47153 matches found
phpsecurepages (cfgProgDir) Remote File Include Vulnerability
============================================================================================== phpsecurepages cfgProgDir Remote File Include Vulnerability =============================================================================================== Critical Level : Dangerous Download from :...
[SA22122] PhotoStore Cross-Site Scripting Vulnerabilities
TITLE: PhotoStore Cross-Site Scripting Vulnerabilities SECUNIA ADVISORY ID: SA22122 VERIFY ADVISORY: http://secunia.com/advisories/22122/ CRITICAL: Less critical IMPACT: Cross Site Scripting WHERE: From remote SOFTWARE: PhotoStore 2.x http://secunia.com/product/12118/ DESCRIPTION: meto5757 has...
ACGV News <= v0.9.1 (PathNews) Remote File Inclusion Exploit
============================================================================================== ACGV News = v0.9.1 PathNews Remote File Inclusion Exploit =============================================================================================== Critical Level : Dangerous Venedor site :...
Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
MyGallery "Room.php" SQL Injection
=========================================== Discovered By: C.B.B.L CrAzY CrAcKeR ,Breeeeh ,BoNy-m ,LiNuXrOOt =========================================== Example:- /MyGallery/Room.php?id=SQL Injection ===========================================...
Open Exchange default account
mailadmin/secret LDAP account is created during installation with /bin/bash login shell...
[TZO-062006] Safe'nVulnerable
Safe'nSec - Insecure File execution and Auto-startup Ref : TZO-062006-SafenSec Author : Thierry Zoller WWW : http://secdev.zoller.lu Article : http://secdev.zoller.lu/research/safensec.htm I. Background "Safe'n'Sec is complex data and user applications protection against threats and vulnerabiliti...
[Full-disclosure] Advisory 01/2005: Fileupload/download vulnerability in Trac
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Happy Python Hackers Project www.hardened-php.net -= Security Advisory =- Advisory: Fileupload/download vulnerability in Trac Release Date: 2005/06/20 Last Modified: 2005/06/20 Author: Stefan Esser [email protected] Application: Trac = 0.8.3...
[VulnWatch] CORE-2004-0819: MSN Messenger PNG Image Parsing Vulnerability
Core Security Technologies Advisory http://www.coresecurity.com MSN Messenger PNG Image Parsing Vulnerability Date Published: 2005-02-08 Last Update: 2005-02-08 Advisory ID: CORE-2004-0819 Bugtraq ID: None currently assigned. CVE Name: CAN-2004-0597 Title: MSN Messenger PNG Image Parsing...
[SA13074] FsPHPGallery Denial of Service and Disclosure of System Information Vulnerabilities
---------------------------------------------------------------------- Monitor, Filter, and Manage Security Information - Filtering and Management of Secunia advisories - Overview, documentation, and detailed reports - Alerting via email and SMS Request Trial: https://ca.secunia.com/?f=l...
[waraxe-2004-SA#012 - Multiple vulnerabilities in XMB Forum 1.8 SP3 and 1.9 beta]
================================================================================ waraxe-2004-SA012 ================================================================================ Multiple vulnerabilities in XMB 1.8 Partagium SP3 and 1.9 Nexus Beta...
Security Advisory: Cisco VPN 5000 Series Concentrator RADIUS PAP Authentication Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco VPN 5000 Series Concentrator RADIUS PAP Authentication Vulnerability Revision 1.0 For Public Release 2002 August 07 UTC 1500 Contents Summary Affected Products Details Impact Software Versions and Fixes Obtaining Fixed...
An Analysis of the RADIUS Authentication Protocol
An Analysis of the RADIUS Authentication Protocol by Joshua Hill, InfoGard Laboratories www.infogard.com Last Modified Mon Nov 12 16:12:53 PST 2001 A current HTML version of this paper can be found at: http://www.untruth.org/josh/security/radius Please send comments to [email protected] 1...
CGI - nph-maillist.pl vulnerability...
Hello BuGReaders... Script: nph-maillist.plcgi Introduction: cat from source .................................................................... Created by: Matt Tourtillott URL: www.marketrends.net email [email protected] The email list generator is a web interfaced script that allows the...
Option to VERITAS Cluster Server (VCS) lltstat command will panic system.
I had a hell of a time getting through to Veritas, but after I did they reacted VERY quickly. I apologize that I didn't get this info out to the general community sooner, but Veritas didn't tell me that they released the fix. In the name of full disclosure: synopsis: "When using VERITAS Cluster...
Security Bulletin (MS00-067)
Microsoft Security Bulletin MS00-067 - --------------------------------------- Patch Available for "Windows 2000 Telnet Client NTLM Authentication" Vulnerability Originally posted: September 14, 2000 Summary ======= Microsoft has released a patch that eliminates a security vulnerability in the...
Win2k Telnet.exe malicious server vulnerability
Microsoft was informed of this problem with exploit over a month ago. I received some token responses right after emailing them, but have heard nothing since. If they have released an advisory of their own yet, I have not seen it. I informed them up-front that I would release a full-disclosure...
Security Bulletin (MS00-060)
Microsoft Security Bulletin MS00-060 - -------------------------------------- Patch Available for "IIS Cross-Site Scripting" Vulnerabilities Originally posted: August 25, 2000 Summary ======= Microsoft has released a patch that eliminates security vulnerabilities in Microsoftr Internet Informatio...
Security Bulletin (MS00-041)
Microsoft Security Bulletin MS00-041 - -------------------------------------- Patch Available for "DTS Password" Vulnerability Originally posted: June 14, 2000 Summary ======= Microsoft has released a patch that eliminates a security vulnerability in a component that ships with Microsoftr SQL...
IE Domain Confusion Vulnerability
IE can be fooled into thinking a web page is in any domain by encoding some characters in the URL and placing the domain you want to spoof at the end of the URL. For example the URL http://www.peacefire.org2fsecurity2fiecookies2fshowcookie.html3F.amazon.com is in the pecefire.org domain but becau...
Security Advisory: Cisco IOS Software TELNET Option Handling Vulnerability
Cisco IOS Software TELNET Option Handling Vulnerability Revision 1.0 For public release Thursday 2000/04/20 at 09:00 AM US/Eastern UTC-0400. --------------------------------------------------------------------------- Summary ======= A defect in multiple Cisco IOS software versions will cause a...
TestLink Security Advisory - Multiple XSS Vulnerabilities - CVE-2015-7391
Information -------------------- Advisory by Netsparker. Name: Multiple XSS Vulnerabilities in TestLink 1.9.13 Affected Software : TestLink Affected Versions: 1.9.1.3 and possibly below Vendor Homepage : http://testlink.org/ Vulnerability Type : Cross-site Scripting Severity : Important Status :...
Re: CVE-2015-5204: HTTP header injection vulnerability in Apache Cordova File Transfer Plugin for Android
CVE-2015-5204: HTTP header injection vulnerability in Apache Cordova File Transfer Plugin for Android Severity: Medium Vendor: The Apache Software Foundation Versions Affected: Cordova Android File Transfer Plugin 1.2.1 and below Description: Android applications built with the Cordova framework...
Multiple Vulnerabilities found in ZHONE
Vantage Point Security Advisory 2015-002 ======================================== Title: Multiple Vulnerabilities found in ZHONE Vendor: Zhone Vendor URL: http://www.zhone.com Device Model: ZHONE ZNID GPON 2426A 24xx, 24xxA, 42xx, 42xxA, 26xx, and 28xx series models Versions affected: S3.0.501...
[USN-2772-1] PostgreSQL vulnerabilities
========================================================================== Ubuntu Security Notice USN-2772-1 October 16, 2015 postgresql-9.1, postgresql-9.3, postgresql-9.4 vulnerabilities ========================================================================== A security issue affects these...
Mozilla Firefox / Thunderbird / Seamonkey / Firefox OS multiple security vulnerabilities
Restrictions bypass, memory corruptions...
[USN-2720-1] Django vulnerability
========================================================================== Ubuntu Security Notice USN-2720-1 August 18, 2015 python-django vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives...
APPLE-SA-2015-05-19-1 Watch OS 1.0.1
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2015-05-19-1 Watch OS 1.0.1 Watch OS 1.0.1 is now available and addresses the following: Certificate Trust Policy Available for: Apple Watch Sport, Apple Watch, and Apple Watch Edition Impact: Update to the certificate trust policy Descriptio...
[SECURITY] [DSA 3270-1] postgresql-9.4 security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3270-1 [email protected] http://www.debian.org/security/ Christoph Berg May 22, 2015 http://www.debian.org/security/faq -...
Pligg CMS 2.0.2 - Stored XSS
Hi Team, Affected Vendor: http://pligg.com/ Date: 23/04/2015 Discovered by: Joel Vadodil Varghese Type of vulnerability: Persistent XSS Tested on: Windows 8.1 Product: Pligg CMS Version: 2.0.2 Tested Link: http://localhost/pligg/admin/adminpage.php Description: Pligg CMS is a content management...
Instant v2.0 SQL Injection Vulnerability
========================================================================================== Instant v2.0 SQL Injection Vulnerability ==========================================================================================...
OpenSSL multiple security vulnerabilities
NULL pointer dereferences, reahable asserts, memory corruptions...
ESA-2015-014: RSA® Digital Certificate Solution Multiple Vulnerabilities
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2015-014: RSA® Digital Certificate Solution Multiple Vulnerabilities EMC Identifier: ESA-2015-014 CVE Identifier: See below for individual CVEs Severity Rating: CVSS v2 Base Score: View details below for individual CVSS Score for each CVE. Affecte...
Multiple vulnerabilities in MantisBT
Advisory ID: HTB23243 Product: MantisBT Vendor: MantisBT Team Vulnerable Versions: 1.2.17 and probably prior Tested Version: 1.2.17 Advisory Publication: December 3, 2014 without technical details Vendor Notification: December 3, 2014 Vendor Patch: January 25, 2015 Public Disclosure: January 28,...
SEC Consult SA-20150113-1 :: Privilege Escalation & XSS & Missing Authentication in Ansible Tower
SEC Consult Vulnerability Lab Security Advisory 20150113-1 ======================================================================= title: Privilege Escalation & XSS & Missing Authentication product: Ansible Tower vulnerable version: =2.0.2 fixed version: =2.0.5 impact: high homepage:...
PHPLIST v3.0.6 & v3.0.10 - SQL Injection Vulnerability
Document Title: =============== PHPLIST v3.0.6 & v3.0.10 - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1358 Release Date: ============= 2014-12-18 Vulnerability Laboratory ID VL-ID: ==================================== 135...
CVE-2014-5392 XML eXternal Entity (XXE) in "JobScheduler"
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2014-5392 =================== "XML eXternal Entity XXE" CWE-611 vulnerability in "JobScheduler" product Vendor =================== Software- & Organisations-Service GmbH Product =================== "JobScheduler is a workload automation tool. It i...
SAP Security Note 1908531 - XXE in BusinessObjects Explorer
COMPASS SECURITY ADVISORY http://www.csnc.ch/en/downloads/advisories.html Product: BusinessObjects Explorer Vendor: SAP AG Subject: Untrusted XML input parsing possible in SBOP Explorer Risk: High Effect: Remotely exploitable Author: Stefan Horlacher Date: 2014-10-10 SAP Security Note: 1908531 0...
[USN-2289-1] Linux kernel vulnerabilities
========================================================================== Ubuntu Security Notice USN-2289-1 July 17, 2014 linux vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubun...
file / PHP multiple security vulnerabilities
Memroy corruptions, DoS, information leakage...
PHP security vulnerabilities
Symbolic links vulnerabilities, dnsgetrecord buffer overflow...
CS and XSS vulnerabilities in DZS Video Gallery for WordPress
Hello 3APA3A! There are Content Spoofing and Cross-Site Scripting vulnerabilities in plugin DZS Video Gallery for WordPress. After I announced multiple vulnerabilities in DZS Video Gallery at 08.05.2014 and informed developers, they ignored it, so the second advisory is going directly to full...
Apache Struts multiple security vulnerabilities
Few ClassLoader manipulation vulnerabilities with potential RCE impact...
CVE-2014-1216 - Remote Command Execution in Fitnesse Wiki
Vulnerability title: Remote Command Execution in Fitnesse Wiki CVE: CVE-2014-1216 Vendor: Fitnesse Product: Wiki Affected version: v20131110 and earlier Fixed version: N/A Reported by: Jerzy Kramarz Details: The Fitnesse wiki does not validate the syntax of edited pages to validate whether the...
[security bulletin] HPSBPI03014 rev.1 - HP LaserJet Pro MFP Printers, HP Color LaserJet Pro MFP Printers, Remote Disclosure of Information
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04262495 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04262495 Version: 1 HPSBPI03014 rev....
[SECURITY] [DSA 2885-1] libyaml-libyaml-perl security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2885-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso March 26, 2014 http://www.debian.org/security/faq -...
Apple QuickTime multiple security vulnerabilities
Buffer overflows, memory corruptions, integer overflows on different media formats parsing...
Updated [CVE-2013-6398] CloudStack Virtual Router stop/start modifies firewall rules allowing additional access
Issued: November 27, 2013 Updated: January 10, 2014 CVE-2013-6398 CloudStack Virtual Router stop/start modifies firewall rules allowing additional access Product: Apache CloudStack Vendor: Apache Software Foundation Vulnerability type: Bypass Vulnerable Versions: Apache CloudStack 4.1.0, 4.1.1,...