Asterisk Recording Interface 0.7.15 Audio.PHP Information Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/17641/info Asterisk Recording Interface is prone to an information-disclosure vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this...

SCO Unixware 7.1 '/var/mail' permissions Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/849/info Certain versions of SCO's UnixWare only 7.1 was tested ship with the /var/mail/ directory with permission 777-rwxrwxrwx . This in effect allows malicious users to read incoming mail for users who do not yet have ...

Xedus Web Server 1.0 testgetrequest.x username Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/11071/info It is reported that Xedus is susceptible to multiple vulnerabilities. The first reported issue is a denial of service vulnerability. The affected application is unable to service multiple simultaneous...

eyeos <= 1.9.0.2 - Stored XSS vulnerability using image files

No description provided by source. Title: eyeOS = 1.9.0.2 Stored XSS vulnerability using image files Product: eyeOS = 1.9.0.2 Author: Alberto Ortega @a0rtega albertoatpentboxdotnet http://securitybydefault.com/ - Summary: A stored XSS vulnerability using image files jpg, png, gif tested affects t...

KLA10002 Multiple vulnerabilities in Adobe Flash Player

Multiple serious vulnerabilities have been found in Adobe Flash Player. Malicious users can exploit these vulnerabilities to inject arbitrary script or HTML, access restrictions, execute arbitrary code or cause denial of service Vectors related to unknown applications can be exploited to inject...

KLA10014 Multiple SUI vulnerabilities in Opera

Multiple low severity vulnerabilities have been found in Opera versions 21 and earlier. Malicious users can exploit these vulnerabilities to spoof user interface. Vectors related to the address bar can be exploited to fool some users via user interface spoofing. Original advisories Opera blog...

ESA-2014-003: RSA® Data Loss Prevention Improper Session Management Vulnerability

ESA-2014-003.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-003: RSA® Data Loss Prevention Improper Session Management Vulnerability EMC Identifier: ESA-2014-003 CVE Identifier: CVE-2014-0624 Severity Rating: CVSS v2 Base Score: 3.5 AV:L/AC:H/Au:S/C:P/I:P/A:P Affected Products: RSA Da...

KLA10336 Multiple vulnerabilities in Sophos Web Appliance

Multiple critical vulnerabilities have been found in Sophos Web Appliance. Malicious users can exploit these vulnerabilities to execute arbitrary commands or change admin password. Below is a complete list of vulnerabilities 1. Vectors related to the netinterface configuration page can be exploit...

KLA10543 Security bypass vulnerability in Microsoft Silverlight

An unspecified vulnerability was found in Microsoft Silverlight. By exploiting this vulnerability malicious users can bypass security restrictions. This vulnerability can be exploited remotely via an unknown vectors. Original advisories MS14-014 CVE-2014-0319 Related products Microsoft-Silverligh...

KLA10209 ACE vulnerability in IBM Security AppScan

The lack of an integrity check was found in IBM Security AppScan Standart. By exploiting this vulnerability malicious users can execute arbitrary code. This vulnerability can be exploited remotely via a specially designed file. Original advisories - Related products...

KLA10349 Vulnerability in Sylpheed

An unspecified vulnerability was found in Sylpheed. By exploiting this vulnerability malicious users can cause unknown impact via unknown vectors. Original advisories Changelog Related products Sylpheed CVE list Solution Update to latest version Affected Products - Sylpheed versions 3.3.0 and...

Upload vulnerability science[1]-The file upload form is Web Security the main threat-vulnerability warning-the black bar safety net

In order to allow the end user to upload files to your website, just like Is to compromise your server for a malicious user to open another door. Even so, in today's modern Internet Web applications, it is a common requirement, because it helps to improve your business efficiency. On Facebook and...

User invite functionality available to non-admins

The REST API which manages user invites ensures that only adminstrators can generate a new invite token. However, no similar access controls are present on the methods which are used to invite new users, or to revert to the previous security token – these can be successfully called by any...

KLA10296 ACE vulnerability in Polaris

An unspecified vulnerability was found in Polaris. By exploiting this vulnerability malicious users can execute arbitrary code. This vulnerability can be exploited remotely via a specially designed DOCX file. Original advisories ZDI Related products Polaris-Office-for-Android CVE list Solution...

Debian Security Advisory DSA 2696-1 (otrs2 - privilege escalation)

A vulnerability has been discovered in the Open Ticket Request System, which can be exploited by malicious users to disclose potentially sensitive information. An attacker with a valid agent login could manipulate URLs in the ticket split mechanism to see contents of tickets they are not permitte...

Debian: Security Advisory (DSA-2696-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

KLA10327 Vulnerabilities in Skype

An unspecified vulnerability was found in Skype. By exploiting this vulnerability malicious users can cause unknown impact via unknown vectors. Original advisories Skype changelog Related products Skype-for-Windows CVE list Solution Update to latest version Affected Products - Skype...

ESA-2012-057: EMC Smarts Network Configuration Manager Multiple Vulnerabilities

ESA-2012-057.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2012-057: EMC Smarts Network Configuration Manager Multiple Vulnerabilities EMC Identifier: ESA-2012-057 CVE Identifier: CVE-2012-4614 CVE Identifier: CVE-2012-4615 Severity Rating: CVSS v2 Base Score: See below for individual...

PostgreSQL 8.x/9.x 存在多个安全漏洞

CVE-2012-0866 CVE-2012-0867 CVE-2012-0868 PostgreSQL是一款对象关系型数据库管理系统，支持扩展的SQL标准子集 PostgreSQL存在多个安全漏洞，允许恶意用户绕过部分安全限制，进行伪造攻击或操作某些数据 -在触发函数上没有对CREATE TRIGGER进行正确的权限检查，可利用此漏洞标记触发函数为SECURITY DEFINER，可授权EXECUTE权限 -在校验SSL证书的公用名时不正确把名称截断为32个字符，可导致不正确校验伪造证书...

Stoneware WebNetwork6 Cross Site Request Forgery / Cross Site Scripting

Stoneware WebNetwork6 Vulnerability Assessment Conducted by: Leland Public Schools Stoneware Customer Jacob Holcomb Network Engineer for LPS Conducted for: Leland Public Schools Purchaser of WebNetwork product. Test was to assure cloud security Stoneware INC. Discovered Zero Day vulnerabilities...