[ESNC-2013-001] Privilege Escalation in SAP Healthcare Industry Solution

ESNC-2013-001 Privilege Escalation in SAP Healthcare Industry Solution Please refer to www.esnc.de for the original security advisory, updates and additional information. ------------------------------------------------------------------------ 1. Business Impact...

[ESNC-2013-002] Privilege Escalation in SAP Production Planning and Control

ESNC-2013-002 Privilege Escalation in SAP Production Planning and Control Please refer to www.esnc.de for the original security advisory, updates and additional information. ------------------------------------------------------------------------ 1. Business Impact...

[SECURITY] [DSA 2662-1] xen security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2662-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso April 18, 2013 http://www.debian.org/security/faq -...

Adobe ColdFusion security vulnerabilities

Information leakage, unauthorized access...

Oracle Java / OpenJDK multiple security vulnerabilities

42 different vulnerabilities...

APPLE-SA-2013-04-16-2 Java for OS X 2013-003 and Mac OS X v10.6 Update 15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2013-04-16-2 Java for OS X 2013-003 and Mac OS X v10.6 Update 15 Java for OS X 2013-003 and Mac OS X v10.6 Update 15 are now available and address the following: Java Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7 o...

Cisco Network Admission Control Manager SQL injection

No description provided...

SEC Consult SA-20130417-1 :: Java ActiveX Control Memory Corruption

SEC Consult Vulnerability Lab Security Advisory 20130417-1 ======================================================================= title: Java ActiveX Control Memory Corruption product: JavaTM Web Start Launcher vulnerable version: Sun Java Version 7 Update 17 and before Sun Java Version 6 Update...

Cisco IOS multiple security vulnerabilities

RSVP DoS, IKE DoS, NAT implementation DoS, Smart Install client DoS, SPT DoS, IP SLA DoS, SIP DoS...

Cisco Prime Network Control Systems default account

Default database account...

[CVE-REQUEST] Multiple CSRF vulnerabilities on Foscam IP cameras web UI

Embedded Web interface version 2.4.10.3 and older of Foscam FI8910W, FI8908W and many others is vulnerable to CSRF attacks. This allows attacker to perform calls to any CGI API using cached basic server authentication data stored in victims browser. Details: For example, the following URL request...

CVE-2013-0798 : World read and write access to app_tmp directory on Android

Fourteenforty Research Institute, Inc. Security Advisory World read and write access to apptmp directory on Firefox for Android 2013/04/02 === Summary === World read and write access to apptmp directory on Firefox for Android allows replacing Firefox add-ons. === Severity === Middle === Affected...

[SECURITY] [DSA 2659-1] libapache-mod-security security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2659-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso April 09, 2013 http://www.debian.org/security/faq -...

Firefox for Android weak permissions

Weak apptmp permissions allows to overwrite addons...

Microsoft Internet Explorer DoS

Crash on recursive CSS inclusion...

DartWebserver DoS

NULL pointer dereference...

Linux kernel multiple security vulnerabilities

DoS, protection bypass, nVidia drivers buffer overflow, information leakage...

[USN-1793-1] Linux kernel vulnerabilities

========================================================================== Ubuntu Security Notice USN-1793-1 April 08, 2013 linux vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

Apache mod_security security vulnerabilities

Local files access, resources exhausiton...

DoS vulnerability in Internet Explorer (access violation)

Hello 3APA3A! I want to warn you about Denial of Service vulnerabilities in Internet Explorer. This is access violation. I've made the exploit and tested this vulnerability at 13.02.2013. This exploit is based on video by TheSecuritylab for IE7. As I've tested, it also works in IE6 and IE8...

libc glob() resources exhaustion

It's possible to build recursive template, leading to memory exhaustion...

MacOSX 10.8.3 ftpd Remote Resource Exhaustion

MacOSX 10.8.3 ftpd Remote Resource Exhaustion Maksymilian Arciemowicz http://cxsecurity.com/ http://cvemap.org/ Public Date: 01.02.2013 http://cxsecurity.com/cveshow/CVE-2010-2632 http://cxsecurity.com/cveshow/CVE-2011-0418 --- 1. Description --- Old vulnerability in libc allow to denial of servi...

[CVE-2012-5389] Null Pointer Derefence in Dart Webserver <= 1.9.2

Overview =============== DartWebserver.Dll is an HTTP server provided by Dart Comunications dart.com. It is distributed in their PowerTCP/Webserver For ActiveX product and likely other similar products. "Build web applications in any familiar software development environment. Use WebServer for...

Cisco Unified MeetingPlace Application Server security vulnerabilities

Authentication bypass, unauthorized access...

[USN-1799-1] NVIDIA graphics drivers vulnerability

========================================================================== Ubuntu Security Notice USN-1799-1 April 10, 2013 nvidia-graphics-drivers, nvidia-graphics-drivers-updates, nvidia-settings, nvidia-settings-updates vulnerability...

Microsoft Active Directory DoS

Memory exhaustion...

Microsoft multiple applications crossite scripting

Invalid characters sanitization...

Microsoft Remote Desktop Connection Client ActiveX code execution

Use-after-free in ActiveX...

Microsoft SharePoint weak permissions

Weak documents access rights...

Microsoft Windows multiple security vulnerabilities

Multiple privilege escalations in kernel, CSRSS and drivers...

MIT Kerberos 5 DoS

pkinitcryptoopenssl.c NULL pointer dereference...

Multiple vulnerabilities in D-Link devices

Code execution, information leakage...

Aastra IP phones backdoor

Hardcoded telnet account admin/Mqozn...

[ MDVSA-2013:043 ] libgssglue

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:043 http://www.mandriva.com/en/support/security/ Package : libgssglue Date : April 5, 2013 Affected: Business Server 1.0 Problem Description: This update fixes insecure getenv usage in libgssglue, which coul...

HP LoadRunner security vulnerabilities

Few different buffer overflows...

Multiple Vulnerabilities in D-Link devices

Device Name: DIR-600 / DIR-300 revB / DIR-815 / DIR-645 / DIR-412 / DIR-456 / DIR-110 Vendor: D-Link ============ Vulnerable Firmware Releases: ============ DIR-815 v1.03b02 unauthenticated command injection DIR-645 v1.02 unauthenticated command injection DIR-645 v1.03 authenticated command...

[security bulletin] HPSBMU02785 SSRT100526 rev.2 - HP LoadRunner Running on Windows, Remote Execution of Arbitrary Code, Denial of Service (DoS)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03216705 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03216705 Version: 2 HPSBMU02785...

Aastra IP Telephone hardcoded telnet admin password

Aastra IP Telephone hardcoded telnet admin password --------------------------------------------------- Affected products ================= Aastra 6753i IP Telephone Firmware Version 3.2.2.56 Firmware Release Code SIP Boot Version 2.5.2.1010 Background ========== "The 6753i from Aastra offers...

[slackware-security] subversion (SSA:2013-095-01)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 slackware-security subversion SSA:2013-095-01 New subversion packages are available for Slackware 13.0, 13.1, 13.37, 14.0, and -current to fix security issues. Here are the details from the Slackware 14.0 ChangeLog: +--------------------------+...

Subversion multiple security vulnerabilities

Multiple DoS conditions...

libgssapi / libgssglue privilege escalation

Insecure getenv usage...

OpenFabrics ibutils 1.5.7 /tmp clobbering vulnerability

OpenFabrics ibutils 1.5.7 /tmp clobbering vulnerability 3/6/2013 Larry W. Cashdollar @larry0 The infiniband diagnostic utiltiy handles files in /tmp insecurely. A malicious user can clobber root owned files with common symlink attacks. http://www.openfabrics.org/downloads/ibutils/ nobody@exdb01...

OpenFabrics ibutils symbolic links vulnerability

infiniband utility unsafe temporary files creation...

Authentication bypass on Netgear WNR1000

Authentication bypass on Netgear WNR1000 ======================================== ADVISORY INFORMATION Title: Authentication bypass on Netgear WNR1000 Discovery date: 10/11/2012 Release date: 29/03/2013 Credits: Roberto Paleari [email protected], twitter: @rpaleari VULNERABILITY INFORMATION...

Cisco Video Surveillance Operations Manager Multiple vulnerabilities

Exploit Title:Cisco Video Surveillance Operations Manager Multiple vulnerabilities Google Dork: intitle:"Video Surveillance Operations Manager Login" Date: 22 Feb 2013 reported to the vendor Exploit Author: Bassem | bassem.co Vendor Homepage: www.cisco.com Version: Version 6.3.2 Tested on: Versio...

Google AD Sync Tool - Exposure of Sensitive Information Vulnerability - Security Advisory - SOS-13-001

Sense of Security - Security Advisory - SOS-13-001 Release Date. 03-Apr-2013 Last Update. - Vendor Notification Date. 03-Sep-2012 Product. Google Active Directory Sync GADS Tool Platform. Windows, Linux, Solaris Affected versions. All versions up to 3.1.3 Severity Rating. High Impact. Exposure of...

Groovy Media Player buffer overflow Vulnerability

Title: ==== Groovy Media Player 3.2.0 Buffer Overflow Vulnerability Credit: ====== Name: Akshaysinh Vaghela Company/affiliation: Cyberoam Technologies Private Limited Website: www.cyberoam.com CVE: ===== CVE-2013-2760 Reserved Date: ==== 21-03-2013 CL-ID: ==== CRD-2013-02 Vendor: ======...

QlikView integer overflow

Integer overflow on .qvw files parsing...

Novell GroupWise code execution

Untrusted pointer dereference...

[USN-1790-1] Libav vulnerabilities

========================================================================== Ubuntu Security Notice USN-1790-1 April 04, 2013 libav vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...