TYPO3 Akronymmanager Extension 0.5.0 - SQL Injection Vulnerability

TYPO3 Extension Akronymmanager versions 0.5.0 and below suffer from a remote SQL injection vulnerability. Advisory: SQL Injection in TYPO3 Extension Akronymmanager An SQL injection vulnerability in the TYPO3 extension "Akronymmanager" allows authenticated attackers to inject SQL statements and...

CA20150604-01: Security Notice for CA Common Services

-----BEGIN PGP SIGNED MESSAGE----- CA20150604-01: Security Notice for CA Common Services Issued: June 4, 2015 CA Technologies Support is alerting customers to multiple potential risks with products that bundle CA Common Services on Unix/Linux platforms. A local attacker may exploit these...

Improper validation of certificates when using self-signed certificates 1.8.2

Platform: Desktop-clients Versions: 1.8.2, Date: 6/8/2015 Risk level: Medium CVSS v2 Base Score: 6.1 AV:N/AC:H/Au:N/C:C/I:P/A:N CWE: Improper Validation of Certificate with Host Mismatch CWE-297...

DSS TFTP 1.0 Server - Path Traversal Vulnerability

Document Title: =============== DSS TFTP 1.0 Server - Path Traversal Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1440 Release Date: ============= 2015-02-26 Vulnerability Laboratory ID VL-ID: ==================================== 1440...

WordPress Plugin Easy Social Icons 1.2.2 - Cross-Site Request Forgery

==================================================== Product: Easy Social Icons WordPress plugin Vendor: CyberNetikz Tested Version: 1.2.2 Vulnerability Type: XSS CWE-79 and CSRF CWE-352 Risk Level: Medium Solution Status: Solved in version 1.2.3 Discovered and Provided: Eric Flokstra - ITsec...

T-Mobile Internet Manager - DLL Hijacking (mfc71enu.dll)

Document Title: =============== T-Mobile Internet Manager - DLL Hijacking mfc71enu.dll References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1427 Release Date: ============= 2015-01-29 Vulnerability Laboratory ID VL-ID: ==================================== 142...

PhotoSync v1.1.3 Android - Local Command Injection Vulnerability

Exploit for Android platform in category local exploits Product & Service Introduction: =============================== Its all about one thing – the best and easiest way to transfer, backup and share your photos and videos! PhotoSync allows you to transfer your photos and videos between your...

FreeBSD : subversion -- DoS vulnerabilities (f5561ade-846c-11e4-b7a7-20cf30e32f6d)

Subversion Project reports : Subversion's moddavsvn Apache HTTPD server module will crash when it receives a REPORT request for some invalid formatted special URIs. Subversion's moddavsvn Apache HTTPD server module will crash when it receives a request for some invalid formatted special URIs. We...

[RT-SA-2014-009] Information Disclosure in TYPO3 Extension ke_questionnaire

Advisory: Information Disclosure in TYPO3 Extension kequestionnaire The TYPO3 extension kequestionnaire stores answered questionnaires in a publicly reachable directory on the webserver with filenames that are easily guessable. Details ======= Product: kequestionnaire Affected Versions: 2.5.2...

Ebay Magento Bug Bounty #1 - Persistent API Vulnerability

Document Title: =============== Ebay Magento Bug Bounty 1 - Persistent API Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1202 eBay Inc. Bug Bounty Program ID: EIBBP-26643 Release Date: ============= 2014-11-17 Vulnerability Laboratory ID...

Encore Discovery Solution Multiple Vulnerability Disclosure

Product: Encore Discovery Solution Vendor: Innovative Interfaces Inc Vulnerable Version: 4.3 Tested Version: 4.3 Vendor Notification: June 19, 2014 Public Disclosure: August 26, 2014 Vulnerability Type: Open Redirect CWE-601 CVE Reference: CVE-2014-5127 Risk Level: Medium CVSSv2 Base Score: 4.3...

[Onapsis Security Advisory 2014-029] SAP Business Objects Information Disclosure

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Onapsis Security Advisory 2014-020: SAP Business Objects Information Disclosure 1. Impact on Business ===================== A malicious user can discover information relating to valid users using a vulnerable Business Objects Enterprise instance. This...

Google Fixes 159 Flaws in Chrome

Google updates its Chrome browser on a very aggressive timeline, often a couple of times a month. Usually, each update includes a handful of security fixes, maybe 12 or 15. On Tuesday, the company released Chrome 38, which patched a staggering 159 vulnerabilities. The huge majority of those...

Solaris 10 (x86) : 126547-06

SunOS 5.10x86: bash patch. Date this patch was last updated by Sun : Sep/26/14 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

PhotoSync 2.2 Command Injection

Document Title: =============== PhotoSync v2.2 iOS - Command Inject Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1290 Release Date: ============= 2014-08-05 Vulnerability Laboratory ID VL-ID: ==================================== 1290...

Kanboard 1.0.5 Cross Site Request Forgery Vulnerability

Cross-site request forgery CSRF vulnerability in Kanboard before 1.0.6 allows remote attackers to hijack the authentication of administrators for requests that add an administrative user via a save action to the default URI. Product: Kanboard Vendor: http://kanboard.net/ Vulnerable Versions: 1.0....

Joomla (Job Component) SQL Injection Vulnerability

No description provided by source. ...BEGIN ADVISORY... !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! TITLE: Joomla Job Component SQL Injection Vulnerability LANGUAGE: PHP RESEARCHER: B-HUNT3|2 CONTACT: bhunt3ratnospamgmaildotnospamcom...

ajax category dropdown wordpress plugin 0.1.5 - Multiple Vulnerabilities

No description provided by source. ============================= Vulnerability ID: HTB22946 Reference: http://www.htbridge.ch/advisory/multiplesqlinjectioninajaxcategorydropdownwordpressplugin.html Product: Ajax Category Dropdown wordpress plugin Vendor: http://www.dyasonhat.com/...

Free Real Estate Contact Form 1.09 - Local File Inclusion

No description provided by source. Securitylab.ir Application Info: Name: Free Real Estate Contact Form Version: 1.09 Vendor: http://www.phpkobo.com/realestatecontact.php Vulnerability Info: Type: Local File Inclusion Risk: Medium Vulnerability:...

recordpress 0.3.1 - Multiple Vulnerabilities

No description provided by source. ---------------------------------------------------------------- WebApplication : RecordPress 0.3.1 Type of vunlnerability : CSRF Change Admin Password And XSS Risk of use : Medium ---------------------------------------------------------------- Producer Website...