PT-2016-03: SQL Injection in Advantech WebAccess

The specialists of the Positive Research center have detected an SQL Injection vulnerability in Advantech WebAccess. Advantech WebAccess before 8.1 allows remote authenticated users to execute arbitrary SQL commands to modify web server settings, accounts, and projects. How to fix Update your...

Pandora FMS < 5.1 SP1 Multiple Vulnerabilities - Active Check

Pandora FMS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:artica:pandorafms"; ifdescripti...

DBD::PgPP vulnerable to SQL injection

Overview DBD::PgPP is a pure-Perl client interface for the PostgreSQL database. DBD::PgPP contains a SQL injection vulnerability. Toshiharu Sugiyama reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact If DBD::Pg...

Wordpress Google Document Embedder 2.5.14 SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Google Doc Embedder 2.5.14 SQL Injection Date: 10-11-2014 Exploit Author: Kacper Szurek - http://security.szurek.pl http://twitter.com/KacperSzurek Software Link:...

Symantec Endpoint Protection 12.1.4023.4080 - Multiple Vulnerabilities

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: XXE & XSS & Arbitrary File Write vulnerabilities product: Symantec Endpoint Protection vulnerable version: 12.1.4023.4080 fixed version: 12.1.5 RU 5 impact: Critical CVE...

PT-2014-8631

Name of the Vulnerable Software and Affected Versions: Web Dorado Spider Video Player plugin versions prior to 1.5.2 Description: The issue is related to a cross-site scripting XSS vulnerability, which allows remote attackers to inject arbitrary web script or HTML. This can be achieved via...

PT-2014-5409 · Google +2 · Luci +2

Name of the Vulnerable Software and Affected Versions: luci version 0.26.0 Description: The issue allows remote authenticated users with certain permissions to execute arbitrary Python code via a crafted cluster configuration. Recommendations: For luci version 0.26.0, update to a version that fix...

SLFileManager for Android vulnerable to directory traversal

Overview SLFileManager provided by S-Link, Inc. contains a flaw in processing file names, which may result in a directory traversal CWE-22 vulnerability. Ryohei Koike of Sakura Information Systems Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

PT-2014-6294 · Esri · Esri Arcgis For Server

Name of the Vulnerable Software and Affected Versions: ESRI ArcGIS for Server version 10.1.1 Description: The issue allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, which can lead to cross-site scripting XSS attacks. Recommendations: For ESRI ArcGIS for...

Tenable Nessus Web UI Information Disclosure Vulnerability

Tenable Nessus is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

KLA10071 DoS vulnerability in Apache Subversion

An unspecified vulnerability was found in Apache Subversion. By exploiting this vulnerability malicious users can cause denial of service. This vulnerability can be exploited from the network at a point related to moddavsvn via a specially designed OPTIONS request. Original advisories Apache...

KLA10354 ACE vulnerability in Symantec Endpoint Protection

A buffer overflow was found in Symantec products. By exploiting this vulnerability malicious users can execute arbitrary code. This vulnerability can be exploited remotely via a specially designed argument. Original advisories Symantec advisory Exploitation Public exploits exist for this...

KLA10265 Multiple vulnerabilities in MySQL

Unspecified vulnerabilities were found in MySQL Server. By exploiting these vulnerabilities malicious users can affect integrity, confidentiality and availability. These vulnerabilities can be exploited remotely at vectors related to SRCHAR, SRINFOSC and ENFED. Original advisories - Related...

KLA10284 Multiple vulnerabilities in Oracle VirtualBox

Unspecified vulnerabilities were found in Oracle VirtualBox. By exploiting this vulnerability malicious users can affect integrity, availability and confidentiality. This vulnerability can be exploited remotely via unknown vectors. Original advisories - Exploitation Public exploits exist for this...

Infoblox NetMRI < 6.8.5 OS Command Injection Vulnerability - Active Check

Infoblox NetMRI is prone to an OS command injection vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Adobe Flash Player Multiple Vulnerabilities-01 (Jul 2014) - Windows

Adobe Flash Player is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:adobe:flashplayer";...

KLA10290 DoS vulnerability in PHP

A use-after-free vulnerability was found in PHP. By exploiting this vulnerability malicious users can cause denial of service or cause other unspecified impact. This vulnerability can be exploited locally at a point related to SPL. Original advisories PHP bugtracker Related products PHP CVE list...

Hosting Controller <= 6.1 Hotfix 3.1 Privilege Escalation Vulnerability

No description provided by source. Title: An attacker can gain reseller privileges and after that can gain admin privileges Version: 6.1 Hotfix = 3.1 Developer url: www.Hostingcontroller.com Solution: Update to Hotfix 3.2 Discover date: 2005,Summer Report date to hc company: Sat Jun 10, 2006...

KLA10262 PE vulnerability in McAfee

An unspecified vulnerability was found in McAfee products. By exploiting this vulnerability malicious users can gain privileges. This vulnerability can be exploited locally. Original advisories McAfee bulletin Related products McAfee-Host-Intrusion-Prevention McAfee-VirusScan CVE list Solution...

TERASOLUNA Server Framework for Java(Web) vulnerable to ClassLoader manipulation

Overview TERASOLUNA Server Framework for JavaWeb provided by NTT DATA Corporation is a software framework for creating Java web applications. TERASOLUNA Server Framework for JavaWeb bundles Apache Struts 1.2.9, which contains a vulnerability where the ClassLoader may be manipulated CVE-2014-0114...