[SECURITY] [DSA 2616-1] nagios3 security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2616-1 [email protected] http://www.debian.org/security/ Jonathan Wiltshire February 03, 2013 http://www.debian.org/security/faq -...

US-CERT Alert TA13-010A - Oracle Java 7 Security Manager Bypass Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Awareness System US-CERT Alert TA13-010A Oracle Java 7 Security Manager Bypass Vulnerability Original release date: January 10, 2013 Last revised: -- Systems Affected Any system using Oracle Java 7 1.7, 1.7.0 including Java Platform...

[SECURITY] [DSA 2579-1] apache2 security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2579-1 [email protected] http://www.debian.org/security/ Stefan Fritsch November 30, 2012 http://www.debian.org/security/faq -...

[USN-1595-1] libxslt vulnerabilities

========================================================================== Ubuntu Security Notice USN-1595-1 October 04, 2012 libxslt vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

ZDI-12-141 : Microsoft .NET Framework Clipboard Unsafe Memory Access Remote Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-141 : Microsoft .NET Framework Clipboard Unsafe Memory Access Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-141 August 17, 2012 - -- CVE ID: CVE-2012-1855 - -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P - --...

ZDI-12-091 : Symantec Web Gateway upload_file Remote Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-091 : Symantec Web Gateway uploadfile Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-091 June 8, 2012 - -- CVE ID: CVE-2012-0299 - -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P - -- Affected Vendors: Symantec ...

GroupWare epesiBIM CRM 1.2.1 - Multiple Web Vulnerabilities

Title: ====== GroupWare epesiBIM CRM 1.2.1 - Multiple Web Vulnerabilities Date: ===== 2012-04-10 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=501 VL-ID: ===== 501 Introduction: ============= epesi BIM stands for Business Information Manager. We just did not like the...

Ilient SysAid v8.5.05 - Multiple Web Vulnerabilities

Title: ====== Ilient SysAid v8.5.05 - Multiple Web Vulnerabilities Date: ===== 2012-03-08 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=470 VL-ID: ===== 470 Introduction: ============= SysAid IT Enterprise Edition is an IT management solution that includes a suite of...

[USN-1364-1] Linux kernel (OMAP4) vulnerabilities

========================================================================== Ubuntu Security Notice USN-1364-1 February 13, 2012 linux-ti-omap4 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its...

Vulnerabilities in Serv-U 11.1.0.3

Luigi Auriemma Application: Serv-U FTP http://www.serv-u.com Versions: = 11.1.0.3 Platforms: Windows, Linux bug B should affect only some Windows versions Bugs: A sockets and ports consumption B possible access to the management console Exploitation: remote Date: 03 Dec 2011 Author: Luigi Auriemm...

European Security Services GPS v1.0 - Multiple Vulnerabilities

Title: ====== European Security Services GPS 1.x - Multiple Vulnerabilities Date: ===== 2011-09-28 VL-ID: ===== 63 Reference: ========== http://www.vulnerability-lab.com/getcontent.php?id=63 Introduction: ============= Fur eine geringe Ortungsgebuhr erhalten Sie einen Zugang zu unserem Online...

[DSECRG-11-032] SAP NetWeaver ipcpricing - information disclose (by ERPScan)

DSECRG-11-032 SAP NetWeaver ipcpricing - information disclose com.sap.ipc.webapp.ipcpricing application has information disclose vulnerability Digital Security Research Group DSecRG Advisory DSECRG-11-032 Internal DSecRG-00197 Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL...

Dexanet Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability Dexanet AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.dexanet.com/ Persian Gulf 4 Ever! Dork : "inurl:competenzeprodotti.asp?id=" Exploite:...

Listendifferent (prodotto.php?IDprodotto) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability Listendifferent prodotto.php?IDprodotto AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.listendifferent.com/ Persian Gulf 4 Ever! Dork : "Concept and Designed by...

[USN-1158-1] curl vulnerabilities

========================================================================== Ubuntu Security Notice USN-1158-1 June 24, 2011 curl vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubunt...

ZDI-11-196: Microsoft Internet Explorer HTTP 302 Redirect Remote Code Execution Vulnerability

ZDI-11-196: Microsoft Internet Explorer HTTP 302 Redirect Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-196 June 14, 2011 -- CVE ID: CVE-2011-1262 -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P -- Affected Vendors: Microsoft -- Affected Products: Microsoft...

VUPEN Security Research - Oracle Java ICC Profile "clrt" Tag Integer Overflow Code Execution Vulnerability

VUPEN Security Research - Oracle Java ICC Profile "clrt" Tag Integer Overflow Code Execution Vulnerability http://www.vupen.com/english/research.php I. BACKGROUND --------------------- "Java is a programming language and computing platform released by Sun Microsystems now Oracle. It is the...

[SECURITY] [DSA 2251-1] subversion security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2251-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst June 02, 2011 http://www.debian.org/security/faq -...

[SECURITY] CVE-2011-1026: Apache Archiva Multiple CSRF vulnerability

CVE-2011-1026: Apache Archiva Multiple CSRF vulnerability Severity: High Vendor: The Apache Software Foundation Versions Affected: Archiva 1.3.0 - 1.3.4 The unsupported versions Archiva 1.0 - 1.2.2 are also affected. Description: An attacker can build a simple html page containing a hidden Image...

NGS00068 Patch Notification: LibAVCodec AMV Out of Array Write

LibAVCodec AMV Out of Array Write 27/04/2011 Dominic Chell of NGS Secure has discovered a high risk vulnerability in LibAVCodec. Opening a malformed AMV file can result in an out of array write and potentially arbitrary code execution when using this library. Whilst the vulnerability may affect...

[PRE-SA-2011-03] Denial-of-service vulnerability in EFI partition handling code of the Linux kernel

PRE-CERT Security Advisory ========================== Advisory: PRE-SA-2011-03 Released on: 13 Apr 2011 Last updated on: 13 Apr 2011 Affected product: Linux Kernel 2.4 and 2.6 Impact: denial-of-service Origin: storage devices Credit: Timo Warns PRESENSE Technologies GmbH CVE Identifier:...

phplist: cross site request forgery (CSRF), CVE-2011-0748

phplist: cross site request forgery CSRF, CVE-2011-0748 References https://vulners.com/cve/CVE-2011-2748 http://int21.de/cve/CVE-2011-0748-phplist.html Description phplist is a mailing list software written in PHP. Up to version 2.10.12, it provided no protection against cross site request forger...

ZDI-11-106: Novell Netware NWFTPD.NLM DELE Remote Code Execution Vulnerability

ZDI-11-106: Novell Netware NWFTPD.NLM DELE Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-106 March 18, 2011 -- CVE ID: CVE-2010-4228 -- CVSS: 9, AV:N/AC:L/Au:S/C:C/I:C/A:C -- Affected Vendors: Novell -- Affected Products: Novell Netware -- TippingPointTM I...

[security bulletin] HPSBST02630 SSRT1000385 rev.1 - HP StorageWorks X9000 Network Storage Systems, Remote Unauthenticated Access

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c02712670 Version: 1 HPSBST02630 SSRT1000385 rev.1 - HP StorageWorks X9000 Network Storage Systems, Remote Unauthenticated Access NOTICE: The information in this Security Bulletin should be acted...

HTB22810: SQL Injection in ReOS

Vulnerability ID: HTB22810 Reference: http://www.htbridge.ch/advisory/sqlinjectioninreos3.html Product: ReOS Vendor: IT ELAZOS S.L. http://reos.elazos.com/ Vulnerable Version: 2.0.5 Vendor Notification: 20 January 2011 Vulnerability Type: SQL Injection Risk level: High Credit: High-Tech Bridge SA...

[security bulletin] HPSBMA02626 SSRT100301 rev.1 - HP OpenView Storage Data Protector, Remote Denial of Service (DoS)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c02699143 Version: 1 HPSBMA02626 SSRT100301 rev.1 - HP OpenView Storage Data Protector, Remote Denial of Service DoS NOTICE: The information in this Security Bulletin should be acted upon as soon ...

GNU libc/regcomp(3) Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 GNU libc/regcomp3 Multiple Vulnerabilities Author: Maksymilian Arciemowicz http://securityreason.com/ http://cxib.net/ Date: - - Dis.: 01.10.2010 - - Pub.: 07.01.2011 CERT: VU912279 CVE: CVE-2010-4051 CVE-2010-4052 Affected tested: - - Ubuntu 10.10 - ...

XSS vulnerability in Frog CMS

Vulnerability ID: HTB22682 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinfrogcms.html Product: Frog CMS Vendor: Philippe Archambault http://www.madebyfrog.com/ Vulnerable Version: 0.9.5 and probably prior versions Vendor Notification: 09 November 2010 Vulnerability Type: Stored XSS...

Mozilla Foundation Security Advisory 2010-70

Mozilla Foundation Security Advisory 2010-70 Title: SSL wildcard certificate matching IP addresses Impact: Moderate Announced: October 19, 2010 Reporter: Richard Moore Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 3.6.11 Firefox 3.5.14 Thunderbird 3.1.5 Thunderbird 3.0.9 SeaMonkey...

Security problems in Zenphoto version 1.3

We are continuing with the list of security vulnerabilities found in a number of web applications while testing our latest version of Acunetix WVS v7 . In this blog post, we will look into the details of a number of security problems discovered by Acunetix WVS in the popular web gallery applicati...

Mozilla Foundation Security Advisory 2010-58

Mozilla Foundation Security Advisory 2010-58 Title: Crash on Mac using fuzzed font in data: URL Impact: Critical Announced: September 7, 2010 Reporter: Marc Schoenefeld Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 3.6.9 Firefox 3.5.12 Thunderbird 3.1.3 Thunderbird 3.0.7 SeaMonkey...

SQL injection vulnerability in TCMS

Vulnerability ID: HTB22577 Reference: http://www.htbridge.ch/advisory/sqlinjectionvulnerabilityintcms3.html Product: TCMS Vendor: Target CMS http://targetcms.com/ Vulnerable Version: 100728 and Probably Prior Versions Vendor Notification: 09 August 2010 Vulnerability Type: SQL Injection Status: N...

Pligg Installation File XSS Vulnerability

Title: Pligg Installation File XSS Vulnerability Vendor: Pligg Product: Pligg CMS Tested Version: 1.0.4 Threat Class: XSS Severity: Medium Remote: yes Local: no Discovered By: Andrei Rimsa Alvares ===== Description ===== Pligg is prone to a XSS vulnerability in the installation file:...

VUPEN Security Research - Apple Safari WebKit HTML Button Use-after-free Vulnerability (CVE-2010-1392)

About the security content of Safari 5.0 and Safari 4.1 Last Modified: June 07, 2010 Article: HT4196 Email this article Print this page Summary This document describes the security content of Safari 5.0 and Safari 4.1. For the protection of our customers, Apple does not disclose, discuss, or...

[security bulletin] HPSBMA02525 SSRT100083 rev.1 - HP System Insight Manager Running on HP-UX, Linux, and Windows , Remote Cross Site Scripting (XSS), Cross Site Request Forgery (CSRF), Privilege Elevation

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c02027185 Version: 1 HPSBMA02525 SSRT100083 rev.1 - HP System Insight Manager Running on HP-UX, Linux, and Windows , Remote Cross Site Scripting XSS, Cross Site Request Forgery CSRF, Privilege...

[SECURITY] CVE-2009-2902 Apache Tomcat unexpected file deletion in work directory

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2009-3548: Apache Tomcat unexpected file deletion and/or alteration Severity: Low Vendor: The Apache Software Foundation Versions Affected: Tomcat 5.5.0 to 5.5.28 Tomcat 6.0.0 to 6.0.20 The unsupported Tomcat 3.x, 4.x and 5.0.x versions may be als...

HP Operations Manager backdoor account

There is a hidden undocumented Tomcat account...

Microsoft Security Bulletin MS09-061 - Critical Vulnerabilities in the Microsoft .NET Common Language Runtime Could Allow Remote Code Execution (974378)

Microsoft Security Bulletin MS09-061 - Critical Vulnerabilities in the Microsoft .NET Common Language Runtime Could Allow Remote Code Execution 974378 Published: October 13, 2009 Version: 1.0 General Information Executive Summary This security update resolves three privately reported...

Subrion CMS Multiple Vulnerabilities

---------------------------------------------------------------------- PT-2009-16 Positive Technologies Security Advisory Subrion CMS Multiple Vulnerabilities ---------------------------------------------------------------------- --- Affected Software Subrion CMS Versions prior to 1.1.x Product...

[Advisory]PBBoard <=2.0.2 Full Path Disclosure

AdvisoryPBBoard =2.0.2 - Full Path Disclosure Details ======= Product: PHP = PBBoard Security-Risk: moderated Remote-Exploit: yes Vendor-URL: http://www.pbboard.com Credits ============ Discovered by: rUnViRuS site: http://www.sec-area.com Affected Products: ---------------------------- test on...

[ MDVSA-2009:248 ] php

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2009:248 http://www.mandriva.com/security/ Package : php Date : September 25, 2009 Affected: 2009.1 Problem Description: Multiple vulnerabilities was discovered and corrected in php: The...

cURL / libcurl SSL certificate spoofing

Certificate name spoofing via NULL byte...

ASMAX AR 804 gu Web Management Console Arbitrary Shell Command Injection Vulnerability

ASMAX 804 gu router is a SOHO class device. It provides ADSL / WiFi / Ethernet interfaces. 2. There is an unauthenticated maintenance script named 'script' in /cgi-bin/ directory of the web management interface. 3. When 'system' paramether is passed to the script it allows running OS shell...

OpenBSD pf DoS

Null pointer dereferenceon malformed IPv4 packet with ICMPv6 data...

Microsoft Security Bulletin MS09-015 – Moderate Blended Threat Vulnerability in SearchPath Could Allow Elevation of Privilege (959426)

Microsoft Security Bulletin MS09-015 – Moderate Blended Threat Vulnerability in SearchPath Could Allow Elevation of Privilege 959426 Published: April 14, 2009 Version: 1.0 General Information Executive Summary This security update resolves a publicly disclosed vulnerability in the Windows...

AdaptBB 1.0 Beta Multiple Remote Vulnerabilities

Salvatore "drosophila" Fresta + Application: AdaptBB + Version: 1.0 Beta + Website: http://sourceforge.net/projects/adaptbb/ + Bugs: A Multiple Blind SQL Injection B Multiple Dynamic Code Execution C Arbitrary File Upload + Exploitation: Remote + Date: 09 Apr 2009 + Discovered by: Salvatore...

[USN-748-1] OpenJDK vulnerabilities

=========================================================== Ubuntu Security Notice USN-748-1 March 26, 2009 openjdk-6 vulnerabilities CVE-2006-2426, CVE-2009-1093, CVE-2009-1094, CVE-2009-1095, CVE-2009-1096, CVE-2009-1097, CVE-2009-1098, CVE-2009-1100, CVE-2009-1101, CVE-2009-1102...

Cisco Security Advisory: Cisco Unified Communications Manager IP Phone Personal Address Book Synchronizer Privilege Escalation Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco Unified Communications Manager IP Phone Personal Address Book Synchronizer Privilege Escalation Vulnerability Advisory ID: cisco-sa-20090311-cucmpab Revision 1.0 For Public Release 2009 March 11 1600 UTC GMT...

Microsoft Security Bulletin MS09-008 – Important Vulnerabilities in DNS and WINS Server Could Allow Spoofing (962238)

Microsoft Security Bulletin MS09-008 – Important Vulnerabilities in DNS and WINS Server Could Allow Spoofing 962238 Published: March 10, 2009 Version: 1.0 General Information Executive Summary This security update resolves two privately reported vulnerabilities and two publicly disclosed...

DMXReady Blog Manager (SQL/XSS)

--------------------------------------------------------- Portal Name: DMXReady Blog Manager SQL/XSS Vendor : http://www.galaxyscripts.com Author : PouyaServer , [email protected] Aria-Security.Net Vulnerability : SQL/XSS --------------------------------------------------------- SQL:...