CVE-2015-3141

Multiple cross-site request forgery CSRF vulnerabilities in Synametrics Technologies Xeams 4.5 Build 5755 and earlier allow remote attackers to hijack the authentication of administrators for requests that create an 1 SMTP domain or a 2 user via a request to /FrontController; or conduct cross-sit...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Synametrics Technologies Xeams 4.5 Build 5755 and earlier allow remote attackers to hijack the authentication of administrators for requests that create an 1 SMTP domain or a 2 user via a request to /FrontController; or conduct cross-sit...

CVE-2015-3141

Multiple cross-site request forgery CSRF vulnerabilities in Synametrics Technologies Xeams 4.5 Build 5755 and earlier allow remote attackers to hijack the authentication of administrators for requests that create an 1 SMTP domain or a 2 user via a request to /FrontController; or conduct cross-sit...

CVE-2015-3141

The CVE-2015-3141 entry affects Synametrics Xeams 4.5 Build 5755 and earlier, with CSRF vulnerabilities in /FrontController enabling an attacker to hijack administrator sessions via requests that create an SMTP domain or a user, and to trigger XSS via domainname, txtRecipient, and related paramet...

Justice Department Charges Six Chinese Nationals with Insider Theft

The Justice Department has issued a 32-count indictment including charges of economic espionage and theft of trade secrets against a pair of Chinese professors along with four other citizens of the People’s Republic of China. Authorities last Sunday arrested one of the alleged, Professor Hao Zhan...

Multiple Cross-Site Scripting (XSS) in FreePBX

Advisory ID: HTB23253 Product: FreePBX Vendor: Sangoma Technologies Vulnerable Versions: 12.0.43 and probably prior Tested Version: 12.0.43 Advisory Publication: March 18, 2015 without technical details Vendor Notification: March 18, 2015 Vendor Patch: March 27, 2015 Public Disclosure: April 22,...

Multiple Cross-Site Request Forgery Vulnerabilities at Synametrics Technologies

A cross-site request forgery vulnerability in the mngUsers operation in Synametrics Technologies /app allows remote attackers to construct a malicious URI, trick a user into parsing it, and can target the user context to perform malicious actions...

FreePBX 12.0.43 Cross Site Scripting

Advisory ID: HTB23253 Product: FreePBX Vendor: Sangoma Technologies Vulnerable Versions: 12.0.43 and probably prior Tested Version: 12.0.43 Advisory Publication: March 18, 2015 without technical details Vendor Notification: March 18, 2015 Vendor Patch: March 27, 2015 Public Disclosure: April 22,...

Report Recommends Series of Cybersecurity Changes at FAA

The Federal Aviation Administration needs to upgrade and update its information security capabilities–including building a threat-modeling capability and implementing federal security guidelines–in order to ensure the safety of the nation’s aviation infrastructure, according to a new report by th...

PT-2015-15: Information Disclosure in LiteSpeed Web Server

The specialists of the Positive Research center have detected an Information Disclosure vulnerability in LiteSpeed Web Server. This vulnerability allows attackers to obtain the content of arbitrary memory locations in LiteSpeed Web Server. The exploitation of the vulnerability makes it possible t...

hivex, ocaml, perl, python, ruby security update

CentOS Errata and Security Advisory CESA-2015:0301 Updated hivex packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common...

Debian DSA-3183-1 : movabletype-opensource - security update

Multiple vulnerabilities have been discovered in Movable Type, a blogging system. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2013-2184 Unsafe use of Storable::thaw in the handling of comments to blog posts could allow remote attackers to include and...

Debian Security Advisory DSA 3183-1 (movabletype-opensource - security update)

Multiple vulnerabilities have been discovered in Movable Type, a blogging system. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2013-2184 Unsafe use of Storable::thaw in the handling of comments to blog posts could allow remote attackers to include and...

Agilent Technologies Feature Extraction AnnotationX.AnnList.1 ActiveX Control Arbitrary Code Execution Vulnerability

Agilent Technologies Feature Extraction is a set of feature extraction software for automatically reading and processing image files from multiple original chips from Agilent Technologies. A security vulnerability exists in Agilent Technologies Feature Extraction's AnnotationX.AnnList.1 ActiveX...

PT-2016-61: Denial of Service in the web interface to TP-Link wireless devices control system

The specialists of the Positive Research center have detected a Denial of Service vulnerability in the web interface to TP-Link wireless devices control system. An attacker can cause a full denial of service of the server used for the web interface to wireless devices control system via the speci...

CVE-2015-2092

The AnnotationX.AnnList.1 ActiveX control in Agilent Technologies Feature Extraction allows remote attackers to execute arbitrary code via a crafted object parameter in the Insert function, related to "Index Out-Of-Bounds."...

Out-of-bounds

The AnnotationX.AnnList.1 ActiveX control in Agilent Technologies Feature Extraction allows remote attackers to execute arbitrary code via a crafted object parameter in the Insert function, related to "Index Out-Of-Bounds."...

CVE-2015-2092

The AnnotationX.AnnList.1 ActiveX control in Agilent Technologies Feature Extraction allows remote attackers to execute arbitrary code via a crafted object parameter in the Insert function, related to "Index Out-Of-Bounds."...

CVE-2015-2092

The CVE-2015-2092 entry concerns Agilent Technologies Feature Extraction, specifically the AnnotationX.AnnList.1 ActiveX control. The vulnerability allows remote code execution via a crafted object parameter in the Insert function, related to an index-out-of-bounds condition. Public documentation...

Moderate: Red Hat Security Advisory: hivex security, bug fix, and enhancement update

Updated hivex packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a...