MITKRB5-SA-2015-001 Vulnerabilities in kadmind, libgssrpc, gss_process_context_token

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 MITKRB5-SA-2015-001 MIT krb5 Security Advisory 2015-001 Original release: 2015-02-03 Last update: 2015-02-03 Topic: Vulnerabilities in kadmind, libgssrpc, gssprocesscontexttoken VU540092 CVE-2014-5352: gssprocesscontexttoken incorrectly frees context...

Multiple vulnerabilities in MantisBT

Advisory ID: HTB23243 Product: MantisBT Vendor: MantisBT Team Vulnerable Versions: 1.2.17 and probably prior Tested Version: 1.2.17 Advisory Publication: December 3, 2014 without technical details Vendor Notification: December 3, 2014 Vendor Patch: January 25, 2015 Public Disclosure: January 28,...

[The ManageOwnage Series, part VI]: 0day database info and superuser credential disclosure in EventLog Analyser

Hi, This is the 6th part of the ManageOwnage series. For previous parts see 1. This time we have two 0 day vulns CVE-2014-6038 and 6039 that can be abused to dump information from the database and obtain the superuser credentials for Windows and AS/400 hosts which are managed by EventLog Analyzer...

SAP Security Note 1908531 - XXE in BusinessObjects Explorer

COMPASS SECURITY ADVISORY http://www.csnc.ch/en/downloads/advisories.html Product: BusinessObjects Explorer Vendor: SAP AG Subject: Untrusted XML input parsing possible in SBOP Explorer Risk: High Effect: Remotely exploitable Author: Stefan Horlacher Date: 2014-10-10 SAP Security Note: 1908531 0...

LSE Leading Security Experts GmbH - LSE-2014-06-10 - Perl CORE - Deep Recursion Stack Overflow

=== LSE Leading Security Experts GmbH - Security Advisory LSE-2014-06-10 === Perl CORE - Deep Recursion Stack Overflow ----------------------------------------- Affected Versions ================= Perl v5.20.1 and below Issue Overview ============== Vulnerability Type: Stack Overflow Technical...

[security bulletin] HPSBMU03075 rev.1 - HP Network Node Manager I (NNMi) for Windows and Linux, Remote Execution of Arbitrary Code

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04378450 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04378450 Version: 1 HPSBMU03075 rev....

HP Operations Agent privilege escalation

Privilege escalation via Glance...

[ MDVSA-2014:087 ] php

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:087 http://www.mandriva.com/en/support/security/ Package : php Date : May 15, 2014 Affected: Business Server 1.0 Problem Description: A vulnerability has been discovered and corrected in php: PHP FPM in PHP...

Deutsche Telekom CERT Advisory [DTC-A-20140324-004] nagios vulnerability

Deutsche Telekom CERT Advisory DTC-A-20140324-004 Summary: An Off-by-one memory access was found in the web gui of nagios. A patch was applied to the core master branch of nagios http://sourceforge.net/p/nagios/nagioscore/ci/d97e03f32741a7d851826b03ed73ff4c9612a866/. This resolution is announced ...

CVE-2014-1214 - Remote Code Execution in Projoom NovaSFH Plugin

Vulnerability title: Remote Code Execution in Projoom NovaSFH Plugin CVE: CVE-2014-1214 Vendor: Projoom Product: NovaSFH Plugin Version: 3.0.3 Reported by: Yuri Kramarz Details: The PHP executable which is responsible for handling file upload functionality allows arbitrary files to be uploaded to...

AlienVault OSSIM SQL Injection vulnerability

INDEX --------------------------------------- 1. Background 2. Description 3. Affected Products 4. Vulnerability 5. Solution 6. Credit 7. Disclosure Timeline 1. BACKGROUND --------------------------------------- OSSIM by AlienVault is an Open Source Security Information and Event Management SIEM...

[SECURITY] [DSA 2811-1] chromium-browser security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2811-1 [email protected] http://www.debian.org/security/ Michael Gilbert December 07, 2013 http://www.debian.org/security/faq -...

OWASP ESAPI Security Advisory: MAC Bypass in ESAPI Symmetric Encryption

OWASP ESAPI for Java Security Advisory 1 The OWASP Foundation MAC Bypass in ESAPI Symmetric Encryption Summary ======= Category: Symmetric cryptography Module: ESAPI Encryptor interface Announced: 2013-08-23 via ESAPI-Dev mailing list...

perl-Proc-ProcessTable symbolic links vulnerabilities

Symbolic links vulnerabilities on /tmp/TTYDEVS processing...

[ MDVSA-2013:193 ] apache

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:193 http://www.mandriva.com/en/support/security/ Package : apache Date : July 11, 2013 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: A vulnerability has been found and corrected i...

[USN-1849-1] Linux kernel (Raring HWE) vulnerability

========================================================================== Ubuntu Security Notice USN-1849-1 May 31, 2013 linux-lts-raring vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

EMC Smarts security vulnerabilities

Crossite scripting in different applications, Smarts Network Configuration Manager authentication bypass...

Multiple XSS vulnerabilities in Events Manager WordPress plugin

Advisory ID: HTB23139 Product: Events Manager WordPress plugin Vendor: Marcus Sykes Vulnerable Versions: 5.3.3 and probably prior Tested Version: 5.3.3 Vendor Notification: January 16, 2013 Vendor Patch: January 17, 2013 Public Disclosure: March 6, 2013 Vulnerability Type: Cross-Site Scripting...

Multiple SQL injection vulnerabilities in Cardoza Wordpress poll plugin

Exploit Title : Multiple SQL injection vulnerabilities in Cardoza Wordpress poll plugin Author:Marcela Benetrix home:www.girlinthemiddle.net Date: 01/21/13 version: 34.05 software link:http://wordpress.org/extend/plugins/cardoza-wordpress-poll/ Wordpress Poll plugin description Wordpress Poll is...

CVE-2012-6452 Axway Secure Messenger Username Disclosure

Product: Axway Email Firewall Component: Secure Messenger Vendor: Axway Vulnerable Versions: 6.5 and earlier on the Email Firewall EMF platform only Tested Version: 6.3.2 Build 4230 Vendor Notification: December 8, 2012 Vendor Patch: Secure Messenger version 6.5.0 Updated Release 7 Public...

TomatoCart 1.x | Cross Site Request Forgery Protection Bypass via JavaScript Hijacking

OVERVIEW TomatoCart 1.x versions are vulnerable to Cross Site Request Forgery Protection Bypass. 2. BACKGROUND TomatoCart is an innovative Open Source shopping cart solution developed by Wuxi Elootec Technology Co., Ltd. It is forked from osCommerce 3 as a separate project and is released under...

VMSA-2012-0018 VMware security updates for vCSA and ESXi

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 VMware Security Advisory Advisory ID: VMSA-2012-0018 Synopsis: VMware security updates for vCSA and ESXi Issue date: 2012-12-20 Updated on: 2012-12-20 initial advisory CVE numbers: ------------- vCSA --------------- CVE-2012-6324, CVE-2012-6325...

NGS000241 Technical Advisory: SysAid Helpdesk Pro Blind SQL Injection

======= Summary ======= Name: SysAid Helpdesk Pro - Blind SQL Injection Release Date: 30 November 2012 Reference: NGS00241 Discoverer: Daniel Compton [email protected] Vendor: SysAid Vendor Reference: Systems Affected: SysAid Helpdesk 8.5 Pro Risk: High Status: Published ========...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Apple WebKit (iTunes, iPhone, Safari, Google Chrome) multiple security vulnerabilities

70 of different memory corruption vulnerabilities, crossite scripting, information leakage...

[SECURITY] CVE-2012-2138 Apache Sling denial of service vulnerability

CVE-2012-2138 : Apache Sling denial of service vulnerability Severity: Important Vendor: The Apache Software Foundation Versions Affected: org.apache.sling.servlets.post bundle up to 2.1.0 Description: The @CopyFrom operation of the Sling POST servlet allows for copying a parent node to one of it...

7sepehr SQL Injection Vulnerability

Exploit Title : 7sepehr SQL Injection Vulnerability Author : Iranian security & Research Lab Discovered By : Ehram.shahmohamadi Home : sec-lab.ir Contact : research at sec-lab dot ir Portal Link : www.7sepehr.Com Security Risk : High DorK : "Powered by 7sepehr.com"...

[SECURITY] [DSA 2466-1] rails security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2466-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst May 09, 2012 http://www.debian.org/security/faq -...

VMWare applications multiple security vulnerabilities

Privilege escalation, cross application scripting, information leakage, crossite scripting...

Case YVS Image Gallery

http://osvdb.org/show/osvdb/79477 The software "YVS Image Gallery" seems to be full of security issues. For example one can have lots of fun with this. Copy from installation.php: """ caseisset$POST'dbname': $host = $POST'host'; $dbname = $POST'dbname'; $dbusername = $POST'dbusername'; $dbpasswor...

Microsoft Windows multiple security vulnerabilities

Kernel drivers privileges escalation, DirectWrite API DoS, RDP memory corruption and DoS...

Mozilla Foundation Security Advisory 2012-06

Mozilla Foundation Security Advisory 2012-06 Title: Uninitialized memory appended when encoding icon images may cause information disclosure Impact: High Announced: January 31, 2012 Reporter: Tim Abraldes Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 10.0 Thunderbird 10.0 SeaMonkey...

Apache mod_proxy unauthorized internal network access

Invalid processing for URI with preceeding @ sign...

[security bulletin] HPSBPI02733 SSRT100646 rev.1 - Certain HP LaserJet Printers, Remote Unauthorized Access to Files

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03140700 Version: 1 HPSBPI02733 SSRT100646 rev.1 - Certain HP LaserJet Printers, Remote Unauthorized Access to Files NOTICE: The information in this Security Bulletin should be acted upon as soon...

Oxide M0N0X1D3 HTTP Server Directory Traversal Vulnerability

Title : Oxide M0N0X1D3 HTTP Server Directory Traversal Vulnerability Software : Oxide M0N0X1D3 HTTP Server Software Version : 20040223 Vendor: http://sourceforge.net/projects/oxide-ws/ Vulnerability Published : 2011-11-15 Vulnerability Update Time : Status : Impact : Medium Bug Description : Oxid...

webyuss (prodotto.php?id) (quadri.php?id) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability webyuss prodotto.php?id quadri.php?id AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.webyuss.com/ Persian Gulf 4 Ever! Dork : "Powered by webyuss" "inurl:prodotto.php?id...

XSS vulnerability in TWiki < 5.0.2

Information ----------------------------------- Name : XSS vulnerability in TWiki Software : TWiki 5.0.1 and possibily below. Vendor Hompeage : http://twiki.org/ Vulnerability Type : Cross-Site Scripting Severity : High Researcher : Mesut Timur mesut at mavitunasecurity dot com Advisory Reference...

Proofpoint Protection Server Cross-Site Scripting Vulnerability - SOS-11-005

Sense of Security - Security Advisory - SOS-11-005 Release Date. 03-May-2011 Last Update. - Vendor Notification Date. 28-Apr-2011 Product. Proofpoint Protection Server Platform. Appliance Affected versions. 5.5.5 verified, and possibly others Severity Rating. Medium Impact. Cookie/credential thef...

VUPEN Security Research - Apple Safari Text Nodes Remote Use-after-free Vulnerability (CVE-2011-1344)

VUPEN Security Research - Apple Safari Text Nodes Remote Use-after-free Vulnerability CVE-2011-1344 http://www.vupen.com/english/research.php I. BACKGROUND --------------------- "Apple Safari is a web browser developed by Apple. As of February 2010, Safari was the fourth most widely used browser,...

HTB22853: XSS vulnerability in Pragyan CMS

Vulnerability ID: HTB22853 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinpragyancms.html Product: Pragyan CMS Vendor: Pragyan Team http://sourceforge.net/projects/pragyan/ Vulnerable Version: v.3.0 beta Vendor Notification: 17 February 2011 Vulnerability Type: Stored XSS Cross Site...

[DSECRG-11-008] Open Edge RDBMS - Multiple architecture vulnerabilities (UNPATCHED)

Digital Security Research Group DSecRG Advisory DSECRG-11-008 Application: Progress OpenEdge Enterprise RDBMS Versions Affected: 10.2A and maybe others Vendor URL: http://web.progress.com Bug: Authentication bypass, UserID enumerate Exploits: YES Reported: 13.10.2009 Vendor response: 13.10.2009...

MITKRB5-SA-2010-007 Multiple checksum handling vulnerabilities [CVE-2010-1324 CVE-2010-1323 CVE-2010-4020 CVE-2010-4021]

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 MITKRB5-SA-2010-007 MIT krb5 Security Advisory 2010-007 Original release: 2010-11-30 Last update: 2010-11-30 Topic: Multiple checksum handling vulnerabilities CVE-2010-1324 krb5 GSS-API applications may accept unkeyed checksums krb5 application servic...

R7-0037: SAP BusinessObjects Axis2 Default Admin Password

R7-0037: SAP BusinessObjects Axis2 Default Admin Password October 13th, 2010 Description: The SAP BusinessObjects product contains a module dswsbobje.war which deploys Axis2 with an administrator account which is configured with a static password. As a result, anyone with access to the Axis2 port...

Microsoft Security Bulletin MS10-057 - Important Vulnerability in Microsoft Office Excel Could Allow Remote Code Execution (2269707)

Microsoft Security Bulletin MS10-057 - Important Vulnerability in Microsoft Office Excel Could Allow Remote Code Execution 2269707 Published: August 10, 2010 Version: 1.0 General Information Executive Summary This security update resolves a privately reported vulnerability in Microsoft Office. Th...

ZDI-10-134: Mozilla Firefox DOM Attribute Cloning Remote Code Execution Vulnerability

ZDI-10-134: Mozilla Firefox DOM Attribute Cloning Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-134 July 20, 2010 -- CVE ID: CVE-2010-1208 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: Mozilla Firefox -- Affected Products: Mozilla Firefox...

XSS vulnerability in Spitfire

Vulnerability ID: HTB22486 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinspitfire3.html Product: Spitfire Vendor: Claus Muus http://spitfire.clausmuus.de/ Vulnerable Version: 1.0.336 and Probably Prior Versions Vendor Notification: 08 July 2010 Vulnerability Type: XSS Cross Site...

Microsoft Security Bulletin MS10-036 - Important Vulnerability in COM Validation in Microsoft Office Could Allow Remote Code Execution (983235)

Microsoft Security Bulletin MS10-036 - Important Vulnerability in COM Validation in Microsoft Office Could Allow Remote Code Execution 983235 Published: June 08, 2010 Version: 1.0 General Information Executive Summary This security update resolves a privately reported vulnerability in COM...

ZDI-10-033: Microsoft Internet Explorer TIME2 Behavior Remote Code Execution Vulnerability

ZDI-10-033: Microsoft Internet Explorer TIME2 Behavior Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-033 April 2, 2010 -- CVE ID: CVE-2010-0492 -- Affected Vendors: Microsoft -- Affected Products: Microsoft Internet Explorer -- TippingPointTM IPS Customer...

[Full-disclosure] Windows SMB NTLM Authentication Weak Nonce Vulnerability

to get the scripts mentioned by this advisory please get the full version at http://www.hexale.org/advisories/OCHOA-2010-0209.txt; I did not include them here to reduce the size of this email Windows SMB NTLM Authentication Weak Nonce Vulnerability Security Advisory Hernan Ochoa [email protected] ...