47153 matches found
SEC Consult SA-20130122-0 :: F5 BIG-IP XML External Entity Injection vulnerability
SEC Consult Vulnerability Lab Security Advisory 20130122-0 ======================================================================= title: XML External Entity Injection XXE product: F5 BIG-IP vulnerable version: =11.2.0 fixed version: 11.2.0 HF3 11.2.1 HF3 CVE number: CVE-2012-2997 impact: Medium...
Re: EMC Avamar: World writable cache files
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-003: EMC Avamar Client Elevation of Privilege Vulnerability EMC Identifier: ESA-2013-003 CVE Identifier: CVE-2012-2291 Severity Rating: CVSS v2 Base Score: 6.8 AV:L/AC:L/Au:S/C:C/I:C/A:C Affected Products: EMC Avamar HP-UX Client 4.x, 5.x and...
Multiple Vulnerabilities in Linksys WRT54GL
Device Name: Linksys WRT54GL v1.1 Vendor: Linksys/Cisco ============ Vulnerable Firmware Releases: ============ Firmware Version: 4.30.15 build 2, 01/20/2011 ============ Device Description: ============ The Router lets you access the Internet via a wireless connection, broadcast at up to 54 Mbps...
ircd-ratbox / Charybdis DoS
Crash with assert on connection initialization...
HP Diagnostics Server code execution
magentservice.exe code execution on TCP/23472 request parsing...
[SECURITY] [DSA 2612-1] ircd-ratbox security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2612-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff January 24, 2013 http://www.debian.org/security/faq -...
Multiple SQL injection vulnerabilities in Cardoza Wordpress poll plugin
Exploit Title : Multiple SQL injection vulnerabilities in Cardoza Wordpress poll plugin Author:Marcela Benetrix home:www.girlinthemiddle.net Date: 01/21/13 version: 34.05 software link:http://wordpress.org/extend/plugins/cardoza-wordpress-poll/ Wordpress Poll plugin description Wordpress Poll is...
F5 BIG-IP security vulnerabilities
SQL and XML injections...
ESA-2013-008: EMC AlphaStor Multiple Vulnerabilities
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-008: EMC AlphaStor Multiple Vulnerabilities EMC Identifier: ESA-2013-008 EMC Identifier: NW146708 CVE Identifier: CVE-2013-0928, CVE-2013-0929 Severity Rating: See below for individual severity scores Affected product: EMC AlphaStor 4.0 prior...
Vino information leakage
It's possible to access clipboard content without authentication...
[USN-1701-1] Vino vulnerability
========================================================================== Ubuntu Security Notice USN-1701-1 January 22, 2013 vino vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubun...
PHP information leakage
opensslencrypt memory disclosure...
EMC AlphaStor security vulnerabilities
Command injection, format string vulnerability...
Cisco Linksys WRT54GL multiple security vulnerabilities
Code execution, crossite scripting, crossite request forgery...
[security bulletin] HPSBMU02841 SSRT100724 rev.1 - HP Diagnostics Server, Remote Execution of Arbitrary Code
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03645497 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03645497 Version: 1 HPSBMU02841...
Cisco Wireless LAN Controller multiple security vulnerabilities
DoS via IP packet processing in IPS, DoS via SIP packet, SNMP unauthorized access, HTTP Profiling code execution...
EMC Avamar weak permissions
Cache files are world writable...
SEC Consult SA-20130122-1 :: F5 BIG-IP SQL injection vulnerability
SEC Consult Vulnerability Lab Security Advisory 20130122-1 ======================================================================= title: SQL Injection product: F5 BIG-IP vulnerable version: =11.2.0 fixed version: 11.2.0 HF3 11.2.1 HF3 CVE number: CVE-2012-3000 impact: Medium homepage:...
SEC Consult SA-20130124-0 :: Critical SSH Backdoor in multiple Barracuda Networks Products
SEC Consult Vulnerability Lab Security Advisory 20130124-0 ======================================================================= title: Critical SSH Backdoor in multiple Barracuda Networks Products vulnerable products: Barracuda Spam and Virus Firewall Barracuda Web Filter Barracuda Message...
Cisco ASA DoS
DoS on H.323 processing...
NSOADV-2013-001: DELL SonicWALL GMS/Viewpoint/Analyzer Authentication Bypass (/appliance/)
-------------------------- NSOADV-2013-001 --------------------------- SonicWALL GMS/Viewpoint/Analyzer Authentication Bypass /appliance/ 111101111 11111 00110 00110001111 111111 01 01 1 11111011111111 11111 0 11 01 0 11 1 1 111011001 11111111101 1 11 0110111 1 1111101111 1001 0 1 10 11 0 10 11...
CVE-2012-6452 Axway Secure Messenger Username Disclosure
Product: Axway Email Firewall Component: Secure Messenger Vendor: Axway Vulnerable Versions: 6.5 and earlier on the Email Firewall EMF platform only Tested Version: 6.3.2 Build 4230 Vendor Notification: December 8, 2012 Vendor Patch: Secure Messenger version 6.5.0 Updated Release 7 Public...
[USN-1696-1] Linux kernel vulnerabilities
========================================================================== Ubuntu Security Notice USN-1696-1 January 18, 2013 linux vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...
Trimble Infrastructure GNSS crossite scripting
Web interface crossite scripting...
[SECURITY] [DSA 2608-1] qemu security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2608-1 [email protected] http://www.debian.org/security/ Florian Weimer January 15, 2013 http://www.debian.org/security/faq -...
NSOADV-2013-002: DELL SonicWALL GMS/Viewpoint/Analyzer Authentication Bypass (/sgms/)
-------------------------- NSOADV-2013-002 --------------------------- SonicWALL GMS/Viewpoint/Analyzer Authentication Bypass /sgms/ 111101111 11111 00110 00110001111 111111 01 01 1 11111011111111 11111 0 11 01 0 11 1 1 111011001 11111111101 1 11 0110111 1 1111101111 1001 0 1 10 11 0 10 11 111111...
Trimble® Infrastructure GNSS Series Receivers Cross Site Scripting (XSS) vulnerability
Trimble® Infrastructure GNSS Series Receivers Cross Site Scripting XSS vulnerability: - CVE: CVE-2012-5053 - Deloitte Argentina Advisory Code: DTTAR-20130001 - Vendor Status: CONFIRMED - Public Disclosure Date: January, 15th, 2013. - Vendors Affected: Trimble - http://www.trimble.com/ - Systems...
Axway Email Firewall information leakage
Different authentication error codes for existant and non-existant user...
Secunia Research: Oracle Outside In Technology Paradox Database Handling Buffer Overflow
====================================================================== Secunia Research 16/01/2013 - Oracle Outside In Technology Stream Filters - - Paradox Database Handling Buffer Overflow - ====================================================================== Table of Contents Affected...
[SE-2012-01] Java 7 Update 11 confirmed to be vulnerable
Hello All, This post might be interesting for those concerned about the state of Oracle's Java SE security. We have successfully confirmed that a complete Java security sandbox bypass can be still gained under the recent version of Java 7 Update 11 1 JRE version 1.7.011-b21. MBeanInstantiator bug...
Linux kernel security vulnerabilities
Invalid hot-added memory handling, information leakage on module loading, DoS...
SonicWALL GMS/Viewpoint/Analyzer authentication bypass
It's possible to access few directories without authentication...
Secunia Research: Oracle Outside In Technology Paradox Database Handling Denial of Service
====================================================================== Secunia Research 16/01/2013 - Oracle Outside In Technology Stream Filters - - Paradox Database Handling Denial of Service - ====================================================================== Table of Contents Affected...
0-day vulnerability in Oracle Java is used to install maliscious software
Applet can grant permissions to itself...
qemu buffer overflow
Buffer overflow in e1000 emulator...
Microsoft Internet Explorer use-after-free vulnerabilities
Use-after-free vulnerability in CButton is actively used in-the-wild...
CVE-2012-5641 Apache CouchDB Information disclosure via unescaped backslashes in URLs on Windows
CVE-2012-5641 Information disclosure via unescaped backslashes in URLs on Windows Affected Versions: All Windows-based releases of Apache CouchDB, up to and including 1.0.3, 1.1.1, and 1.2.0 are vulnerable. Description: A specially crafted request could be used to access content directly that wou...
FreeType security vulnerabilities
Multiple vulnerabilities on BDF fonts parsing...
Multiple vulnerabilities in Floating Tweets for WordPress
Hello 3APA3A! I want to warn you about multiple vulnerabilities in plugin Floating Tweets for WordPress. These are Full path disclosure, Directory Traversal and Cross-Site Scripting vulnerabilities. ------------------------- Affected products: ------------------------- Vulnerable are Floating...
ProFTPd symbolic links vulnerability
No description provided...
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
Adobe Reader / Acrobat multiple security vulnereabilities
Multiple memory corruptions, buffer overflows, integer overflows, privilege escalations, code executions...
DefenseCode Security Advisory (UPCOMING): Cisco Linksys Remote Preauth 0day Root Exploit
DefenseCode Security Advisory UPCOMING: Cisco Linksys Remote Preauth 0day Root Exploit Story behind the vulnerability... Months ago, we've contacted Cisco about a remote preauth root access vulnerability in default installation of their Linksys routers that we've discovered. We gave them detailed...
[USN-1683-1] Linux kernel vulnerability
========================================================================== Ubuntu Security Notice USN-1683-1 January 10, 2013 linux vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...
CVE-2012-5649 Apache CouchDB JSONP arbitrary code execution with Adobe Flash
CVE-2012-5649 JSONP arbitrary code execution with Adobe Flash Severity: Moderate Vendor: The Apache Software Foundation Affected Versions: JSONP is supported but disabled by default in all currently supported releases of Apache CouchDB. Administrator access is required to enable it. Releases up t...
[security bulletin] HPSBMU02838 SSRT100789 rev.1 - HP Serviceguard on Linux, Remote Denial of Service (DoS)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03621178 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03621178 Version: 1 HPSBMU02838...
HP ServiceGuard DoS
No description provided...
[USN-1686-1] FreeType vulnerabilities
========================================================================== Ubuntu Security Notice USN-1686-1 January 14, 2013 freetype vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: ...
Adobe Flash Player memory corruption
Memory corruption on SWF parsing...
US-CERT Alert TA13-010A - Oracle Java 7 Security Manager Bypass Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Awareness System US-CERT Alert TA13-010A Oracle Java 7 Security Manager Bypass Vulnerability Original release date: January 10, 2013 Last revised: -- Systems Affected Any system using Oracle Java 7 1.7, 1.7.0 including Java Platform...