CVE-2014-3265

CVE-2014-3265 describes a cross-site scripting (XSS) vulnerability in the Auto Update Server (AUS) web framework used by Cisco Security Manager (CSM) 4.2 and earlier. The root cause is insufficient input validation of a parameter within the AUS web framework, enabling remote attackers to inject a...

Cisco Security Manager AUS Cross-Site Scripting Vulnerability

A vulnerability in the web framework of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface. The vulnerability is due to insufficient input validation of a parameter, which affects the Auto Update...

Server Misconfiguration discloses passwords of all Barracuda Network Employees

Security expert Ebrahim Hegazy has found a Password disclosure vulnerability in Barracuda update servers which allows to gain access to employee credentials. The Egyptian information security advisor Ebrahim Hegazy@Zigoo0 has found a Password disclosure vulnerability in one of Barracuda update...

CentOS Update for gnutls CESA-2013:0883 centos5

Check for the Version of gnutls OpenVAS Vulnerability Test CentOS Update for gnutls CESA-2013:0883 centos5 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under th...

Analysis Reveals Flame Malware's Process Injection Tricks

As researchers continue to pull apart the Gauss malware code, looking for spreading mechanisms and infection vectors, there is still some work being done on Gauss’s cousin Flame, as well. New research from CERT Polska reveals how deeply Flame burrows itself into infected systems, showing that the...

Microsoft Details Flame Hash-Collision Attack

The details of the collision attack used by the Flame malware authors to create a forged code-signing certificate for Microsoft code are beginning to emerge, and the company said that the attackers used an MD5 hash collision specifically to ensure that their attack would work on machines running...

McAfee LinuxShield <= 1.5.1 Local/Remote Root Code Execution

No description provided by source. !/usr/bin/perl Title: McAfee LinuxShield = 1.5.1 Local/Remote Root Exploit Name: nailsRoot.pl Author: Nikolas Sotiriu lofi lofiatsotiriu.de WARNING: This Exploit deletes the default Update Server Use it only for education or ethical pentesting! The author accept...

McAfee LinuxShield 1.5.1 Remote Root Exploit

!/usr/bin/perl Title: McAfee LinuxShield WARNING: This Exploit deletes the default Update Server Use it only for education or ethical pentesting! The author accepts no liability for damage caused by this tool. use strict; use IO::Socket::SSL; use Getopt::Std; my %args; my $ack; my $timestamp;...

McAfee LinuxShield 1.5.1 - Local/Remote File Inclusion / Remote Code Execution

!/usr/bin/perl Title: McAfee LinuxShield WARNING: This Exploit deletes the default Update Server Use it only for education or ethical pentesting! The author accepts no liability for damage caused by this tool. use strict; use IO::Socket::SSL; use Getopt::Std; my %args; my $ack; my $timestamp;...

McAfee LinuxShield 1.5.1 - LocalRemote File Inclusion Remote Code Execution

McAfee LinuxShield 1.5.1 - LocalRemote File Inclusion Remote Code Execution !/usr/bin/perl Title: McAfee LinuxShield WARNING: This Exploit deletes the default Update Server Use it only for education or ethical pentesting! The author accepts no liability for damage caused by this tool. use strict;...

SOL10905 - NTP vulnerability - CVE-2009-3563

F5 Product Development has determined that these BIG-IP and Enterprise Manager versions use a vulnerable version of NTP. However, the vulnerable code is not used by default on these BIG-IP or Enterprise Manager systems. These products are only vulnerable if NTP was manually configured and enabled...

Fedora Update for cobbler FEDORA-2008-9745

Check for the Version of cobbler OpenVAS Vulnerability Test Fedora Update for cobbler FEDORA-2008-9745 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

Trend Micro HouseCall ActiveX control does not adequately validate update server parameters

Overview The Trend Micro HouseCall ActiveX control contains a vulnerability that can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description The Trend Micro HouseCall ActiveX control HousecallActiveX.dll includes an update feature. A web page hosting...

Remote code execution

The Trend Micro HouseCall ActiveX control 6.51.0.1028 and 6.6.0.1278 in HousecallActiveX.dll allows remote attackers to download an arbitrary library file onto a client system via a "custom update server" argument. NOTE: this can be leveraged for code execution by writing to a Startup folder...

[SECURITY] Fedora 8 Update: cobbler-1.2.9-1.fc8

Cobbler is a network boot and update server. Cobbler supports PXE, provisioning virtualized images, and reinstalling existing Linux machines. The last two modes require a helper tool called 'koan' that integrates with cobbler. Cobbler's advanced features include importing distributions from DVDs...

Directory traversal

Directory traversal vulnerability in BitDefender Update Server http.exe, as used in BitDefender products including Security for Fileservers and Enterprise Manager BDEM, allows remote attackers to read arbitrary files via .. dot dot sequences in an HTTP request...

CVE-2008-0396

Directory traversal vulnerability in BitDefender Update Server http.exe, as used in BitDefender products including Security for Fileservers and Enterprise Manager BDEM, allows remote attackers to read arbitrary files via .. dot dot sequences in an HTTP request...

CVE-2008-0396

Directory traversal vulnerability in BitDefender Update Server http.exe, as used in BitDefender products including Security for Fileservers and Enterprise Manager BDEM, allows remote attackers to read arbitrary files via .. dot dot sequences in an HTTP request...

CVE-2008-0396

CVE-2008-0396 is a directory traversal vulnerability in BitDefender Update Server (http.exe) used by BitDefender products. The vulnerability allows an unauthenticated remote attacker to read arbitrary files by crafting HTTP requests with directory traversal sequences (..). The issue affects the U...

BitDefender Update Server Detection

The remote web server is a BitDefender Update Server, used for centralized updates of BitDefender products on a local network. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid30020; scriptversion"1.15"; scriptsetattributeattribute:"pluginmodificationdate",...