RootPanel SQL Injection Vulnerability

RootPanel suffers from a remote SQL injection vulnerability that allows for account takeover. ============================================================ RootPanel All versions SQL injection/Account takeover. Discovery: AkaStep and CAMOUFL4G3 Vendor: http://www.rootpanel.ru/...

Oracle Linux 5 : ipa-client (ELSA-2013-0189)

The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2013-0189 advisory. 2.1.3-5.2 - Add missing man page option --ca-cert-file. 878217 2.1.3-5.1 - Fix python syntax backport issue in CVE patch. 878217 2.1.3-5 - Use secure method to...

Oracle Linux 3 / 4 : fetchmail (ELSA-2007-0018)

From Red Hat Security Advisory 2007:0018 : Updated fetchmail packages that fix two security issues are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Fetchmail is a remote mail retrieval and forwarding utility. A denial of servi...

NSA can eavesdrop traffic in Real Time, more PRISM slides leaked

The NSA surveillance program PRISM story was started with four leaked slides from the Washington Post weeks before and today they has revealed four more annotated slides about the NSA operation, along with detailing the various levels of scrutiny from the FBI and NSA that happen before, during an...

IPMI 2.0 RAKP Remote SHA1 Password Hash Retrieval

This module identifies IPMI 2.0-compatible systems and attempts to retrieve the HMAC-SHA1 password hashes of default usernames. The hashes can be stored in a file using the OUTPUTFILE option and then cracked using hmacsha1crack.rb in the tools subdirectory as well hashcat cpu 0.46 or newer using...

Parsing of external XML entities can be exploited to retrieve files or make HTTP requests on the target network

h3. Description This issue has been assigned CVE-2013-3925 by Mitre Corporation. Previously reported issue CVE-2012-2926 August 2012, CVSS score 6.4 was patched by introducing a new XFire servlet component into Crowd. The new component disables external entity resolution during XML parsing. The n...

[SECURITY] Fedora 17 Update: libkcddb-4.10.4-1.fc17

CDDB retrieval library...

[SECURITY] Fedora 18 Update: libkcddb-4.10.4-1.fc18

CDDB retrieval library...

[SECURITY] Fedora 19 Update: libkcddb-4.10.4-1.fc19

CDDB retrieval library...

CORE-2013-0322 - MayGion IP Cameras multiple vulnerabilities

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ MayGion IP Cameras multiple vulnerabilities 1. Advisory Information Title: MayGion IP Cameras multiple vulnerabilities Advisory ID: CORE-2013-0322 Advisory URL:...

Report Says Active Recovery Efforts Could Deter IP Theft By Foreign Attackers

An independent commission focused on the threat of intellectual property from U.S. companies says that between 50 percent and 80 percent of all IP theft originates in China and, in a new report, urges the government to take stronger action against government-sanctioned IP theft. The Commission on...

http-coldfusion-subzero NSE Script

Attempts to retrieve version, absolute path of administration panel and the file 'password.properties' from vulnerable installations of ColdFusion 9 and 10. This was based on the exploit 'ColdSub-Zero.pyFusion v2'. See also: http-adobe-coldfusion-apsa1301.nse http-vuln-cve2009-3960.nse...

DDIVRT-2013-53 Actuate 'ActuateJavaComponent' Multiple Vulnerabilities

Title ----- DDIVRT-2013-53 Actuate 'ActuateJavaComponent' Multiple Vulnerabilities Severity -------- High Date Discovered --------------- March 19, 2013 Discovered By ------------- Digital Defense, Inc. Vulnerability Research Team Credit: Dennis Lavrinenko, Bobby Lockett, and r@b13$ 1. Actuate...

Adobe Releases Security Update for ColdFusion

Adobe has released a security hotfix for ColdFusion 10, 9.0.2, 9.0.1, and 9.0 for Windows, Macintosh, and UNIX. This hotfix addresses a vulnerability CVE-2013-1389 that could allow a remote attacker to execute arbitrary code and a vulnerability CVE-2013-3336 that could permit an unauthorized user...

OPC UA Browse Next Request Command

...

OPC UA Browse Next Response Command

...

McAfee ePolicy Orchestrator 4.6.4 and earlier pre-authenticated SQL injection and directory path traversal vulnerabilities

Overview McAfee ePolicy Orchestrator 4.6.4 and earlier contains a pre-authenticated sql injection and directory path traversal vulnerability which could allow an attacker to inject malicious code into the system. Description McAfee ePolicy Orchestrator 4.6.4 and earlier contains a pre-authenticat...

[Ghost Phisher] GUI suite for phishing and penetration attacks

Ghost Phisher is a Wireless and Ethernet security auditing and attack software program written using the Python Programming Language and the Python Qt GUI library, the program is able to emulate access points and deploy various internal networking servers for networking, penetration testing and...

EverFocus Multiple Devices Directory Traversal (Mar 2013) - Active Check

Multiple EverFocus devices are prone to a directory traversal vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

Medium: gnutls

Issue Overview: It was discovered that GnuTLS leaked timing information when decrypting TLS/SSL protocol encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a TLS/SSL server as a padding...