Oracle Solaris Third-Party Patch Update : librsvg (cve_2011_3146_denial_of)

The remote Solaris system is missing necessary patches to address security updates : - librsvg before 2.34.1 uses the node name to identify the type of node, which allows context-dependent attackers to cause a denial of service NULL pointer dereference and possibly execute arbitrary code via a SV...

Oracle Solaris Third-Party Patch Update : ejabberd (cve_2013_6169_cryptographic_issues)

The remote Solaris system is missing necessary patches to address security updates : - The modpubsub module modpubsub.erl in ejabberd 2.1.8 and 3.0.0-alpha-3 allows remote authenticated users to cause a denial of service infinite loop via a stanza with a publish tag that lacks a node attribute...

Oracle Solaris Third-Party Patch Update : gnutls (cve_2011_4128_buffer_overflow)

The remote Solaris system is missing necessary patches to address security updates : - Buffer overflow in the gnutlssessiongetdata function in lib/gnutlssession.c in GnuTLS 2.12.x before 2.12.14 and 3.x before 3.0.7, when used on a client that performs nonstandard session resumption, allows remot...

Oracle Solaris Third-Party Patch Update : hplip (cve_2013_0200_link_following)

The remote Solaris system is missing necessary patches to address security updates : - HP Linux Imaging and Printing HPLIP through 3.12.4 allows local users to overwrite arbitrary files via a symlink attack on the 1 /tmp/hpcupsfilterc .bmp, 2 /tmp/hpcupsfilterk.bmp, 3 /tmp/hpcupsjob.out, 4...

Oracle Solaris Third-Party Patch Update : dbus (cve_2013_2168_input_validation)

The remote Solaris system is missing necessary patches to address security updates : - The dbusprintfstringupperbound function in dbus/dbus-sysdeps-unix.c in D-Bus aka DBus 1.4.x before 1.4.26, 1.6.x before 1.6.12, and 1.7.x before 1.7.4 allows local users to cause a denial of service service cra...

Oracle Solaris Third-Party Patch Update : samba (cve_2013_4475_access_control)

The remote Solaris system is missing necessary patches to address security updates : - Samba 3.2.x through 3.6.x before 3.6.20, 4.0.x before 4.0.11, and 4.1.x before 4.1.1, when vfsstreamsdepot or vfsstreamsxattr is enabled, allows remote attackers to bypass intended file restrictions by leveragi...

Oracle Solaris Third-Party Patch Update : gtk (cve_2012_2370_denial_of)

The remote Solaris system is missing necessary patches to address security updates : - Multiple integer overflows in the readbitmapfiledata function in io-xbm.c in gdk-pixbuf before 2.26.1 allow remote attackers to cause a denial of service application crash via a negative 1 height or 2 width in ...

Oracle Solaris Third-Party Patch Update : transmission (cve_2012_4037_xss_vulnerability)

The remote Solaris system is missing necessary patches to address security updates : - Multiple cross-site scripting XSS vulnerabilities in the web client in Transmission before 2.61 allow remote attackers to inject arbitrary web script or HTML via the 1 comment, 2 created by, or 3 name field in ...

Oracle Solaris Third-Party Patch Update : tomcat (cve_2013_0346_permissions_privileges)

The remote Solaris system is missing necessary patches to address security updates : - DISPUTED Apache Tomcat 7.x uses world-readable permissions for the log directory and its files, which might allow local users to obtain sensitive information by reading a file. NOTE: One Tomcat distributor has...

Oracle Solaris Third-Party Patch Update : telnet (cve_2011_4862_buffer_overflow)

The remote Solaris system is missing necessary patches to address security updates : - Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications aka krb5-appl 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other...

Oracle Solaris Third-Party Patch Update : fetchmail (multiple_vulnerabilities_in_fetchmail) (BEAST)

The remote Solaris system is missing necessary patches to address security updates : - The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained...

Oracle Solaris Third-Party Patch Update : kerberos (cve_2002_2443_denial_of)

The remote Solaris system is missing necessary patches to address security updates : - schpw.c in the kpasswd service in kadmind in MIT Kerberos 5 aka krb5 before 1.11.3 does not properly validate UDP packets before sending responses, which allows remote attackers to cause a denial of service CPU...

Pirelli Home Broadband Routers Exposed for Two Years

ISP-issued home broadband routers have been a shooting gallery for researchers and hackers alike looking for, and successfully exploiting, shocking vulnerabilities. One disclosed by a researcher in Spain this week is symptomatic of the problem to a disturbing degree. Researcher Eduardo Novella...

CVE-2014-100007

Cross-site scripting XSS vulnerability in the HK Exif Tags plugin before 1.12 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via an EXIF tag. NOTE: some of these details are obtained from third party information...

Facebook Open Redirect

Facebook Old Generated URLs Still Vulnerable to Open Redirect Attacks & A New Open Redirect Security Vulnerability Domain: http://www.facebook.com Discover: Wang Jing, School of Physical and Mathematical Sciences SPMS, Nanyang Technological University NTU, Singapore...

Zappos Settles with Nine States Following Data Breach

Online retailer Zappos this week settled with attorneys general in nine states, agreeing to pay out $106,000 stemming from a data breach in 2012 that exposed 24 million customers’ information. Massachusetts Attorney General Martha Coakley filed the settlement in Suffolk Superior Court on Wednesda...

Multiple vulnerabilities in Content Rating Extbase (content_rating_extbase)

It has been discovered that the extension "Content Rating Extbase" contentratingextbase is susceptible to Cross-Site Scripting and SQL Injection. Release Date: January 9, 2015 Bulletin Update: February 23, 2015 added CVEs Component Type: Third party extension. This extension is not a part of the...

Facebook Careers Page XXE Vulnerability Patched

A vulnerability was discovered and patched in a third-party service that handles resumes on Facebook’s careers page. The discovery was worth more than $6,000 in a bounty paid out by Facebook to researcher Mohamed Ramadan of Egypt, who published some details of the vulnerability and exploit on his...

IPCop 2.1.4 Cross Site Request Forgery / Cross Site Scripting

Exploit Title: IPCop = 2.1.4 XSS to CSRF to Remote Command Execution Date: 21/12/2014 Author: Yann CAM @ Synetis - ASafety Vendor or Software Link: www.ipcop.org - www.ipcop.org/download.php Version: 2.1.4 Category: Remote Command Execution Google dork: Tested on: IPCop distribution IPCop...

Multiple broadband routers use vulnerable versions of Allegro RomPager

Overview Multiple broadband routers use vulnerable versions of Allegro RomPager in current firmware releases. Description Many home and office/home office SOHO routers have been found to be using vulnerable versions of the Allegro RomPager embedded web server. Allegro RomPager versions prior to...