ACROS Security: Remote Binary Planting in Apple iTunes for Windows (ASPR #2010-08-18-1)

=====BEGIN-ACROS-REPORT===== PUBLIC ========================================================================= ACROS Security Problem Report 2010-08-18-1 ------------------------------------------------------------------------- ASPR 2010-08-18-1: Remote Binary Planting in Apple iTunes for Windows...

Cisco Security Advisory: Multiple Vulnerabilities in Cisco ASA 5500 Series Adaptive Security Appliances

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Multiple Vulnerabilities in Cisco ASA 5500 Series Adaptive Security Appliances Advisory ID: cisco-sa-20100804-asa http://www.cisco.com/warp/public/707/cisco-sa-20100804-asa.shtml Revision 1.0 For Public Release 2010 August 04...

Cisco Security Advisory: Multiple Vulnerabilities in Cisco Firewall Services Module

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Multiple Vulnerabilities in Cisco Firewall Services Module Advisory ID: cisco-sa-20100804-fwsm Revision 1.0 For Public Release 2010 August 04 1600 UTC GMT +---------------------------------------------------------------------...

Cisco Security Advisory: Hard-Coded SNMP Community Names in Cisco Industrial Ethernet 3000 Series Switches Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Hard-Coded SNMP Community Names in Cisco Industrial Ethernet 3000 Series Switches Vulnerability Advisory ID: cisco-sa-20100707-snmp Revision 1.0 For Public Release 2010 July 07 1600 UTC GMT...

Microsoft Windows Help and Support Center Vulnerability

US-CERT is aware of a vulnerability affecting the Mircosoft Windows Help and Support Center. This vulnerability is due to improper sanitization of hcp:// URIs. Exploitation of this vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands. US-CERT encourages users a...

Cisco Security Advisory: Multiple Vulnerabilities in Cisco Network Building Mediator

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Multiple Vulnerabilities in Cisco Network Building Mediator Document ID: 111014 Advisory ID: cisco-sa-20100526-mediator http://www.cisco.com/warp/public/707/cisco-sa-20100526-mediator.shtml Revision 1.0 For Public Release 2010...

VideoLAN Releases Security Advisory for VLC Media Player

VideoLAN has released a security advisory to address multiple vulnerabilities in VLC Media Player. These vulnerabilities may allow an attacker to execute arbitrary code or cause a denial-of-service condition. US-CERT encourages users and administrators to review VideoLAN security advisory...

Cisco Releases Security Advisory for Small Business Video Surveillance Cameras and 4-Port Gigabit Security Routers

Cisco has released a security advisory to address a vulnerability that affects Cisco Small Business Video Surveillance Cameras and Cisco RVS4000 4-Port Gigabit Security Routers. This vulnerability may allow an unprivileged user to gain full administrative access on the device or obtain sensitive...

Sun Java Deployment Toolkit Plugin and ActiveX Control Vulnerability

The Sun Java Development Toolkit plugin and ActiveX control contain a vulnerability. This vulnerability is due to insufficient argument validation. By convincing a user to visit a specially crafted HTML document, an attacker may be able to exploit this vulnerability and execute an arbitrary JAR...

Cisco Releases Multiple Security Advisories

Cisco has released three security advisories to address vulnerabilities. Security advisory cisco-sa-20100303-cucm, addresses multiple vulnerabilities in the Cisco Unified Communications Manager which affect the Session Initiation Protocol SIP, Skinny Client Control Protocol SCCP, and the Computer...

SharePoint Server Cross Site Scripting

Hacktics Research Group Security Advisory http://www.hacktics.com/view=Resources%7CAdvisory By Irene Abezgauz, Hacktics. 22-Feb-2010 =========== I. Overview =========== During a penetration test performed by Hacktics' experts, a persistent cross-site scripting vulnerability was identified in the...

Multiple Vulnerabilities in Cisco IronPort Encryption Appliance

Cisco IronPort Encryption Appliance devices contain two vulnerabilities that allow remote, unauthenticated access to any file on the device and one vulnerability that allows remote, unauthenticated users to execute arbitrary code with elevated privileges. There are workarounds available to mitiga...

Microsoft Releases Security Advisory 980088

Microsoft has released Security Advisory 980088 to alert users of a vulnerability in Microsoft Internet Explorer. The advisory indicates that exploitation of this vulnerability may allow an attacker to harvest user credentials and other sensitive information by enticing users to visit a malicious...

Rockwell Automation Allen-Bradley MicroLogix PLC authentication and authorization vulnerabilities

Overview Rockwell Automation Allen-Bradley MicroLogix programmable logic controllers PLCs do not adequately authenticate or authorize remote connections or commands. An attacker with network access can obtain the management password or issue commands that bypass the authentication mechanism...

Clientless SSL VPNs Break Web Browser Security Models

Clientless SSL VPN products from multiple vendors operate in a way that breaks fundamental browser security mechanisms, according to a warning from the U.S. Computer Emergency Response Team US-CERT. This security problem, discussed since at least 2006, could let an attacker could use these device...

PHP "multipart/form-data" denial of service

Description ------------ PHP version 5.3.1 was just released. This release contains a patch for a denial of service condition we've reported on 27 October 2009. The problem is related with PHP's handling of RFC 1867 Form-based File Upload in HTML. When you send a POST request to a PHP script with...

OS Commerce Bypass / Command Execution

OS Commerce authentication bypass Description: Accessing administration pages should give a login screen to unauthenticated users, however instead, data is displayed, and administrative commands can be executed. Apparently any page in the admin directory can be accessed in this way including file...

Dnsmasq Heap Overflow and Null-pointer Dereference on TFTP Server

1. Advisory Information Title: Dnsmasq Heap Overflow and Null-pointer Dereference on TFTP Server Advisory ID: CORE-2009-0820 Advisory URL:http://www.coresecurity.com/core-labs/advisories/dnsmasq-vulnerabilities Date published: 2009-08-31 Date of last update: 2009-08-31 Vendors contacted: Simon...

Cisco Security Advisory: Active Template Library (ATL) Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Active Template Library ATL Vulnerability Advisory ID: cisco-sa-20090728-activex http://www.cisco.com/warp/public/707/cisco-sa-20090728-activex.shtml Revision 1.0 For Public Release 2009 July 28 1800 UTC GMT -...

Microsoft DirectShow Video Streaming ActiveX IMPEG2TuneRequest Overflow

Added: 07/07/2009 CVE: CVE-2008-0015 BID: 35558 OSVDB: 55651 Background DirectX is a feature of the Windows operating system used for streaming media. Within DirectX, the DirectShow technology performs client-side audio and video sourcing, manipulation and rendering. Problem A stack buffer overfl...