4574 matches found
mnoGoSearch 3.3.12 Arbitrary File Read
----------------------------------------------------------- PT-2013-17 Positive Technologies Security Advisory Arbitrary Files Reading in mnoGoSearch ----------------------------------------------------------- --- Vulnerable software mnoGoSearch Version: 3.3.12 and earlier Application link:...
China Publicly Claims to Be the Victim of U.S. Cyberattacks
On Thursday the Chinese government, long considered the aggressor in highly publicized U.S. cyberattacks, publicly spoke about being the victim. Two of its military Web sites were attacked an average of 144,000 per month and two-thirds of those strikes came from the United States, according to a...
Fedora Update for xulrunner FEDORA-2013-2794
Check for the Version of xulrunner OpenVAS Vulnerability Test Fedora Update for xulrunner FEDORA-2013-2794 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under th...
PT-2013-22: XML External Entity Injection in Trustwave ModSecurity
Positive Research Center experts have discovered "XML External Entity Injection" vulnerability in Trustwave ModSecurity. If an attacker sends specially crafted request containing malformed XML to server with ModSecurity, the server will automatically send the contents of local or remote resources...
[SECURITY] Fedora 17 Update: xulrunner-19.0-1.fc17
XULRunner is a Mozilla runtime package that can be used to bootstrap XUL+XP COM applications that are as rich as Firefox and Thunderbird. It provides mecha nisms for installing, upgrading, and uninstalling these applications. XULRunner a lso provides libxul, a solution which allows the embedding ...
[SECURITY] Fedora 18 Update: xulrunner-19.0-1.fc18
XULRunner is a Mozilla runtime package that can be used to bootstrap XUL+XP COM applications that are as rich as Firefox and Thunderbird. It provides mecha nisms for installing, upgrading, and uninstalling these applications. XULRunner a lso provides libxul, a solution which allows the embedding ...
Wonderware Intelligence Tableau Server Ruby on Rails Improper Input Validation (Update A)
Overview This updated advisory was orignally posted to the US-CERT secure Portal library on February 5, 2013, and is now being released to the ICS-CERT Web page. Mitigation details for multiple vulnerabilities that impact third-party software integrated into the Invensys Wonderware Intelligence...
Samsung's new OS Tizen 2.0 source code released
The Tizen 2.0 source code and SDK has officially been released. Tizen is a Linux-based open-source software platform backed by Intel and Samsung Electronics, that is designed for smartphones, tablets, smart TVs and in-car systems and it's designed to run apps written using web technologies...
Samsung's new OS Tizen 2.0 source code released
The Tizen 2.0 source code and SDK has officially been released. Tizen is a Linux-based open-source software platform backed by Intel and Samsung Electronics, that is designed for smartphones, tablets, smart TVs and in-car systems and it’s designed to run apps written using web technologies...
PT-2013-18: Variables Overwriting in mnoGoSearch
Positive Technologies experts have detected a Cross-Site Scripting vulnerability in mnoGoSearch. Due to incorrect application architecture, all the template variables and variables sent by the client are stored in the same list. This vulnerability allows attackers to overwrite any uninitialized...
[PT-2012-53] Privilege Gaining in DataLife Engine
----------------------------------------------------------- PT-2012-53 Positive Technologies Security Advisory Privilege Gaining in DataLife Engine ----------------------------------------------------------- --- Vulnerable software DataLife Engine Version: 9.7 and earlier Application link:...
DefenseCode Security Advisory: Cisco Linksys Remote Preauth 0day Root Exploit Follow-Up
A few weeks ago, we have announced remote preauth root access exploit for Cisco Linksys http://www.youtube.com/watch?v=cv-MbL7KFKE. Vulnerability details were disclosed here: http://www.defensecode.com/public/DefenseCodeBroadcomSecurityAdvisory.pdf During further research, we have discovered that...
PT-2013-15: XML External Entities Injection in vBulletin 5 Connect
The specialists of the Positive Research center have detected an XML External Entities Injection vulnerability in vBulletin 5 Connect. The vulnerability was detected in "appendersocketserver.php" of the Apache log4php library used by vBulletin. PHP's built-in SoapClient class allows the use of...
PT-2013-12: open_basedir bypass in PHP
The specialists of Positive Technologies have detected bypass of the configuration directive "openbasedir" in PHP. The vulnerability was detected in the PHP's built-in SoapClient class. PHP does not validate the configration directive "soap.wsdlcachedir" before writing SOAP wsdl cache files to th...
PT-2013-14: XML External Entities Injection in PHP
The specialists of Positive Technologies have detected an "XXE" vulnerability in PHP. The vulnerability was detected in the PHP's built-in SoapClient and SoapServer classes. PHP allows the use of external entities while parsing SOAP wsdl files which allows an attacker to read arbitrary files. If ...
PT-2013-07: Path and Version Disclosure in Oracle Siebel CRM
The specialists of the Positive Research center have detected a Path and Version Disclosure vulnerability in Oracle Siebel CRM. An attacker is able to disclose software path and version if he imports an invalid XML file. How to fix Update your software up to the latest version Advisory status...
DataLife Engine 9.7 Session Fixation
----------------------------------------------------------- PT-2012-53 Positive Technologies Security Advisory Privilege Gaining in DataLife Engine ----------------------------------------------------------- --- Vulnerable software DataLife Engine Version: 9.7 and earlier Application link:...
PT-2013-11: XML External Entities Injection in Oracle Siebel CRM
The specialists of the Positive Research center have detected an XML External Entities Injection vulnerability in Oracle Siebel CRM. The vulnerability is possible during import of XML files in CRM Siebel. An attacker is able to read an arbitrary file on the target system. How to fix Update your...
PT-2013-08: Remote OS Command Execution in Oracle Siebel CRM
The specialists of the Positive Research center have detected a Remote OS Command Execution vulnerability in Oracle Siebel CRM. An attacker is able to execute arbitrary commands on the target system with current user's privileges and also access its file system using eScript embedded tools. How t...
