47153 matches found
VMWare Tools privilege escalation
It's possible to execute code via DLL hijacking...
[SECURITY] [DSA 2539-1] zabbix security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2539-1 [email protected] http://www.debian.org/security/ Raphael Geissert September 06, 2012 http://www.debian.org/security/faq -...
Ektron CMS - Multiple Vulnerabilities - Security Advisory - SOS-12-009
Sense of Security - Security Advisory - SOS-12-009 Release Date. 05-Sep-2012 Last Update. - Vendor Notification Date. 07-May-2012 Product. Ektron CMS Platform. ASP.NET Affected versions. Ektron CMS version 8.5.0 and possibly others Severity Rating. High Impact. Exposure of sensitive information...
eFront Educational v3.6.11 - Multiple Web Vulnerabilities
Title: ====== eFront Educational v3.6.11 - Multiple Web Vulnerabilities Date: ===== 2012-08-03 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=666 VL-ID: ===== 666 Common Vulnerability Scoring System: ==================================== 3.5 Introduction: =============...
QNAP Turbo NAS privilege escalation
It's possible to manipulate files by absolute path...
QNAP Turbo NAS Multiple Path Injection
Vulnerability: Multiple Path Injection Product: QNAP Turbo NAS Vendor: QNAP Version affected: = 3.7.3 build 20120801 Status: Unpatched Website: http://web.qnap.com/prodetailfeature.asp?pid=202 Discovered by: Andrea Fabrizi Email: [email protected] Web: http://www.andreafabrizi.it This...
eFront Enterprise v3.6.11 - Multiple Web Vulnerabilities
Title: ====== eFront Enterprise v3.6.11 - Multiple Web Vulnerabilities Date: ===== 2012-08-06 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=668 VL-ID: ===== 668 Common Vulnerability Scoring System: ==================================== 3.5 Introduction: =============...
[security bulletin] HPSBMU02811 SSRT100937 rev.1 - HP Business Availability Center (BAC) Cross Site Scripting (XSS), Cross Site Request Forgery (CSRF), and Web Session Hijacking
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03475750 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03475750 Version: 1 HPSBMU02811...
Group-Office Calendar SQL Injection
/------------------------------------- | Group-Office Calendar SQL Injection | -------------------------------------/ Summary ======= Versions of Group-Office a web app for online collaboration prior to 4.0.90 are subject to a SQL injection vulnerability located in the calendar module. A PHP file...
HP Business Availability Center security vulnerabilities
Crossite scripting, requests spoofing, sessions hijacking...
VMWare Tools susceptible to binary planting by hijack
Security Advisory - VMWare Tools susceptible to binary planting by hijack ========================================================================= Summary : VMWare Tools susceptible to binary planting Date : 4 September 2012 Affected versions : Product versions prior to - Workstation 8.0.4 Playe...
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
[CVE-2012-3373] Apache Wicket XSS vulnerability via manipulated URL parameter
Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Wicket 1.4.x and 1.5.x Description: https://wicket.apache.org/2012/09/06/cve-2012-3373.html It is possible to inject JavaScript statements into an ajax link by adding an encoded null byte to a URL pointing to a...
Group-Office Calendar SQL Injection
Title: ====== eFront Educational v3.6.11 - Multiple Web Vulnerabilities Date: ===== 2012-08-03 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=666 VL-ID: ===== 666 Common Vulnerability Scoring System: ==================================== 3.5 Introduction: =============...
Cross-Site Scripting (XSS) in Kayako Fusion
Advisory ID: HTB23095 Product: Kayako Fusion Vendor: Kayako Vulnerable Versions: 4.40.1148 and probably prior Tested Version: 4.40.1148 Vendor Notification: June 6, 2012 Public Disclosure: September 5, 2012 Vulnerability Type: Cross-Site Scripting CWE-79 CVE Reference: CVE-2012-3233 CVSSv2 Base...
Cross-Site Scripting (XSS) Vulnerabilities in Flogr
Advisory ID: HTB23110 Product: Flogr Vendor: Flogr Vulnerable Versions: 2.5.6 and probably prior Tested Version: 2.5.6 Vendor Notification: August 15, 2012 Public Disclosure: September 5, 2012 Vulnerability Type: Cross-Site Scripting CWE-79 CVE Reference: CVE-2012-4336 CVSSv2 Base Score: 4.3...
[SECURITY] [DSA 2538-1] moin security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2538-1 [email protected] http://www.debian.org/security/ Raphael Geissert September 05, 2012 http://www.debian.org/security/faq -...
Admidio 2.3.5 Multiple security vulnerabilities
Advisory: Admidio 2.3.5 Multiple security vulnerabilities Advisory ID: SSCHADV2012-019 Author: Stefan Schurtz Affected Software: Successfully tested on Admidio 2.3.5 Vendor URL: http://www.admidio.org/ Vendor Status: fixed ========================== Vulnerability Description...
Сross-Site Request Forgery (CSRF) in TestLink
Advisory ID: HTB23088 Product: TestLink Vendor: teamst.org Vulnerable Versions: 1.9.3 and probably prior Tested Version: 1.9.3 Vendor Notification: April 18, 2012 Public Disclosure: September 5, 2012 Vulnerability Type: Cross-Site Request Forgery CWE-352 CVE Reference: CVE-2012-2275 CVSSv2 Base...
Secunia Research: Adobe Photoshop TIFF SGI24LogLum Decompression Buffer Overflow
====================================================================== Secunia Research 03/09/2012 - Adobe Photoshop TIFF SGI24LogLum Decompression Buffer Overflow - ====================================================================== Table of Contents Affected...
Adobe Photoshop buffer overflow
Buffer overflow on TIFF parsing...
[slackware-security] glibc (SSA:2012-244-01)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 slackware-security glibc SSA:2012-244-01 New glibc packages are available for Slackware 13.1, 13.37, and -current to fix security issues. Here are the details from the Slackware 13.37 ChangeLog: +--------------------------+...
GNU libc buffer overflow
Buffer overflow in strtod, strtof, strtold, and strtodl string functions...
MAPower / Sitecom / Conceptronic storage devices directory traversal
Directory traversal via web interface...
Security Advisory AA-003: Directory Traversal Vulnerability in Conceptronic GrabnGo Network Storage
Security Advisory AA-003: Directory Traversal Vulnerability in Conceptronic Grab’n’Go Network Storage Severity Rating: High Discovery Date: July 29, 2012 Vendor Notification: July 30, 2012 Disclosure Date: September 3, 2012 Vulnerability Type= Directory Traversal Impact= - System Access - Exposur...
Security Advisory AA-004: Directory Traversal Vulnerability in Sitecom Home Storage Center
Security Advisory AA-004: Directory Traversal Vulnerability in Sitecom Home Storage Center Severity Rating: High Discovery Date: July 29, 2012 Vendor Notification: July 30, 2012 Disclosure Date: September 3, 2012 Vulnerability Type= Directory Traversal Impact= - System Access - Exposure of...
Barracuda SSL VPN crossite scripting
Multiple crossite scripting conditions...
Cross-Site Scripting (XSS) in Jease
Advisory ID: HTB23104 Product: Jease Vendor: jease.org Vulnerable Versions: 2.8 and probably prior Tested Version: 2.8 Vendor Notification: July 25, 2012 Public Disclosure: August 15, 2012 Vulnerability Type: Cross-Site Scripting CWE-79 CVE Reference: CVE-2012-4052 CVSSv2 Base Score: 4.3...
SaltOS 3.1 Cross-Site Scripting vulnerability
Advisory: SaltOS 3.1 Cross-Site Scripting vulnerability Advisory ID: SSCHADV2012-018 Author: Stefan Schurtz Affected Software: Successfully tested on SaltOS 3.1 r4908 Vendor URL: http://www.saltos.net Vendor Status: fixed ========================== Vulnerability Description...
TCExam Edit Cross-Site Scripting
/---------------------------------- | TCExam Edit Cross-Site Scripting | ----------------------------------/ Summary ======= TCExam 11.3.007 is subject to a cross-site scripting vulnerability. A 'questionsubjectid' parameter is not sufficiently sanitised before being written to the...
Distimo Monitor 6.0 - Multiple Cross Site Vulnerabilities
Title: ====== Distimo Monitor 6.0 - Multiple Cross Site Vulnerabilities Date: ===== 2012-07-05 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=631 VL-ID: ===== 631 Common Vulnerability Scoring System: ==================================== 2 Introduction: =============...
Joomla com_fireboard - SQL Injection Vulnerability
Title: ====== Joomla comfireboard - SQL Injection Vulnerability Date: ===== 2012-07-11 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=655 VL-ID: ===== 655 Common Vulnerability Scoring System: ==================================== 7.3 Introduction: ============= Joomla i...
Secunia Research: Citrix Access Gateway Plug-in for Windows nsepacom ActiveX Control Buffer Overflow
====================================================================== Secunia Research 01/08/2012 - Citrix Access Gateway Plug-in for Windows - - "nsepacom" ActiveX Buffer Overflow Vulnerability - ====================================================================== Table of Contents Affected...
XSS Vulnerabilities in LabWiki
Information -------------------- Name : XSS Vulnerabilities in LabWiki Software : LabWiki 1.5 and possibly below. Vendor Homepage : http://www.bioinformatics.org/phplabware/labwiki/index.php Vulnerability Type : Cross-Site Scripting Severity : Critical Researcher : Canberk Bolat Advisory Referenc...
Flynax General Classifieds v4.0 CMS - Multiple Vulnerabilities
Title: ====== Flynax General Classifieds v4.0 CMS - Multiple Vulnerabilities Date: ===== 2012-07-13 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=659 VL-ID: ===== 659 Common Vulnerability Scoring System: ==================================== 8.3 Introduction:...
WordPress Plugin 'Quick Post Widget' 1.9.1 Multiple Cross-site scripting vulnerabilities
Advisory: WordPress Plugin 'Quick Post Widget' 1.9.1 Multiple Cross-site scripting vulnerabilities Advisory ID: SSCHADV2012-016 Author: Stefan Schurtz Affected Software: Successfully tested on Quick Post Widget 1.9.1 Vendor URL: http://qpw.famvanakkeren.nl/ Vendor Status: informed CVE-ID:...
apache struts2 remote code execute
this method was published at xcon2012 xcon.xfocus.net. kxlzx http://www.inbreak.net flow this and step by step: 1, down load struts2-showcase from struts.apache.org 2, run struts2-showcase. 3, open url: http://localhost:8080/struts2-showcase/skill/edit.action?skillName=SPRING-DEV 4, write skill...
XSS and SQL Injection Vulnerabilities in Jara
Information -------------------- Name : XSS and SQL Injection Vulnerabilities in Jara Software : Jara 1.6 and possibly below. Vendor Homepage : http://sourceforge.net/projects/jara/ Vulnerability Type : Cross-Site Scripting and SQL Injection Severity : Critical Researcher : Canberk Bolat Advisory...
7sepehr CMS 2012 - Multiple SQL Injection Vulnerabilities
Title: ====== 7sepehr CMS 2012 - Multiple SQL Injection Vulnerabilities Date: ===== 2012-08-12 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=679 VL-ID: ===== 680 Common Vulnerability Scoring System: ==================================== 8.3 Abstract: ========= The...
Security advisory for Bugzilla 4.3.2, 4.2.2, 4.0.7 and 3.6.10
Summary ======= Bugzilla is a Web-based bug-tracking system used by a large number of software projects. The following security issues have been discovered in Bugzilla: In HTML bugmails, an improper validation of the permissions of the addressee can lead to confidential information about bugs and...
Barracuda SSL VPN 680 - Cross Site Scripting Vulnerabilities
Title: ====== Barracuda SSL VPN 680 - Cross Site Scripting Vulnerabilities Date: ===== 2012-07-16 References: =========== http://vulnerability-lab.com/getcontent.php?id=561 Barracuda Networks Security ID: BNSEC-278 VL-ID: ===== 561 Common Vulnerability Scoring System:...
NGS00208 Patch Notification: Moodle CMS stored XSS
High risk vulnerability in Moodle CMS 20 August 2012 Daniel Compton of NCC Group has discovered a High risk vulnerability in Moodle CMS Impact: Stored XSS Versions affected: Moodle v2.2.1 An updated version of the software has been released to address these vulnerabilities:...
[USN-1552-1] OpenStack Keystone vulnerabilities
========================================================================== Ubuntu Security Notice USN-1552-1 September 03, 2012 keystone vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives...
CodeIgniter <= 2.1.1 xss_clean() Cross Site Scripting filter bypass
Affected products ============== CodeIgniter = 2.1.1 PHP framework and all CodeIgniter-based PHP applications using its built-in XSS filtering mechanism. CVE ==== CVE-2012-1915 Introduction ========== CodeIgniter http://codeigniter.com is a powerful PHP framework with a very small footprint, buil...
[ MDVSA-2012:132 ] glpi
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2012:132 http://www.mandriva.com/security/ Package : glpi Date : August 15, 2012 Affected: Enterprise Server 5.0 Problem Description: Multiple cross-site request forgery CSRF and cross-site scripting XSS flaws ha...
Social Engine v4.2.5 - Multiple Web Vulnerabilities
Title: ====== Social Engine v4.2.5 - Multiple Web Vulnerabilities Date: ===== 2012-07-31 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=672 VL-ID: ===== 672 Common Vulnerability Scoring System: ==================================== 3 Abstract: ========= A Laboratory...
TCExam Edit SQL Injection
/--------------------------- | TCExam Edit SQL Injection | ---------------------------/ Summary ======= TCExam 11.3.007 is prone to a SQL injection flaw located in tceeditanswer.php and tceeditquestion.php. These files pass a 'subjectmoduleid' parameter into a SQL statement without satisfactory...
Secunia Research: Citrix Access Gateway Plug-in for Windows nsepacom ActiveX Control Integer Overflow
====================================================================== Secunia Research 01/08/2012 - Citrix Access Gateway Plug-in for Windows - - "nsepacom" ActiveX Integer Overflow Vulnerability - ====================================================================== Table of Contents Affected...
ShopperPress v2.7 Wordpress - SQL Injection Vulnerability
Title: ====== ShopperPress v2.7 Wordpress - SQL Injection Vulnerability Date: ===== 2012-08-01 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=669 VL-ID: ===== 669 Common Vulnerability Scoring System: ==================================== 6.1 Introduction: =============...
tekno.Portal 0.1b - SQLi Vulnerability in "anket.php"
Title: tekno.Portal 0.1b - SQLi Vulnerability in "anket.php" Date: 07-25-2012 Author: Socket0x03 Alvaro J. Gene Email: [email protected] Website: www.teraexe.com Vulnerable Application: tekno.Portal Version: 0.1b File: anket.php SQL Injection:...