openSUSE Security Update : shibboleth-sp (openSUSE-2017-1348)

This update for shibboleth-sp fixes the following issues : Security issue fixed : - CVE-2017-16852: Fix critical security checks in the Dynamic MetadataProvider plugin in Shibboleth Service bsc1068689. This update was imported from the SUSE:SLE-12-SP1:Update update project. %NASLMINLEVEL 70300 C...

openSUSE: Security Advisory for shibboleth-sp (openSUSE-SU-2017:3229-1)

The remote host is missing an update for the Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

SUSE SLES12 Security Update : shibboleth-sp (SUSE-SU-2017:3215-1)

This update for shibboleth-sp fixes the following issues: Security issue fixed : - CVE-2017-16852: Fix critical security checks in the Dynamic MetadataProvider plugin in Shibboleth Service bsc1068689. Note that Tenable Network Security has extracted the preceding description block directly from t...

FreeBSD : shibboleth2-sp -- 'Dynamic' metadata provider plugin issue (b4b7ec7d-ca27-11e7-a12d-6cc21735f730)

The Internet2 community reports : The Shibboleth Service Provider software includes a MetadataProvider plugin with the plugin type 'Dynamic' to obtain metadata on demand from a query server, in place of the more typical mode of downloading aggregates separately containing all of the metadata to...

Immunity Canvas: WEBLOGIC_T3_DESERIALIZATION

Name| weblogict3deserialization ---|--- CVE| CVE-2015-4852 Exploit Pack| CANVAS Description| weblogict3deserialization Notes| CVE Name: CVE-2015-4852 VENDOR: Oracle NOTES: IMPORTANT NOTE: Any instance of this application running Apache Commons Collections version prior to 3.0 WILL NOT WORK...

Immunity Canvas: JBOSS6_JMXINVOKERSERVLET_DESERIALIZE

Name| jboss6jmxinvokerservletdeserialize ---|--- CVE| CVE-2015-7501 Exploit Pack| CANVAS Description| jboss6jmxinvokerservletdeserialize Notes| CVE Name: CVE-2015-7501 VENDOR: Red Hat NOTES: IMPORTANT NOTE: Any instance of this application running Apache Commons Collections version prior to 3.0...

sp-direct.jp XSS vulnerability

Vulnerable URL: https://sp-direct.jp/products/list/?transactionid=109277f4de35e559bb3a08a890dba6eebc06e82a=%3C%2Fscript%3E%3Cimg+src%3Dx+onerror%3Dprompt%28%2FXSSPOSED%2F%29%3E=%E6%A4%9C%E7%B4%A2 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 16.12.2017 Vulnerability...

canitar.sp.gov.br XSS vulnerability

Vulnerable URL: http://canitar.sp.gov.br/buscar.php?busca=pas%22--!%3E%3CSvg/OnLoad=confirmOPENBUGBOUNTY%3E%22 Details: Description| Value ---|--- Patched:| Verification in progress Latest check for patch:| 26.11.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

SP Movie Database 1.3, SQL Injection

SP Movie Database version 1.3 by joomshaper.com, SQL Injection resolution: update to version 1.4 update notice: https://www.joomshaper.com/forums/sp-movie-database-component-updated-with-security-and-other-fixes...

Joomla SP Movie Database 1.3 Component - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla! Component SP Movie Database 1.3 - SQL Injection Dork: N/A Date: 18.08.2017 Vendor Homepage: http://joomshaper.com/ Software Link:...

Joomla SP Movie Database 1.3 SQL Injection

Exploit Title: Joomla! Component SP Movie Database 1.3 - SQL Injection Dork: N/A Date: 18.08.2017 Vendor Homepage: http://joomshaper.com/ Software Link: https://extensions.joomla.org/extensions/extension/directory-a-documentation/directory/sp-movie-database/ Demo:...

Joomla! Component SP Movie Database 1.3 - SQL Injection

Joomla! Component SP Movie Database 1.3 - SQL Injection Exploit Title: Joomla! Component SP Movie Database 1.3 - SQL Injection Dork: N/A Date: 18.08.2017 Vendor Homepage: http://joomshaper.com/ Software Link:...

Joomla! Component SP Movie Database 1.3 - SQL Injection

Exploit Title: Joomla! Component SP Movie Database 1.3 - SQL Injection Dork: N/A Date: 18.08.2017 Vendor Homepage: http://joomshaper.com/ Software Link: https://extensions.joomla.org/extensions/extension/directory-a-documentation/directory/sp-movie-database/ Demo:...

CVE-2012-0803

Apache CXF CVE-2012-0803 affects CXF 2.4.5 and 2.5.1 where WS-SP UsernameToken policy validation against the security header UsernameToken is broken, allowing a malicious client to bypass authentication by sending an empty UsernameToken in a SOAP request. The issue arises from CXF not validating ...

CVE-2012-0803

The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending an empty UsernameToken as part of a SOAP request...

NIST Releases New Digital Identity Guidelines

The National Institute of Standards and Technology NIST has released the Digital Identity Guidelines document suite. The four-volume suite offers technical guidelines for organizations that use digital identity services. US-CERT encourages information security practitioners in industry, governmen...

rioclaro.sp.gov.br XSS vulnerability

Vulnerable URL: http://www.rioclaro.sp.gov.br/busca/index.php?txtBusca=%22%3E%3Csvg%2Fonload%3Dprompt%28%2FOPENBUGBOUNTY%2F%29%3E=0=0 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

Dup Scout Enterprise 9.5.14 Buffer Overflow

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Dup Scout Enterprise GET Buffer Overflow', 'Description' = %q This module exploits a stack-based buffer overflow vulnerability ...

Threat Outbreak Alert RuleID29057: Email Messages Distributing Malicious Software on May 11, 2017

Medium Alert ID: 53794 First Published: 2017 May 11 15:08 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29057 may contain the following files: Name | Size...

CVE-2017-6606

A vulnerability in a startup script of Cisco IOS XE Software could allow an unauthenticated attacker with physical access to the targeted system to execute arbitrary commands on the underlying operating system with the privileges of the root user. More Information: CSCuz06639 CSCuz42122. Known...