47153 matches found
telepathy-idle insufficient certificate check
Server certificate is not checked...
[USN-1821-1] telepathy-idle vulnerability
========================================================================== Ubuntu Security Notice USN-1821-1 May 09, 2013 telepathy-idle vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: ...
Cross-Site Request Forgery (CSRF) in UMI.CMS
Advisory ID: HTB23151 Product: UMI.CMS Vendor: OOO Umisoft Vulnerable Versions: 2.9 and probably prior Tested Version: 2.9 Vendor Notification: April 3, 2013 Vendor Patch: May 7, 2013 Public Disclosure: May 8, 2013 Vulnerability Type: Cross-Site Request Forgery CWE-352 CVE Reference: CVE-2013-275...
EMC AlphaStor buffer overflow
Buffer overflow on commands parsing in AlphaStor Library Control Program...
Vulnerabilities in VideoJS
Hello 3APA3A! I want to inform you about vulnerabilities in VideoJS. This is popular video and audio player, which is used at hundreds thousands of web sites and in multiple web applications. This is Cross-Site Scripting vulnerability in VideoJS. There is also DoS hole related to this player, whi...
[SECURITY] CVE-2013-2067 Session fixation with FORM authenticator
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2013-2067 Session fixation with FORM authenticator Severity: Important Vendor: The Apache Software Foundation Versions Affected: - - Tomcat 7.0.0 to 7.0.32 - - Tomcat 6.0.21 to 6.0.36 Description: FORM authentication associates the most recent...
ESA-2013-021: EMC Documentum Multiple Vulnerabilities
ESA-2013-021.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-021: EMC Documentum Multiple Vulnerabilities EMC Identifier: ESA-2013-021 CVE Identifier: CVE-2013-0937, CVE-2013-0938, CVE-2013-0939 Severity Rating: See below for individual scores Affected products: • EMC Documentum Webtop...
EMC RSA Authentication Agent crossite scripting
No description provided...
Fujitsu notebooks privilege escalation
Untrusted path to executables...
Apache Tomcat security vulnerabilities
DoS, session fixation, information leakage...
EMC Documentum multiple security vulnerabilities
Session fixation, crossite scripting...
Re: Vulnerabilities in Windows 8 Professional x64 factory preinstallation of Fujitsu Lifebook A512 [continued]
On Sunday, May 05, 2013 10:13 PM I wrote: Hi @ll, Fujitsus http://www.fsc-pc.de/ factory preinstallation as found on a Fujitsu Lifebook A512 purchased a month ago of Windows 8 Professional x64 I'm VERY confident that other variants of Fujitsu's Windows 8 factory installation are just the like has...
ESA-2013-037: EMC AlphaStor Buffer Overflow Vulnerability
ESA-2013-037.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-037: EMC AlphaStor Buffer Overflow Vulnerability EMC Identifier: ESA-2013-037 EMC Identifier: NW150511 CVE Identifier: CVE-2013-0946 Severity Rating: CVSS v2 Base Score: 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C Affected product: • EMC...
DDIVRT-2013-53 Actuate 'ActuateJavaComponent' Multiple Vulnerabilities
Title ----- DDIVRT-2013-53 Actuate 'ActuateJavaComponent' Multiple Vulnerabilities Severity -------- High Date Discovered --------------- March 19, 2013 Discovered By ------------- Digital Defense, Inc. Vulnerability Research Team Credit: Dennis Lavrinenko, Bobby Lockett, and r@b13$ 1. Actuate...
CVE-2013-2071 Request mix-up if AsyncListener method throws RuntimeException
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2013-2071 Request mix-up if AsyncListener method throws RuntimeException Severity: Moderate Vendor: The Apache Software Foundation Versions Affected: - - Tomcat 7.0.0 to 7.0.39 Description: Bug 54178 described a scenario where elements of a previo...
Cisco Unified Customer Voice Portal multiple security vulnerabilities
DoS, privilege escalation code execution, files access...
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
[SECURITY] CVE-2012-3544 Chunked transfer encoding extension size is not limited
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2012-3544 Chunked transfer encoding extension size is not limited Severity: Important Vendor: The Apache Software Foundation Versions Affected: - - Tomcat 7.0.0 to 7.0.29 - - Tomcat 6.0.0 to 6.0.36 Description: When processing a request submitted...
ESA-2013-031: RSA® Authentication Agent Cross-Site Scripting (XSS) Vulnerability
ESA-2013-031.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-031: RSA® Authentication Agent Cross-Site Scripting XSS Vulnerability EMC Identifier: ESA-2013-031 CVE Identifier: CVE-2013-0942 Severity Rating: CVSS v2 Base Score: 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Affected Products: RSA®...
SEC Consult SA-20130507-0 :: Multiple vulnerabilities in NetApp OnCommand System Manager
SEC Consult Vulnerability Lab Security Advisory 20130507-0 ======================================================================= title: Multiple vulnerabilities product: NetApp OnCommand System Manager vulnerable version: = 2.1 and =2.0.2 fixed version: 2.2 only XSS fixed CVE: CVE-2013-3320 XSS...
Vulnerabilities in multiple web applications with VideoJS
Hello 3APA3A! These are Cross-Site Scripting vulnerabilities in multiple web applications with VideoJS. Earlier I've wrote about vulnerabilities in VideoJS http://seclists.org/fulldisclosure/2013/May/21. This is popular video and audio player, which is used at hundreds thousands of web sites and ...
Mesa / WebGL / libgl buffer overflow
Heap overflow...
[USN-1818-1] Mesa vulnerability
========================================================================== Ubuntu Security Notice USN-1818-1 May 07, 2013 mesa vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu...
[ MDVSA-2013:163 ] glibc
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:163 http://www.mandriva.com/en/support/security/ Package : glibc Date : May 7, 2013 Affected: Business Server 1.0 Problem Description: Multiple vulnerabilities has been discovered and corrected in glibc:...
gpsd memory corruption
Memory corruption on request processing...
GNU glibc security vulnerabilities
Buffer overflow in regexec, buffer overflow in getaddrinfo...
[USN-1820-1] gpsd vulnerability
========================================================================== Ubuntu Security Notice USN-1820-1 May 08, 2013 gpsd vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu...
Cisco Prime Data Center Network Manager code execution
TCP/1099 and TCP/9099 services code execution...
[2.0 Update] Cisco Security Advisory: Cisco Prime Data Center Network Manager Remote Command Execution Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco Security Advisory: Cisco Prime Data Center Network Manager Remote Command Execution Vulnerability Advisory ID: cisco-sa-20121031-dcnm Revision 2.0 Last Updated 2013 May 08 16:00 UTC GMT For Public Release 2012 October 31 16:00 UTC GMT...
[USN-1817-1] libxml2 vulnerability
========================================================================== Ubuntu Security Notice USN-1817-1 May 07, 2013 libxml2 vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubunt...
libxml security vulnerabilities
Multiple use-after-free vulnerabilities...
DDIVRT-2013-52 Dell EqualLogic PS6110X Directory Traversal
Title ----- DDIVRT-2013-52 Dell EqualLogic PS6110X Directory Traversal Severity -------- High Discovered By ------------- Evan Sylvester and r@b13$ Date Discovered --------------- February 19, 2013 Vulnerability Description ------------------------- The Dell EqualLogic PS6110X is vulnerable to a...
VULNERABLE and COMPLETELY outdated 3rd-party libraries/components used in 3CX Phone 6
Hi @ll, the current 3CXPhone6.msi for Windows, available from http://www.3cx.com/VOIP/sip-phone/, digitally signed on 2012-07-30, installs the following outdated and vulnerable 3rd-party libraries: libeay32.dll and ssleay32.dll version 0.9.8h from 2008-05-28 of OpenSSL. The current version of...
[waraxe-2013-SA#101] - Update Spoofing Vulnerability in Royal TS 2.1.5
waraxe-2013-SA101 - Update Spoofing Vulnerability in Royal TS 2.1.5 =============================================================================== Author: Janek Vind "waraxe" Date: 29. March 2013 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-101.html Description of vulnerable...
Huawei devices buffer overflow
Multiple buffer overflows in SNMPv3 daemon...
Microsoft Antimalware privilege escalation
It's possible to execute code with local system rights...
Dell EqualLogic directory traversal
It's possible to access system files...
[waraxe-2013-SA#098] - Directory Traversal Vulnerabilities in OpenCart 1.5.5.1
waraxe-2013-SA098 - Directory Traversal Vulnerabilities in OpenCart 1.5.5.1 =============================================================================== Author: Janek Vind "waraxe" Date: 19. March 2013 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-98.html Description of vulnerabl...
OpenText/IXOS ECM for SAP NetWeaver code exeution
ABAP code injection...
Oracle Java / IBM Java protection bypass
Sandbox protection bypass via Reflaction API...
[waraxe-2013-SA#100] - Update Spoofing Vulnerability in mRemote 1.50
waraxe-2013-SA100 - Update Spoofing Vulnerability in mRemote 1.50 =============================================================================== Author: Janek Vind "waraxe" Date: 29. March 2013 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-100.html Description of vulnerable softwar...
EMC RSA Archer multiple security vulnerabilities
Code execution, crosite scripting, authorization bypass...
[ESNC-2013-004] Remote ABAP Code Injection in OpenText/IXOS ECM for SAP NetWeaver
ESNC-2013-004 Remote ABAP Code Injection in OpenText/IXOS ECM for SAP NetWeaver Please refer to http://www.esnc.de for the original security advisory, updates and additional information. ------------------------------------------------------------------------ 1. Business Impact...
Open-Xchange Security Advisory 2013-03-13
Multiple security issues for Open-Xchange Server have been discovered and fixed. The vendor has chosen responsible full disclosure to publish security issue details. Users of the software have already been provided with patched versions. Proof regarding authenticity can be obtained from the...
hornbill supportworks SQL injection
Summary SQL Injection Vulnerability in ITSM component of Hornbill Supportworks Application CVE number: CVE-2013-2594 Impact: High Vendor homepage: http://www.hornbill.com Vendor notified: 19/11/2012 Vendor response: This issue has reportedly been fixed but the vendor refused to give version...
Vulnerabilities in multiple plugins for WordPress with jPlayer
Hello 3APA3A! I want to inform you about multiple vulnerabilities in multiple plugins for WordPress with jPlayer. These are Cross-Site Scripting and Content Spoofing and vulnerabilities. I've wrote about vulnerabilities in jPlayer earlier http://seclists.org/fulldisclosure/2013/Apr/192. jPlayer i...
Vulnerabilities in jPlayer
Hello 3APA3A! I want to inform you about multiple vulnerabilities in jPlayer. These are Cross-Site Scripting and Content Spoofing and vulnerabilities in jPlayer. Which is used at tens thousands of web sites and in multiple web applications. ------------------------- Affected products:...
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
Curl Ruby Gem Remote command execution
Curl Ruby Gem Remote command execution 3/12/2013 https://github.com/tg0/curl Specially crafted URLs can result in remote code execution: In ./lib/curl.rb the following lines: 131 cmd = "curl cookiesstore browsertype @setupparams ref "url" " 132 if @debug 133 puts cmd.red 134 end 135 result =...
CVE-2013-2504 : Matrix42 Service Desk XSS
43zsec SECURITY ADVISORY CVE ID : CVE-2013-2504 Product: Service Store 5.3 SP3 5.33.946.0 Vendor: matrix42 - member of asseco group Subject: Cross-site Scripting - XSS Classification: PCI 2.0: 6.5.7 PCI 1.2: 6.5.1 OWASP: A2 CWE: 79 CAPEC: 19 WASC: 08 Risk: High Effect: Remotely exploitable Author...