AST-2012-013: ACL rules ignored when placing outbound calls by certain IAX2 users

Asterisk Project Security Advisory - AST-2012-013 Product Asterisk Summary ACL rules ignored when placing outbound calls by certain IAX2 users Nature of Advisory Unauthorized use of system Susceptibility Remote Authenticated Sessions Severity Moderate Exploits Known None Reported On 07/27/2012...

ZDI-12-173 : (0Day) HP SiteScope SOAP Call getSiteScopeConfiguration Remote Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-173 : 0Day HP SiteScope SOAP Call getSiteScopeConfiguration Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-173 August 29, 2012 - -- CVE ID: - -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C - -- Affected Vendors:...

ZDI-12-171 : (0Day) Hewlett-Packard Intelligent Management Center UAM sprintf Remote Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-171 : 0Day Hewlett-Packard Intelligent Management Center UAM sprintf Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-171 August 29, 2012 - -- CVE ID: - -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C - -- Affected...

CVE-2012-4737

channels/chaniax2.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1, Certified Asterisk 1.8.11 before 1.8.11-cert7, Asterisk Digiumphones 10.x.x-digiumphones before 10.7.1-digiumphones, and Asterisk Business Edition C.3.x before C.3.7.6 does not enforce ACL rules during certa...

Design/Logic Flaw

channels/chaniax2.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1, Certified Asterisk 1.8.11 before 1.8.11-cert7, Asterisk Digiumphones 10.x.x-digiumphones before 10.7.1-digiumphones, and Asterisk Business Edition C.3.x before C.3.7.6 does not enforce ACL rules during certa...

asterisk -- multiple vulnerabilities

Asterisk project reports: Asterisk Manager User Unauthorized Shell Access ACL rules ignored when placing outbound calls by certain IAX2 users...

Fedora Update for mod_security_crs FEDORA-2012-9813

Check for the Version of modsecuritycrs OpenVAS Vulnerability Test Fedora Update for modsecuritycrs FEDORA-2012-9813 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify i...

CVE-2009-5130

The Rules Service in Websense Email Security before 7.1 allows remote attackers to cause a denial of service service crash via an attachment with a crafted size...

CVE-2009-5130

CVE-2009-5130 affects Websense Email Security’s Rules Service prior to 7.1. The issue is caused by processing an attachment with a crafted size, allowing remote attackers to trigger a denial-of-service (service crash). The connected documents do not provide exploitation details or a confirmed rem...

CVE-2009-5130

The Rules Service in Websense Email Security before 7.1 allows remote attackers to cause a denial of service service crash via an attachment with a crafted size...

CVE-2009-5130: Improper Restriction of Operations within the Bounds of a Memory Buffer

The Rules Service in Websense Email Security before 7.1 allows remote attackers to cause a denial of service service crash via an attachment with a crafted size...

owasp-modsecurity-crs

!Travis build v3.3/devhttps://img.shields.io/travis/spiderlab...

Scientific Linux Security Update : tzdata on SL5.x, SL4.x i386/x86_64

A tzdata enhancement, with updates for Venezuela, Indiana, Egypt, Gaza, South Australia, Antarctica, Brazil, and Iran is now available. The tzdata package contains data files with information regarding and rules for daylight saving times in various timezones around the world. The updated package...

Scientific Linux Security Update : krb5 on SL4.x, SL5.x i386/x86_64

Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a trusted third- party, the Key Distribution Center KDC. A buffer overflow flaw was found in the MIT krb5 telnet daemon telnetd. A remote attacker who can acce...

meetOne Insecure Transport / Information Disclosure

Exploit for php platform in category web applications SUMMARY meetOne, currently in Germany in the Top 50 social apps of the iTunes Store, has multiple vulnerabilities and has been found guilty of stealing Apple iPhone address books and abusing the e-mail addresses there for spam. Apple Inc. is...

meetOne Insecure Transport / Information Disclosure

SUMMARY meetOne, currently in Germany in the Top 50 social apps of the iTunes Store, has multiple vulnerabilities and has been found guilty of stealing Apple iPhone address books and abusing the e-mail addresses there for spam. Apple Inc. is ignoring the data theft and it seems even supressing...

UBUNTU-CVE-2012-3392

mod/forum/unsubscribeall.php in Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4 does not consider whether a forum is optional, which allows remote authenticated users to bypass forum-subscription requirements by leveraging the student role and unsubscribing from all forums...

ZDI-12-127 : (0Day) HP StorageWorks File Migration Agent RsaFTP.dll Remote Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-127 : 0Day HP StorageWorks File Migration Agent RsaFTP.dll Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-127 July 18, 2012 - -- CVE ID: - -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C - -- Affected Vendors:...

ZDI-12-126 : (0 day) HP StorageWorks File Migration Agent RsaCIFS.dll Remote Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-126 : 0 day HP StorageWorks File Migration Agent RsaCIFS.dll Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-126 July 18, 2012 - -- CVE ID: - -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C - -- Affected Vendors:...

CVE-2012-2751

ModSecurity before 2.6.6, when used with PHP, does not properly handle single quotes not at the beginning of a request parameter value in the Content-Disposition field of a request with a multipart/form-data Content-Type header, which allows remote attackers to bypass filtering rules and perform...