5274 matches found
Symantec Web Gateway 5.1.0.x - Multiple Vulnerabilities
Symantec Web Gateway 5.1.0.x - Multiple Vulnerabilities SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities - Surveillance via Symantec Web Gateway product: Symantec Web Gateway vulnerable version:...
Server Misconfiguration discloses passwords of all Barracuda Network Employees
Security expert Ebrahim Hegazy has found a Password disclosure vulnerability in Barracuda update servers which allows to gain access to employee credentials. The Egyptian information security advisor Ebrahim Hegazy@Zigoo0 has found a Password disclosure vulnerability in one of Barracuda update...
Server Misconfiguration discloses passwords of all Barracuda Network Employees
Security expert Ebrahim Hegazy has found a Password disclosure vulnerability in Barracuda update servers which allows to gain access to employee credentials. The Egyptian information security advisor Ebrahim Hegazy@Zigoo0 has found a Password disclosure vulnerability in one of Barracuda update...
C.P.Sub 4.5 - Authentication Bypass
C.P.Sub 4.5 - Authentication Bypass !/usr/bin/python Exploit Title: C.P.Sub = v4.5 Misconfiguration and Improper Authentication Date: 2013/6/27 Exploit Author: Chako Vendor Homepage: http://www.cooltey.org/ping/php.php Software Download Link: http://cooltey.myweb.hinet.net/cpsubv4.5.zip Version: ...
C.P.Sub 4.5 - Authentication Bypass
!/usr/bin/python Exploit Title: C.P.Sub = v4.5 Misconfiguration and Improper Authentication Date: 2013/6/27 Exploit Author: Chako Vendor Homepage: http://www.cooltey.org/ping/php.php Software Download Link: http://cooltey.myweb.hinet.net/cpsubv4.5.zip Version: = v4.5 Tested on: Windows 7 Improper...
C.P.Sub 4.5 Privilege Escalation
!/usr/bin/python Exploit Title: C.P.Sub = v4.5 Misconfiguration and Improper Authentication Date: 2013/6/27 Exploit Author: Chako Vendor Homepage: http://www.cooltey.org/ping/php.php Software Download Link: http://cooltey.myweb.hinet.net/cpsubv4.5.zip Version: = v4.5 Tested on: Windows 7 Improper...
C.P.Sub 4.5 Privilege Escalation Exploit
C.P.Sub versions 4.5 and below allows for administrative access escalation by the simple tweak of a user-supplied parameter. !/usr/bin/python Exploit Title: C.P.Sub = v4.5 Misconfiguration and Improper Authentication Date: 2013/6/27 Exploit Author: Chako Vendor Homepage:...
Dovecot with Exim - 'sender_address' Remote Command Execution
Advisory: Exim with Dovecot: Typical Misconfiguration Leads to Remote Command Execution During a penetration test a typical misconfiguration was found in the way Dovecot is used as a local delivery agent by Exim. A common use case for the Dovecot IMAP and POP3 server is the use of Dovecot as a...
Exim / Dovecot Command Execution
Advisory: Exim with Dovecot: Typical Misconfiguration Leads to Remote Command Execution During a penetration test a typical misconfiguration was found in the way Dovecot is used as a local delivery agent by Exim. A common use case for the Dovecot IMAP and POP3 server is the use of Dovecot as a...
Sensitive Enterprise Data Exposed in Amazon S3 Public Buckets
UPDATE – With companies flocking to cloud services such as Amazon Simple Storage Service S3 to store and serve static content on the cheap, naturally they’re making simple mistakes in doing so—and naturally, a savvy attacker is able to cash in. Researchers at Rapid7 today released data from a...
[Web-Sorrow] Tool for Misconfiguration, Version Detection, Enumeration, and Server Information Scanning
Web-Sorrow is a perl based tool for misconfiguration, version detection, enumeration, and server information scanning. It's entirely focused on Enumeration and collecting Info on the target server. Web-Sorrow is a "safe to run" program, meaning it is not designed to be an exploit or perform any...
CVE-2013-0212
store/swift.py in OpenStack Glance Essex 2012.1, Folsom 2012.2 before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable, allows remote authenticated users to obtain sensitive...
CVE-2012-5634
Xen 4.2.x, 4.1.x, and 4.0, when using Intel VT-d for PCI passthrough, does not properly configure VT-d when supporting a device that is behind a legacy PCI Bridge, which allows local guests to cause a denial of service to other guests by injecting an interrupt...
CVE-2012-5634
CVE-2012-5634 affects Xen when using Intel VT-d PCI passthrough and a device behind a legacy PCI bridge. The VT-d configuration is not properly validated, allowing a local guest to inject an interrupt and potentially cause a denial of service to other guests. The vulnerability is documented in Xe...
USN-1710-1: OpenStack Glance vulnerability
Dan Prince discovered an issue in Glance error reporting. An authenticated attacker could exploit this to expose the Glance operator's Swift credentials for a misconfigured or otherwise unusable Swift endpoint...
CVE-2013-0212
store/swift.py in OpenStack Glance Essex 2012.1, Folsom 2012.2 before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable, allows remote authenticated users to obtain sensitive...
WordPress W3 Total Cache Misconfiguration Leaves Some Blogs Vulnerable
An apparent misconfiguration exists in W3 Total Cache W3TC, a popular plugin for the WordPress blogging platform, that could allow an attacker to browse and download password hashes and other database information. W3 Total Cache W3TC is a framework for WordPress that helps speed up blogs by cachi...
WordPress Plugin - W3 Total Cache Remote Sql Injection Exploit
Exploit for php platform in category web applications From the developers' description 1, W3 Total Cache is: The most complete WordPress performance framework. Recommended by web hosts like: MediaTemple, Host Gator, Page.ly and WP Engine and countless more. Trusted by countless sites like:...
Oracle MySQL For Microsoft Windows MOF Execution
This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Oracle MySQL for Microsoft Windows MO...
Oracle MySQL (Windows) - MOF Execution (Metasploit)
This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Oracle MySQL for Microsoft Windows MO...