47153 matches found
Remote command injection in Ruby Gem kelredd-pruview 0.3.8
Remote command injection in Ruby Gem kelredd-pruview 0.3.8 Larry W. Cashdollar 4/4/2013 @larry0 Description: "A gem to ease generating image previews thumbnails of various files." https://rubygems.org/gems/kelredd-pruview Remote commands can be executed if the file name contains shell meta...
ESA-2013-015: RSA Archer® GRC Multiple Vulnerabilities
ESA-2013-015.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-015: RSA Archer® GRC Multiple Vulnerabilities EMC Identifier: ESA-2013-015 CVE Identifier: CVE-2013-0932, CVE-2013-0933, CVE-2013-0934 Severity Rating: CVSS v2 Base Score: See below for individual scores Affected Products: RS...
XSS and CS vulnerabilities in Dotclear
Hello 3APA3A! These are Cross-Site Scripting and Content Spoofing vulnerabilities in Dotclear. CMS Dotclear has three vulnerable flash-files: swfupload.swf, playerflv.swf and playermp3.swf. File swfupload.swf it's Swfupload. I've wrote about vulnerabilities in Swfupload in November 2012...
Vulnerabilities in SWFUpload in multiple web applications: WordPress, Dotclear, InstantCMS, AionWeb and others
Hello 3APA3A! Earlier I've wrote about Content Spoofing and Cross-Site Scripting vulnerabilities in SWFUpload http://securityvulns.ru/docs29181.html. This is very popular flash-file, which is used at tens millions of web sites and in hundreds of web applications only WordPress is used at more the...
Report OWASP WAF Naxsi bypass Vulnerability
OWASP WAF Naxsi bypass Vulnerability Certain unspecified input is not properly handed in naxsisrc/naxsiutils.c naxsiunescapeuriuchar dst, uchar src, sizet size, ngxuintt type before being used to filtered. This can be exploited to bypass some WAF rules. Naxsi site https://code.google.com/p/naxsi/...
Multiple vulnerabilities in Colormix theme for WordPress
Hello 3APA3A! Last year I've disclosed vulnerabilities in JW Player and in RokBox. Which were fixed by the developers - JW Player developers fixed one hole and promised to fix others later and RokBox fixed all holes but it was questionable how they fixed holes related to JW Player. In December I'...
[ MDVSA-2013:149 ] roundcubemail
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:149 http://www.mandriva.com/en/support/security/ Package : roundcubemail Date : April 21, 2013 Affected: Business Server 1.0 Problem Description: A vulnerability has been found and corrected in roundcubemail...
Remote command execution in Ruby Gem ldoce 0.0.2
Remote command execution in Ruby Gem ldoce 0.0.2 Larry W. Cashdollar @larry0 3/25/2013 Ldoce Ruby Gem: Easily interface with the Longman Dictionary of Contemporary English API from Ruby: NB currently mac only as it depends on the afplay command. https://rubygems.org/gems/ldoce...
Multiple Vulnerabilities in D-Link DSL-320B
Device: DSL-320B Firmware Version: EUDSL-320B v1.23 date: 28.12.2010 Vendor URL: http://www.dlink.com/de/de/home-solutions/connect/modems-and-gateways/dsl-320b-adsl-2-ethernet-modem ============ Vulnerability Overview: ============ Access to the Config file without authentication = full...
Apache VCL improper input validation
CVE-2013-0267: Apache VCL improper input validation Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache VCL 2.1, 2.2, 2.2.1, 2.3, 2.3.1 Description: Some parts of VCL did not properly validate input data. This problem was present both in the Privileges portion of...
[ISecAuditors Security Advisories] Multiple Full Path Disclosure Vulnerabilities in TinyWebGallery <= v1.8.9
============================================= INTERNET SECURITY AUDITORS ALERT 2013-012 - Original release date: March 19th, 2013 - Last revised: April 6th, 2013 - Discovered by: Manuel Garcia Cardenas - Severity: 5/10 CVSS Base Score - CVE-ID: CVE-2013-2631...
Multiple Vulnerabilities in KrisonAV CMS
Advisory ID: HTB23150 Product: KrisonAV CMS Vendor: http://www.krisonav.com Vulnerable Versions: 3.0.1 and probably prior Tested Version: 3.0.1 Vendor Notification: March 27, 2013 Vendor Patch: March 31, 2013 Public Disclosure: April 17, 2013 Vulnerability Type: Cross-Site Scripting CWE-79,...
XSS vulnerabilities in ZeroClipboard in multiple plugins for WordPress
Hello 3APA3A! These are Cross-Site Scripting vulnerabilities in multiple plugins for WordPress with ZeroClipboard.swf. Earlier I've wrote about Cross-Site Scripting vulnerabilities in ZeroClipboard http://seclists.org/fulldisclosure/2013/Feb/103. I wrote that this is very widespread flash-file an...
3CX Phone outdated libraries
Outdated versions of OpenSSL and FFmpeg/FFdshow are used...
[SECURITY] [DSA 2646-1] typo3-src security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2646-1 [email protected] http://www.debian.org/security/ Yves-Alexis Perez March 15, 2013 http://www.debian.org/security/faq -...
Path Traversal in AWS XMS
Advisory ID: HTB23147 Product: AWS XMS Vendor: http://www.aws-dms.com Vulnerable Versions: 2.5 and probably prior Tested Version: 2.5 Vendor Notification: March 6, 2013 Vendor Patch: March 16, 2013 Public Disclosure: March 27, 2013 Vulnerability Type: Path Traversal CWE-22 CVE Reference:...
[SE-2012-01] New security vulnerabilities and broken fixes in IBM Java
Hello All, Security Explorations discovered 7 additional security issues 62-68 in the latest version of IBM SDK, Java Technology Edition software 1. A majority of the new flaws are due to insecure use or implementation of Java Reflection API. Additionally to the above, we found out that four issu...
FUSE symlink vulnerabilities
It's possible to umount any partition...
SRPLab Personal File Share buffer overflow
Buffer overflow on oversized request in HTTP server...
NGS00422 Patch Notification: Oracle Retail Integration Bus Manager Directory Traversal
High Risk Vulnerability in Oracle Retail Integration Bus Manager 1 May 2013 Andrew Davies of NCC Group has discovered a High risk vulnerability in Oracle Retail Integration Bus Manager Impact: Directory traversal Versions affected: Oracle Retail Integration Bus, versions 13.0, 13.1, 13.2 Security...
WowzaMediaServer SecureToken bypass (and worse)
Product: Wowza Media Server URL: http://www.wowza.com/ Description: WMS is a quite popular RTMP/HLS/HDS/RTSP streaming server Issue: By default all installations of WMS use four modules in their application's config file: base, properties, logging, flvplayback. I've found out that the properties...
[security bulletin] HPSBMU02872 SSRT101185 rev.1 - HP Service Manager, Remote Disclosure of Information, Cross Site
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03748875 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03748875 Version: 1 HPSBMU02872...
Wowza Media Server security vulnerabilities
Directory traversal, authentication bypass...
[ MDVSA-2013:154 ] util-linux
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:154 http://www.mandriva.com/en/support/security/ Package : util-linux Date : April 29, 2013 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: A vulnerability has been found and...
HP Service Manager security vulnerabilities
XSS, information leakage...
CORE-2013-0303 - D-Link IP Cameras Multiple Vulnerabilities
Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ D-Link IP Cameras Multiple Vulnerabilities 1. Advisory Information Title: D-Link IP Cameras Multiple Vulnerabilities Advisory ID: CORE-2013-0303 Advisory URL:...
D-Link IP cameras multiple security vulnerabilities
Code execution, authentication bypass, hardcoded credentials, information leakage...
ESA-2013-034: EMC Avamar Improper Authorization vulnerability
ESA-2013-034.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-034: EMC Avamar Improper Authorization vulnerability EMC Identifier: ESA-2013-034 CVE Identifier: CVE-2013-0944 Severity Rating: CVSS v2 Base Score: 7.5 AV:N/AC:M/Au:S/C:C/I:P/A:P Affected products: • EMC Avamar Server 5.x •...
Personal File Share HTTP Server Remote Overflow Vulnerability
Title: Personal File Share HTTP Server Remote Overflow Vulnerability Software : Personal File Share HTTP Server Software Version : UNKNOWN Vendor: http://www.srplab.com/ Vulnerability Published : 2013-04-28 Vulnerability Update Time : Status : Impact : MediumCVSS2 Base : 5.0,...
FreeBSD Security Advisory FreeBSD-SA-13:05.nfsserver [REVISED]
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-13:05.nfsserver Security Advisory The FreeBSD Project Topic: Insufficient input validation in the NFS server Category: core Module: nfsserver Announced: 2013-04-2...
util-linux / mount information leakage
It's possible to check file existance...
stunnel integer overflow
Integer overflow leads to buffer overflow...
nginx integer overflow
Integer overflow leads to code execution...
VUPEN Security Research - Microsoft Internet Explorer 10-9-8-7-6 "CDisplayPointer" Use-after-free (MS13-028)
VUPEN Security Research - Microsoft Internet Explorer 10-9-8-7-6 "CDisplayPointer" Use-after-free MS13-028 Website : http://www.vupen.com Twitter : http://twitter.com/vupen I. BACKGROUND --------------------- "Microsoft Internet Explorer is a web browser developed by Microsoft and included as par...
Microchip controllers IPv6 implementation buffer overflow
Buffer overflow on fragmented packets parsing...
MIT Kerberos 5 security vulnereabilities
Few NULL pointer dereferences...
[SECURITY] [DSA 2665-1] strongswan security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2665-1 [email protected] http://www.debian.org/security/ Yves-Alexis Perez April 30, 2013 http://www.debian.org/security/faq -...
Re: Nginx ngx_http_close_connection function integer overflow
Hello, On Thu, 25 Apr 2013, 06:52-0000, [email protected] wrote: ... II. DESCRIPTION --------------------- Qihoo 360 Web Security Research Team discovered a critical vulnerability in nginx. The vulnerability is caused by a int overflow error within the Nginx ngxhttpcloseconnection function when...
Cisco Linksys E1200 / N300 XSS
XSS in Web interface...
Unchecked Buffer in Microchip TCP/IP Stack Could Allow Remote Code Execution
Unchecked Buffer in Microchip TCP/IP Stack Could Allow Remote Code Execution ============================= ==== General Information ==== ============================= == Executive Summary == The function TCPIPIPV6ProcessFragmentationHeader does not correctly validate the "fragment offset" field i...
Oracle / Sun / MySQL / PeopleSoft multiple applications security vulnerabilities
128 vulnerabilities in different application...
EMC Networker privilege escalation
Weak file permissions...
Microsoft Internet Explorer multiple security vulnerabilities
Use-after-free vulnerabilities...
WowzaMediaServer StorageDir escape (regression)
Product: Wowza Media Server URL: http://www.wowza.com/ Description: WMS is a quite popular RTMP/HLS/HDS/RTSP streaming server Issue: In early 2009 I reported problem with processing of requests with relative paths. The issue surfaced again. In a nutshell, you can escape Applications StorageDir...
strongSwan privilege escalation
Under some condition it's possibloe to authenticate as a different user...
[ MDVSA-2013:157 ] krb5
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:157 http://www.mandriva.com/en/support/security/ Package : krb5 Date : April 30, 2013 Affected: Enterprise Server 5.0 Problem Description: Multiple vulnerabilities has been discovered and corrected in krb5:...
Cisco/Linksys E1200 N300 Reflected XSS
Summary -------------------- Software : Cisco/Linksys Router OS Hardware : E1200 N300 others currently untested Version : 2.0.04 others currently untested Website : http://www.linksys.com Issue : Reflected XSS Severity : Medium Researcher: Carl Benedict theinfinitenigma Product Description...
ESA-2013-035: EMC Avamar Client Improper Certificate Validation Vulnerability
ESA-2013-035.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-035: EMC Avamar Client Improper Certificate Validation Vulnerability EMC Identifier: ESA-2013-035 CVE Identifier: CVE-2013-0945 Severity Rating: CVSS v2 Base Score: 7.6 AV:N/AC:H/Au:N/C:C/I:C/A:C Affected products: EMC Avamar...
EMC Avamar server / client security vulnerabilities
Unauthorized files access, insufficient certificate validation...
[USN-1816-1] ClamAV vulnerabilities
========================================================================== Ubuntu Security Notice USN-1816-1 May 03, 2013 clamav vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubun...