Barracuda Networks Bug Bounty #31 Firewall - Persistent Access Policy Vulnerability

Document Title: =============== Barracuda Networks Bug Bounty 31 Firewall - Persistent Access Policy Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1070 Barracuda Networks Security ID BNSEC: BNSEC-2068 Release Date: ============= 2014-02-2...

CVE-2013-6167

Mozilla Firefox through 27 sends HTTP Cookie headers without first validating that they have the required character-set restrictions, which allows remote attackers to conduct the equivalent of a persistent Logout CSRF attack via a crafted parameter that forces a web application to set a malformed...

CVE-2013-3900 WinVerifyTrust Signature Validation Vulnerability

...

Cooper Power Systems Cybectec DNP3 Master OPC Server Improper Input Validation

OVERVIEW Adam Crain of Automatak and independent researcher Chris Sistrunk have identified an improper input validation vulnerability in Cooper Power Systems Cybectec DNP3 Master OPC Server software. Cooper Power Systems has discontinued the OPC server and recommends that customers use the SMP...

Catapult Software DNP3 Driver Improper Input Validation

OVERVIEW This advisory was originally posted to the US-CERT secure Portal library on October 24, 2013, and is now being released to the NCCIC/ICS-CERT Web site. Adam Crain of Automatak and independent researcher Chris Sistrunk have identified an improper input validation in Catapult Software’s DN...

Microsoft Sharepoint (Cloud) Persistent Script Insertion

Title: ====== Microsoft SharePoint Cloud - Persistent Exception-Handling Web Vulnerability Date: ===== 2013-06-14 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=812 Microsoft Security Response Center MSRC ID: 14096 Microsoft Security Response Center MSRC MANAGER: JT MS...

Moderate: Red Hat Security Advisory: mesa security update

Updated mesa packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2013-0240

Gnome Online Accounts GOA 3.4.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.5, does not properly validate SSL certificates when creating accounts such as Windows Live and Facebook accounts, which allows man-in-the-middle attackers to obtain sensitive information such as credentials by sniffing the...

Ubuntu 9.10 : grub2 vulnerability (USN-868-1)

It was discovered that GRUB 2 did not properly validate passwords. An attacker with physical access could conduct a brute-force attack and bypass authentication by submitting a 1 character password. Note that Tenable Network Security has extracted the preceding description block directly from the...

VoipNow Service Provider Edition - Arbitrary Command Execution

VoipNow Service Provider Edition - Arbitrary Command Execution source: https://www.securityfocus.com/bid/57032/info VoipNow Service Provider Edition is prone to a remote arbitrary command-execution vulnerability because it fails to properly validate user-supplied input. An attacker can exploit th...

CVE-2012-5118

Google Chrome before 23.0.1271.64 on Mac OS X does not properly validate an integer value during the handling of GPU command buffers, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors...

CVE-2011-2502

runtime/staprun/staprunfuncs.c in the systemtap runtime tool staprun in SystemTap before 1.6 does not properly validate modules when a module path is specified by a user for user-space probing, which allows local users in the stapusr group to gain privileges via a crafted module in the search pat...

CVE-2012-1893

win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly validate callback parameters during creation of a hook procedure, which allows local users t...

Ubuntu 10.04 LTS : ubuntuone-client regression (USN-1465-3)

USN-1465-1 fixed vulnerabilities in Ubuntu One Client. The update failed to install on certain Ubuntu 10.04 LTS systems that had a legacy Python 2.5 package installed. This update fixes the problem. We apologize for the inconvenience. It was discovered that the Ubuntu One Client incorrectly...

EZEIP3. 0 multi-page upload validation vulnerability-vulnerability warning-the black bar safety net

Modify the IE browser security settings, the modulation is the highest, however, prohibit the js execution. 2. Open the Modify upload Type page, add aspx type, click Save, and then open the upload page to upload There is a problem of the upload Type page: http://www.XXX.com/...

DHTMLX Suite 3.0 SQL Injection / Cross Site Scripting

Title: ====== DHTMLX Suite v.3.0 - Multiple Web Vulnerabilities Date: ===== 2012-04-11 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=507 VL-ID: ===== 507 Introduction: ============= To demonstrate the rich possibilities of DHTMLX controls and to show how they work...

VMSA-2012-0005 : VMware vCenter Server, Orchestrator, Update Manager, vShield, vSphere Client, Workstation, Player, ESXi, and ESX address several security issues

a. VMware Tools Display Driver Privilege Escalation The VMware XPDM and WDDM display drivers contain buffer overflow vulnerabilities and the XPDM display driver does not properly check for NULL pointers. Exploitation of these issues may lead to local privilege escalation on Windows-based Guest...

VMware ESXi/ESX patches address several security issues (VMSA-2012-0005)

The remote ESXi is missing one or more security related Updates from VMSA-2012-0005. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Oracle Outside In Library OOXML Overflow

Added: 02/03/2012 CVE: CVE-2012-0110 BID: 51452 OSVDB: 78411 Background Oracle Outside In is a a suite of software development kits that allows developers with a comprehensive solution to access, transform, and control the contents of over 500 unstructured file formats. Problem Outside In version...

Oracle Solution Website - Cross Site Scripting Vulnerabilities

Document Title: =============== Oracle Solution Website - Cross Site Scripting Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=370 Release Date: ============= 2012-01-27 Vulnerability Laboratory ID VL-ID:...