JExperts Tecnologia / Channel Software Multiple Vulnerabilities

JExperts Tecnologia / Channel software version 5.0.33CCB allows for authorization bypass / privilege escalation via tampering with parameters in the GET request and a cross site scripting vulnerability. CVE-2014-8558 - JExperts Tecnologia / Channel Software Escalation Access Issues Vendor Notifie...

Cyberespionage: 'This Isn't a Problem That Can Be Solved'

WASHINGTON–Gentlemen may not read each other’s mail, as Henry Stimson famously said so long ago, but in today’s world they certainly steal it and there’s precious little in the way of gentlemanly conduct happening in the realm of cyberespionage. It’s every man—or country—for himself in this...

vBulletin 4.x - breadcrumbs via xmlrpc API (Authenticated) SQL Injection

CVE-2014-2022 - vbulletin 4.x - SQLi in breadcrumbs via xmlrpc API post-auth ============================================================================== Overview -------- date : 10/12/2014 cvss : 7.1 AV:N/AC:H/Au:S/C:C/I:C/A:C base cwe : 89 vendor : vBulletin Solutions product : vBulletin 4...

CVE-2014-6940

The Absolute Lending Solutions aka com.soln.S008F6C05EC0B63264B429F6D76286562 application 1.0073.b0073 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Absolute Lending Solutions aka com.soln.S008F6C05EC0B63264B429F6D76286562 application 1.0073.b0073 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6940

CVE-2014-6940 : The Absolute Lending Solutions Android app (package com.soln.S008F6C05EC0B63264B429F6D76286562) version 1.0073.b0073 does not verify X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certifi...

CVE-2014-6940

The Absolute Lending Solutions aka com.soln.S008F6C05EC0B63264B429F6D76286562 application 1.0073.b0073 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5440

SQL injection vulnerability in Login.aspx in MPEX Business Solutions MX-SmartTimer before 13.19.18 allows remote attackers to execute arbitrary SQL commands via the ct100%24CPHContent%24password parameter...

Sql injection

SQL injection vulnerability in Login.aspx in MPEX Business Solutions MX-SmartTimer before 13.19.18 allows remote attackers to execute arbitrary SQL commands via the ct100%24CPHContent%24password parameter...

CVE-2014-5440

SQL injection vulnerability in Login.aspx in MPEX Business Solutions MX-SmartTimer before 13.19.18 allows remote attackers to execute arbitrary SQL commands via the ct100%24CPHContent%24password parameter...

CVE-2014-5440

MX-SmartTimer (MPEX Business Solutions) is affected by CVE-2014-5440 due to an SQL injection in Login.aspx. The vulnerability enables remote attackers to send SQL commands via the ct100%24CPHContent%24password parameter in versions before 13.19.18, potentially bypassing authentication and executi...

IBM WebSphere Application Server (WAS) Integrated Solutions Console Login Page username Parameter Reflected XSS Security Vulnerability

INFO: Class: Input Validation Error CVE: Remote: Yes Local: No Published: Aug 27 2014 12:00AM Updated: Aug 27 2014 12:00AM Credit: G. S. McNamara, CGI Federal Emerging Technologies Security Practice ETSP Vulnerable: IBM WebSphere Application Server WAS Integrated Solutions Console 7.0.0.19...

IBM WebSphere Application Server XSS

Integrated Solutions Console crossite scripting...

'Kyle and Stan' Malvertising Network Targets Windows and Mac Users

A malvertising network that has been operating since at least May has been able to place malicious ads on a number of high-profile sites, including Amazon and YouTube and serves a unique piece of malware to each victim. The network, dubbed Kyle and Stan by the Cisco researchers who analyzed its...

MX-SmartTimer 13.18.5.11 SQL Injection

"CVE-2014-5440 MX-SmartTimer SQL Injection" - Vendor Status: CONFIRMED - Vendor Disclosure Date: July, 17th, 2014 - Public Disclosure Date: August, 29th, 2014 - Affected Vendor: MPEX Business Solutions http://www.mpexsolutions.com/ - Affected System: MX-SmartTimer Version 13.18.5.11 - Vulnerabili...

Multiple Security vulnerabilities in IBM NAS

IBM SECURITY ADVISORY First Issued : Thu Aug 28 03:15:00 CDT 2014 | Updated: Fri Sep 5 01:11:34 CDT 2014 | Update: The same ifix with a packaging change has been added in | Update: "A. FIXES" section. The most recent version of this document is available here:...

SAP Kernel - RCE and DoS vulnerability

Application: SAP NetWeaver Dispatcher Versions Affected: SAP Kernel 7.00 32BIT, 7.40 64BIT Vendor URL: http://www.sap.com Vulnerability: Buffer Overflow – RCE, Denial of Service Exploits: YES Reported: 25.08.2014 Vendor response: 25.08.2014 Date of Public Advisory: 15.12.2014 Reference: SAP...

Vulnerability Fixed in Subnet Solutions SCADA Server

A hole has been fixed in a popular industrial control system data management server that if left unpatched, could result in a remotely exploitable denial of service condition. Subnet Solutions, Inc., a Canadian manufacturer of electric utility products, fixed the vulnerability – along with anothe...

Sabre AirCentre Crew solutions contain a SQL injection vulnerability

Overview Sabre AirCentre Crew solutions version 2010.2.12.20008 and earlier contain an SQL injection vulnerability. Description CWE-89: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' Sabre AirCentre Crew solutions version 2010.2.12.20008 and earlier are...

Rocket Servergraph Admin Center userRequest and tsmRequest Command Execution (CVE-2014-3915)

Multiple vulnerabilities exist in Rocket Servergraph, an interface for monitoring backup solutions such as IBM Tivoli Storage Manager, Symantec NetBackup etc. These vulnerabilities are due to input validation errors when handling requests to the URIs userRequest and tsmRequest. A remote...