zimbra文件包含漏洞存在于/res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx TemplateMsg.js.zgz中，利用该漏洞攻击者可以查看本地配置文件localconfig.xml的信息，包括LDAP协议授权的根目录，可以通过窃取的LDAP信任请求/service/admin/soap API，创建具有管理员权限的用户，从而获得管理控制权。 0 Zimbra 2013 厂商补丁： Zimbra...

Cisco Unified Communications Manager - TFTP Service

Cisco Unified Communications Manager - TFTP Service !/bin/bash Proof of Concept on how to get tftp config files from cisco phones This can be performed anonymously and privileges gathered relies on those assigned to the ldap account Developed by Daniel Svartman [email protected] In case tf...

Cisco Unified Communications Manager - TFTP Service

!/bin/bash Proof of Concept on how to get tftp config files from cisco phones This can be performed anonymously and privileges gathered relies on those assigned to the ldap account Developed by Daniel Svartman [email protected] In case tftp files are encrypted, you will need to hijack a...

Cisco Unified Communications Manager - TFTP Service

Exploit for hardware platform in category local exploits !/bin/bash Proof of Concept on how to get tftp config files from cisco phones This can be performed anonymously and privileges gathered relies on those assigned to the ldap account Developed by Daniel Svartman email protected In case tftp...

Zimbra Privilegie escalation LFI Vulnerability

Exploit for php platform in category web applications Exploit Title: Zimbra 0day exploit / Privilegie escalation via LFI Date: 06 Dec 2013 Exploit Author: rubina119 Contact Email : rubina119atgmail.com Vendor Homepage: http://www.zimbra.com/ Version: 2009, 2010, 2011, 2012 and early 2013 versions...

Zimbra 2009-2013 - Local File Inclusion

Exploit Title: Zimbra 0day exploit / Privilegie escalation via LFI Date: 06 Dec 2013 Exploit Author: rubina119 Contact Email : rubina119atgmail.com Vendor Homepage: http://www.zimbra.com/ Version: 2009, 2010, 2011, 2012 and early 2013 versions are afected, Tested on: Centosx, Ubuntu. CVE : No CVE...

Zimbra Collaboration Server LFI

This module exploits a local file inclusion on Zimbra 8.0.2 and 7.2.2. The vulnerability allows an attacker to get the LDAP credentials from the localconfig.xml file. The stolen credentials allow the attacker to make requests to the service/admin/soap API. This can then be used to create an...

Zimbra 2009-2013 - Local File Inclusion

Zimbra 2009-2013 - Local File Inclusion Exploit Title: Zimbra 0day exploit / Privilegie escalation via LFI Date: 06 Dec 2013 Exploit Author: rubina119 Contact Email : rubina119atgmail.com Vendor Homepage: http://www.zimbra.com/ Version: 2009, 2010, 2011, 2012 and early 2013 versions are afected,...

SuSE 11.2 Security Update : OpenJDK 1.6 (SAT Patch Number 8598)

OpenJDK 1.6 was updated to the new Icedtea release 1.12.7, which includes many fixes for bugs and security issues : - S8006900, CVE-2013-3829: Add new date/time capability - S8008589: Better MBean permission validation - S8011071, CVE-2013-5780: Better crypto provider handling - S8011081,...

[SECURITY] Fedora 19 Update: mingw-curl-7.33.0-1.fc19

cURL is a tool for getting files from HTTP, FTP, FILE, LDAP, LDAPS, DICT, TELNET and TFTP servers, using any of the supported protocols. cURL is designed to work without user interaction or any kind of interactivity. cURL offers many useful capabilities, like proxy support, user authentication, F...

HylaFAXplus LDAP Authentication User Name Buffer Overflow (CVE-2013-5680)

A buffer overflow vulnerability has been reported in HylaFAX+...

389 security update

CentOS Errata and Security Advisory CESA-2013:1752 Updated 389-ds-base packages that fix one security issue are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS ba...

[USN-2034-1] OpenStack Keystone vulnerability

========================================================================== Ubuntu Security Notice USN-2034-1 November 25, 2013 keystone vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...