Mandriva Linux Security Advisory : subversion (MDVSA-2014:161)

Updated subversion packages fix security vulnerability : Bert Huijben discovered that Subversion did not properly handle cached credentials. A malicious server could possibly use this issue to obtain credentials cached for a different server CVE-2014-3528. %NASLMINLEVEL 70300 C Tenable Network...

ChatSecure IM 2.2.4 iOS - Persistent Cross-Site Scripting

ChatSecure IM 2.2.4 iOS - Persistent Cross-Site Scripting Document Title: =============== ChatSecure IM v2.2.4 iOS - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1317 Release Date: ============= 2014-09-10 Vulnerability...

Important: Red Hat Security Advisory: Fuse ESB Enterprise/Fuse MQ Enterprise 7.1.0 update

This advisory contains instructions on how to resolve one security issue in the Elasticsearch component in Fuse ESB Enterprise and Fuse MQ Enterprise 7.1.0. Red Hat Product Security has rated this security issue as having Important security impact. A Common Vulnerability Scoring System CVSS base...

CacheGuard-OS 5.7.7 Cross Site Request Forgery

I. VULNERABILITY ------------------------- CSRF vulnerabilities in CacheGuard-OS v5.7.7 II. BACKGROUND ------------------------- CacheGuard is an All-in-One Web Security Gateway providing firewall, web antivirus, caching, compression, URL filtering, proxy, high availability, content filtering,...

WordPress Acento Theme - Arbitrary File Download

Acento theme's "file" parameter in view-pdf.php is prone to an arbitrary file download vulnerability. It allows an attacker to download arbitrary files from the web server and get potentially sensitive information. Solution Update the theme...

MyBB User Social Networks Plugin 1.2 - Persistent Cross-Site Scripting

MyBB User Social Networks Plugin 1.2 - Persistent Cross-Site Scripting Exploit Title: User Social Networks MyBB Plugin 1.2 - Cross Site Scripting Google Dork: N/A Date: 05.09.2014 Exploit Author: Fikri Fadzil - [email protected] Vendor Homepage - N/A Software Link:...

BlackCat CMS 1.0.3 Cross Site Scripting Vulnerability

BlackCat CMS version 1.0.3 suffers from a cross site scripting vulnerability. Product: BlackCat CMS Vendor: Black Cat Development Vulnerable Versions: 1.0.3 and probably prior Tested Version: 1.0.3 Advisory Publication: August 13, 2014 without technical details Vendor Notification: August 13, 201...

BlackCat CMS 1.0.3 Cross Site Scripting

Advisory ID: HTB23228 Product: BlackCat CMS Vendor: Black Cat Development Vulnerable Versions: 1.0.3 and probably prior Tested Version: 1.0.3 Advisory Publication: August 13, 2014 without technical details Vendor Notification: August 13, 2014 Vendor Patch: August 13, 2014 Public Disclosure:...

WordPress Mulitple Themes - Arbitrary File Download

Multiple WordPress themes are prone to an arbitrary file download vulnerability. It allows an attacker to download arbitrary files from the web server and get potentially sensitive information. Solution Upgrade themes...

[SECURITY] Fedora 20 Update: zarafa-7.1.10-4.fc20

The Zarafa Collaboration Platform is a Microsoft Exchange replacement. The Open Source Collaboration provides an integration with your existing Linux mail server, native mobile phone support by ActiveSync compatibility and a webaccess with 'Look & Feel' similar to Outlook using Ajax. Including an...

CVE-2014-5127

CVE-2014-5127 is an Open Redirect vulnerability in Encore Discovery Solution 4.3 by Innovative Interfaces Inc. Attackers can redirect users to attacker-controlled sites via a crafted URL parameter, enabling phishing attempts. The SecurityVulns entry confirms product, vulnerable version (4.3), and...

CVE-2014-5127

Open redirect vulnerability in Innovative Interfaces Encore Discovery Solution 4.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in an unspecified parameter...

CVE-2014-5128

Innovative Interfaces Encore Discovery Solution 4.3 places a session token in the URI, which might allow remote attackers to obtain sensitive information via unspecified vectors...

CVE-2014-5128

The vulnerability CVE-2014-5128 affects Encore Discovery Solution 4.3 from Innovative Interfaces Inc. The advisory details that the product “places a session token in the URI,” exposing the session token via GET parameters and creating potential information leakage through unspecified vectors. Th...

CVE-2014-5127

Open redirect vulnerability in Innovative Interfaces Encore Discovery Solution 4.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in an unspecified parameter...

Information disclosure

Innovative Interfaces Encore Discovery Solution 4.3 places a session token in the URI, which might allow remote attackers to obtain sensitive information via unspecified vectors...

Open redirect

Open redirect vulnerability in Innovative Interfaces Encore Discovery Solution 4.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in an unspecified parameter...

F5 Big-IP - rsync Access

When configured in a high availability mode, the F5 solution suffers from an unauthenticated rsync access vulnerability that can be leveraged to upload a malicious SSH key and gain remote root access to the appliance. The BigIP platform configures an rsync daemon listening on the ConfigSync...

ManageEngine DeviceExpert 5.9 Credential Disclosure

Hi, You can read the usernames and MD5 hashed passwords of all the users in the Device Expert application by sending an unauthenticated request. I am releasing this as a 0 day as ManageEngine have responded that they do not consider this a priority and won't fix it in the near future unless a...

SQL Injection Vulnerability in ArticleFR

Advisory ID: HTB23225 Product: ArticleFR Vendor: Free Reprintables Vulnerable Versions: 3.0.4 and probably prior Tested Version: 3.0.4 Advisory Publication: July 23, 2014 without technical details Vendor Notification: July 23, 2014 Public Disclosure: August 20, 2014 Vulnerability Type: SQL...