[security bulletin] HPSBMU03081 rev.1 - HP Enterprise Maps, Remote Information Disclosure

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04390793 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04390793 Version: 1 HPSBMU03081 rev....

Consumer Groups Urge FTC to Halt Facebook Data Collection Program

A collection of privacy and consumer groups from the United States and Europe has asked the Federal Trade Commission to force Facebook to suspend a recently installed program that mines information on sites that users’ visit around the Web in order to serve them interest-based ads. The groups say...

Escape or filter script tags in "all activity" panel

We've got an external report about a third party plugin: quote From: Vincent Ollivier Date: 29 July 2014 13:12 Subject: JIRA 6.2.5 / JEditor XSS Vulnerability To: [email protected] Hi, Sorry for the email, I couldn't find the correct project to report this security issue. There's an XSS in...

Escape or filter script tags in "all activity" panel

We've got an external report about a third party plugin: quote From: Vincent Ollivier Date: 29 July 2014 13:12 Subject: JIRA 6.2.5 / JEditor XSS Vulnerability To: [email protected] Hi, Sorry for the email, I couldn't find the correct project to report this security issue. There's an XSS in...

Third-Party Software Library Risks Scrutinized at Black Hat

Enterprise application developers are under real pressures to push projects out the door quickly and cheaply, and each new version certainly has to be better than the last. This forces them to make decisions that, at a minimum, improve efficiency—and also introduce additional risks. Of particular...

Google Project Zero a Big Win for Security

Billions of people–not to mention a decent portion of the world’s economies–depend upon the Internet in a way that is both amazing and terrifying. We rely on the network in a way that perhaps we have never relied on anything in the course of human history. The Internet is a wonderful resource, bu...

Security Advisory 2982792 released, Certificate Trust List updated

Today, we are updating the Certificate Trust List CTL for all supported releases of Microsoft Windows to remove the trust of mis-issued third-party digital certificates. These certificates could be used to spoof content and perform phishing or man-in-the-middle attacks against web properties. Wit...

XXE in multiple third party components - ownCloud

Multiple third party components of ownCloud are vulnerable to XXE attacks, which may lead to: Local File Disclosure Server Side Request Forgery DoS Code Execution depending on the PHP wrappers … The following libraries are affected: ZendFramework: CVE-2014-2052 GetID3: CVE-2014-2053 PHPExcel:...

QIP 2005 Malformed Rich Text Message Remote Denial of Service Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/33609/info QIP 2005 is prone to a remote denial-of-service vulnerability. Exploiting this issue may allow attackers to cause the application to hang and consume excessive computer resources, denying service to legitimate...

Nokia Electronic Documentation 5.0 Connection Redirection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/8625/info A vulnerability has been discovered in Nokia Electronic Documentation NED that may allow an attacker to redirect connections to a third party system. The problem likely occurs due to the NED server failing to...

Quinn "the Eskimo" and Peter N. Lewis Internet Config 1.0/2.0 Weak Password Encryption Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/546/info Internet Config is a third-party freeware utility for MacOS. It provides a means of centralizing frequently-required connection information, including passwords, for use by several programs. The passwords are...

Motorola SB5101 Hax0rware Rajko HTTPD Remote Exploit PoC

No description provided by source. !/usr/bin/perl Motorola SB5101 Hax0rware Rajko HttpD Remote Exploit PoC Author: Dillon Beresford Date: 6/6/2010 Vendor: SBHacker & Motorola Software Link: http://www.sbhacker.net/forum/index.php Tested on Hax0rware 1.1 R30, R32 and R39 Description: Motorola SB51...

Teamtek Universal FTP Server Multiple Commands Remote Denial of Service Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/21085/info Universal FTP Server is prone to multiple remote denial-of-service vulnerabilities because the application fails to handle exceptional conditions. An attacker can exploit these issues to crash the affected...

nodesforum 1.059 - Remote File Inclusion Vulnerability

No description provided by source. Exploit Title: nodesforum 1.059 Remote File Inclusion Vulnerability Google Dork: inurl: powered by Nodesforum Date: 6/23/2011 Author: bd0rk bd0rkathackermail.com Software-Download: http://home.nodesforum.com/download?file=nodesforum1.059withbbcode1.004.zip Teste...

PIX Firewall 2.7/3.x/4.x/5 Forged TCP RST Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1454/info A connection through a Cisco Secure PIX Firewall can be reset by a third party if the source and destination IP addresses and ports of the connection can be determined or inferred. This can be accomplished by...

Roxio Toast 7 DejaVu Component PATH Variable Local Privilege Escalation Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/19596/info Roxio Toast is prone to a local privilege-escalation vulnerability because it fails to properly sanitize user-supplied input. As a result, local users may set their own search path for external applications tha...

Fat Player 0.6b - WAV File Processing Buffer Overflow (SEH)

No description provided by source. Stack-based buffer overflow in Fat Player 0.6b allows remote attackers to execute arbitrary code via a long string in a .wav file. NOTE: some of these details are obtained from third party information. Reference:...

Define the security for which plugins can be used by which users on which pages

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Cloud. Using Confluence Server? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFSERVER-34095. panel This is a request for a new feature which could restrict/define the usage of specific plugins/macros to only allow...

[security bulletin] HPSBMU03048 rev.1 - HP Software Executive Scorecard, Remote Execution of Code, Directory Traversal

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04341295 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04341295 Version: 1 HPSBMU03048 rev....

PayPal GoToMaxx PDFMailer - Local Overflow Vulnerability

Document Title: =============== PayPal GoToMaxx PDFMailer - Local Overflow Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1274 http://www.vulnerability-lab.com/getcontent.php?id=940 Video: https://www.youtube.com/watch?v=IXhwfZV6x0M Release Date:...