47153 matches found
[CVE-2012-5858] [CVE-2012-5859] DoS/Authorization Bypass - Kies Air
Name: CVE-2012-5858 CVE-2012-5859 DoS/Authorization Bypass - Kies Air Package: com.samsung.swift.app.kiesair Affected versions: 2.1.207051, 2.1.210161 Testing Device: Samsung S3 AT&T - SAMSUNG-SGH-I747 Android Version: 4.0.4/ Build Number: IMM76D.I747UCALH9 Vendor homepage:...
Microsoft Internet Explorer multiple security vulnerabilities
Few different use-after-free vulnerabilities...
XSS vulnerability in swfupload in WordPress
Hello 3APA3A! I will draw your attention to XSS vulnerability in swfupload in WordPress. In April there was announced Cross-Site Scripting vulnerability in swfupload.swf in WordPress CVE-2012-3414. It was fixed in WordPress 3.3.2. At that time there was no detailed information about it. Last week...
Multiple Vulnerabilities in Smartphone Pentest Framework (SPF)
Advisory ID: HTB23123 Product: Smartphone Pentest Framework SPF Vendor: Bulb Security LLC Vulnerable Versions: v0.1.2 and probably prior Tested Version: v0.1.2 Vendor Notification: October 24, 2012 Public Disclosure: November 14, 2012 Vulnerability Type: OS Command Injection CWE-78, SQL Injection...
[SECURITY] [DSA 2574-1] typo3-src security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2574-1 [email protected] http://www.debian.org/security/ November 15, 2012 http://www.debian.org/security/faq -...
Security advisory for Bugzilla 4.4rc1, 4.2.4, 4.0.9 and 3.6.12
Summary ======= Bugzilla is a Web-based bug-tracking system used by a large number of software projects. The following security issues have been discovered in Bugzilla: Confidential product and component names can be disclosed to unauthorized users if they are used to control the visibility of a...
Media Player Classic security vulnerabilities
Built-in web server DoS and crossite scripting...
iDev Rentals v1.0 - Multiple Web Vulnerabilities
Title: ====== iDev Rentals v1.0 - Multiple Web Vulnerabilities Date: ===== 2012-11-14 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=760 VL-ID: ===== 758 Common Vulnerability Scoring System: ==================================== 3.5 Introduction: =============...
Samsung Kies Air security vulnerabilities
DoS, authentication bypass...
XSS vulnerability in web applications with swfupload: Dotclear, XenForo, InstantCMS, AionWeb, Dolphin
Hello 3APA3A! I will draw your attention to XSS vulnerability in other web applications with swfupload. Earlier I've wrote about swfupload in WordPress CVE-2012-3414 and that this hole is available in many web applications. In previous letter I've wrote the information about different versions of...
Microsoft Excel multiple security vulnerabilities
Bufer overflows, memory corruptions, use-after-free...
[USN-1632-1] Django vulnerability
========================================================================== Ubuntu Security Notice USN-1632-1 November 15, 2012 python-django vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its...
BananaDance Wiki b2.2 - Multiple Web Vulnerabilities
Title: ====== BananaDance Wiki b2.2 - Multiple Web Vulnerabilities Date: ===== 2012-11-10 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=745 VL-ID: ===== 745 Common Vulnerability Scoring System: ==================================== 7.1 Introduction: ============= Banan...
Weak password encryption on Huawei products
Weak password encryption on Huawei products =========================================== ADVISORY INFORMATION Title: Weak password encryption on Huawei products Release date: 13/11/2012 Credits: Roberto Paleari, Emaze Networks [email protected] Ivan Speziale, Emaze Networks...
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
[OVSA20121112] OpenVAS Manager Vulnerable To Command Injection
OpenVAS Security Advisory OVSA20121112 Date: 12th November 2012 Product: OpenVAS Manager 3.0.4 and 4.0+beta4 Vendor: OpenVAS http://www.openvas.org/ Risk: Medium Summary It has been identified that OpenVAS Manager is vulnerable to command injection due to insufficient validation of user supplied...
ESA-2012-055: RSA® Data Protection Manager Multiple Vulnerabilities
ESA-2012-055.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2012-055: RSA® Data Protection Manager Multiple Vulnerabilities EMC Identifier: ESA-2012-055 CVE Identifier: CVE-2012-4612, CVE-2012-4613 Severity Rating: See below for individual scores and refer vendor advisories for component...
[DC-2012-11-001] DefenseCode ThunderScan PHP Advisory: Wordpress WP e-Commerce Plugin Multiple Security Vulnerabilities
DefenseCode ThunderScan PHP Advisory: Wordpress WP E-Commerce Plugin Multiple Security Vulnerabilities Advisory ID: DC-2012-11-001 Advisory Title: Wordpress WP E-Commerce Plugin Multiple Vulnerabilities Advisory URL:...
OpenVAS Manager code execution
Unescaped shell characters on OMP request processing...
Huawei weak passwords encryption
Passwords are stored in reversible encryption...
Eventy CMS v1.8 Plus - Multiple Web Vulnerablities
Title: ====== Eventy CMS v1.8 Plus - Multiple Web Vulnerablities Date: ===== 2012-11-13 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=756 VL-ID: ===== 756 Common Vulnerability Scoring System: ==================================== 8.3 Introduction: ============= Publish...
EMC RSA Data Protection Manager security vulnerabilities
Crossite scripting, restrictions bypass...
Reflective XSS in uk cookie plugin
The plugin uk-cookie has a reflective XSS injection possible while using it. http://wordpress.org/extend/plugins/uk-cookie/ Script Used- scriptalert'hacked'/script CVE-2012-5856...
radsecproxy protection bypass
It's possible to bypass SSL certificate check under some conditions...
[SECURITY] [DSA 2573-1] radsecproxy security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2573-1 [email protected] http://www.debian.org/security/ Luciano Bello November 10, 2012 http://www.debian.org/security/faq -...
Sophos / Cisco Ironport products security vulnerabilities
Different vulnerabilities, including remote code execution...
Sql injection in AJAX post Search wordpress plugin
Exploit Title : SQl INJECTION AJAX Post Search --- wordpress plugin--- Author:Marcela Benetrix home:www.girlinthemiddle.net Date: 10/12/12 version: 1.1 software link: http://wordpress.org/extend/plugins/cardoza-ajax-search/ AJAX Post Search wordpress plugin description This plugin will allow your...
[USN-1626-1] Glance vulnerability
========================================================================== Ubuntu Security Notice USN-1626-1 November 08, 2012 glance vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...
Cisco Nexus 1000V protection bypass
Under some conditions devices with invalid licenses and disabled protection do not display valid status...
IcedTea-Web memory corruption
No description provided...
Cross-Site Request Forgery (CSRF) in CMS Made Simple
Advisory ID: HTB23121 Product: CMS Made Simple Vendor: cmsmadesimple.org Vulnerable Versions: 1.11.2 and probably prior Tested Version: 1.11.2 Vendor Notification: October 17, 2012 Public Disclosure: November 7, 2012 Vulnerability Type: Cross-Site Request Forgery CWE-352 CVE Reference:...
Vulnerability Report on AWCM 2.2
Vulnerability Report AWCM 2.2 CVE-Candidate-ID: CVE-2012-2437, CVE-2012-2438 Issue: Access Control Bug in AWCM 2.2, Anyone can build the cookie and inserts DB records. Author: Sooel Son sonpostman at gmail dot com Source Code: http://sourceforge.net/projects/awcm/ 1. Details: CVE-2012-2437 Withou...
Apple QuickTime multiple security vulnerabilities
Multiple memory corruptions on different file formats and server responses parsing and in ActiveX components...
APPLE-SA-2012-11-07-1 QuickTime 7.7.3
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2012-11-07-1 QuickTime 7.7.3 QuickTime 7.7.3 is now available and addresses the following: QuickTime Available for: Windows 7, Vista, XP SP2 or later Impact: Viewing a maliciously crafted PICT file may lead to an unexpected application...
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
Glance unauthorized images deletion
Insufficient access control validation...
Cisco Secure Access Control System authentication bypass
Insufficient password check if TACACS+ authentication is used with LDAP...
[USN-1625-1] Icedtea-Web vulnerability
========================================================================= Ubuntu Security Notice USN-1625-1 November 07, 2012 icedtea-web vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives:...
Mesa code execution
Invalid arrays handling...
[SECURITY] [DSA 2571-1] libproxy security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2571-1 [email protected] http://www.debian.org/security/ Raphael Geissert November 04, 2012 http://www.debian.org/security/faq -...
[USN-1624-1] Remote Login Service vulnerability
========================================================================== Ubuntu Security Notice USN-1624-1 November 05, 2012 remote-login-service vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its...
[USN-1623-1] Mesa vulnerability
========================================================================== Ubuntu Security Notice USN-1623-1 November 05, 2012 mesa vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...
[CVE-2012-5777]EmpireCMS Template Parser Remote PHP Code Execution Vulnerability
Exploit Title : Answer my question wordpress plugin Multiple Cross-Site Scripting Vulnerabilities Author:Marcela Benetrix home:www.girlinthemiddle.net Date: 09/19/12 version: 1.1 software link:http://wordpress.org/extend/plugins/answer-my-question/ Answer my question plugin description This plugi...
[USN-1622-1] Munin vulnerabilities
========================================================================== Ubuntu Security Notice USN-1622-1 November 05, 2012 munin vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...
XSS in answer my question plugin
Exploit Title : Answer my question wordpress plugin Multiple Cross-Site Scripting Vulnerabilities Author:Marcela Benetrix home:www.girlinthemiddle.net Date: 09/19/12 version: 1.1 software link:http://wordpress.org/extend/plugins/answer-my-question/ Answer my question plugin description This plugi...
PR11-07 Multiple peristent XSS, XSS, XSRF, offsite redirection and information disclosure flaws within CheckPoint/Sofaware firewalls
ProCheckUp Research http://procheckup.com/procheckup-labs/pr11-07.aspx PR11-07 Multiple peristent XSS, XSS, XSRF, offsite redirection and information disclosure flaws within CheckPoint/Sofaware firewalls Vulnerability found: 3rd May 2011 Vendor informed: 20th July 2011 Vulnerability fixed: 16th...
multiple critical vulnerabilities in sophos products
List, I've completed the second paper in my series analyzing Sophos Antivirus internals, titled "Practical Attacks against Sophos Antivirus". As the name suggests, this paper describes realistic attacks against networks using Sophos products. The paper includes a working pre-authentication remote...
Ubuntu Remote Login Services information leakage
Context information is purged insufficiently on user account switching...
Munin security vulnerabilities
Symbolic links vulnerability, code execution...
AwAuctionScript (Aw Auction Script - Market Place for WebMasters) Multiple Vulnerabilities
========================================================================================== AwAuctionScript Aw Auction Script - Market Place for WebMasters Multiple Vulnerabilities ==========================================================================================...