CVE-2015-3141

Multiple cross-site request forgery CSRF vulnerabilities in Synametrics Technologies Xeams 4.5 Build 5755 and earlier allow remote attackers to hijack the authentication of administrators for requests that create an 1 SMTP domain or a 2 user via a request to /FrontController; or conduct cross-sit...

CVE-2015-3141

The CVE-2015-3141 entry affects Synametrics Xeams 4.5 Build 5755 and earlier, with CSRF vulnerabilities in /FrontController enabling an attacker to hijack administrator sessions via requests that create an SMTP domain or a user, and to trigger XSS via domainname, txtRecipient, and related paramet...

Justice Department Charges Six Chinese Nationals with Insider Theft

The Justice Department has issued a 32-count indictment including charges of economic espionage and theft of trade secrets against a pair of Chinese professors along with four other citizens of the People’s Republic of China. Authorities last Sunday arrested one of the alleged, Professor Hao Zhan...

PT-2015-6073

Name of the Vulnerable Software and Affected Versions Synametrics Technologies Xeams versions 4.5 Build 5755 and earlier Description The issue allows remote attackers to hijack the authentication of administrators for requests, such as creating an SMTP domain or a user, via a request to...

CVE-2015-3141: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Synametrics Technologies Xeams 4.5 Build 5755 and earlier allow remote attackers to hijack the authentication of administrators for requests that create an 1 SMTP domain or a 2 user via a request to /FrontController; or conduct cross-sit...

Multiple Cross-Site Scripting (XSS) in FreePBX

Advisory ID: HTB23253 Product: FreePBX Vendor: Sangoma Technologies Vulnerable Versions: 12.0.43 and probably prior Tested Version: 12.0.43 Advisory Publication: March 18, 2015 without technical details Vendor Notification: March 18, 2015 Vendor Patch: March 27, 2015 Public Disclosure: April 22,...

Multiple Cross-Site Request Forgery Vulnerabilities at Synametrics Technologies

A cross-site request forgery vulnerability in the mngUsers operation in Synametrics Technologies /app allows remote attackers to construct a malicious URI, trick a user into parsing it, and can target the user context to perform malicious actions...

FreePBX 12.0.43 Cross Site Scripting

Advisory ID: HTB23253 Product: FreePBX Vendor: Sangoma Technologies Vulnerable Versions: 12.0.43 and probably prior Tested Version: 12.0.43 Advisory Publication: March 18, 2015 without technical details Vendor Notification: March 18, 2015 Vendor Patch: March 27, 2015 Public Disclosure: April 22,...

Report Recommends Series of Cybersecurity Changes at FAA

The Federal Aviation Administration needs to upgrade and update its information security capabilities–including building a threat-modeling capability and implementing federal security guidelines–in order to ensure the safety of the nation’s aviation infrastructure, according to a new report by th...

PT-2015-15

Name of the Vulnerable Software and Affected Versions LiteSpeed affected versions not specified Description The issue is related to a lack of protection for internal data in the LiteSpeed web application server, allowing an attacker to obtain the contents of random memory segments, such as parts ...

hivex, ocaml, perl, python, ruby security update

CentOS Errata and Security Advisory CESA-2015:0301 Updated hivex packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common...

Debian DSA-3183-1 : movabletype-opensource - security update

Multiple vulnerabilities have been discovered in Movable Type, a blogging system. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2013-2184 Unsafe use of Storable::thaw in the handling of comments to blog posts could allow remote attackers to include and...

Debian Security Advisory DSA 3183-1 (movabletype-opensource - security update)

Multiple vulnerabilities have been discovered in Movable Type, a blogging system. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2013-2184 Unsafe use of Storable::thaw in the handling of comments to blog posts could allow remote attackers to include and...

Agilent Technologies Feature Extraction AnnotationX.AnnList.1 ActiveX Control Arbitrary Code Execution Vulnerability

Agilent Technologies Feature Extraction is a set of feature extraction software for automatically reading and processing image files from multiple original chips from Agilent Technologies. A security vulnerability exists in Agilent Technologies Feature Extraction's AnnotationX.AnnList.1 ActiveX...

PT-2016-61

Name of the Vulnerable Software and Affected Versions TP-Link wireless router management system affected versions not specified Description The issue is caused by resource management errors in the web interface of the TP-Link wireless router management system. An attacker can exploit this issue b...

CVE-2015-2092

The AnnotationX.AnnList.1 ActiveX control in Agilent Technologies Feature Extraction allows remote attackers to execute arbitrary code via a crafted object parameter in the Insert function, related to "Index Out-Of-Bounds."...

Out-of-bounds

The AnnotationX.AnnList.1 ActiveX control in Agilent Technologies Feature Extraction allows remote attackers to execute arbitrary code via a crafted object parameter in the Insert function, related to "Index Out-Of-Bounds."...

CVE-2015-2092

The CVE-2015-2092 entry concerns Agilent Technologies Feature Extraction, specifically the AnnotationX.AnnList.1 ActiveX control. The vulnerability allows remote code execution via a crafted object parameter in the Insert function, related to an index-out-of-bounds condition. Public documentation...

CVE-2015-2092

The AnnotationX.AnnList.1 ActiveX control in Agilent Technologies Feature Extraction allows remote attackers to execute arbitrary code via a crafted object parameter in the Insert function, related to "Index Out-Of-Bounds."...

CVE-2015-2092: Improper Restriction of Operations within the Bounds of a Memory Buffer

The AnnotationX.AnnList.1 ActiveX control in Agilent Technologies Feature Extraction allows remote attackers to execute arbitrary code via a crafted object parameter in the Insert function, related to "Index Out-Of-Bounds."...