47153 matches found
GE Proficy Historian ActiveX code execution
KeyHelp code execution...
Novell iPrint buffer overflow
nipplib buffer overflow...
AST-2012-012: Asterisk Manager User Unauthorized Shell Access
Asterisk Project Security Advisory - AST-2012-012 Product Asterisk Summary Asterisk Manager User Unauthorized Shell Access Nature of Advisory Permission Escalation Susceptibility Remote Authenticated Sessions Severity Minor Exploits Known No Reported On July 13, 2012 Reported By Zubair Ashraf of...
ZDI-12-171 : (0Day) Hewlett-Packard Intelligent Management Center UAM sprintf Remote Code Execution Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-171 : 0Day Hewlett-Packard Intelligent Management Center UAM sprintf Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-171 August 29, 2012 - -- CVE ID: - -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C - -- Affected...
HP Application Lifecycle Management ActiveX memory ovewritting
Memory overwritting of user-controlled address in XGO.ocx...
ZDI-12-177 : (0Day) HP SiteScope SOAP Call loadFileContent Remote Code Execution Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-177 : 0Day HP SiteScope SOAP Call loadFileContent Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-177 August 29, 2012 - -- CVE ID: - -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C - -- Affected Vendors:...
ZDI-12-168 : InduSoft Thin Client ISSymbol InternationalSeparator Remote Code Execution Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-168 : InduSoft Thin Client ISSymbol InternationalSeparator Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-168 August 29, 2012 - -- CVE ID: CVE-2011-0340 - -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P - --...
squidguard DoS
Request to oversized URL causes protection to switch off...
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
Exploit Title: Mihalism Multi Host v 5.0
Exploit Title: Mihalism Multi Host v 5.0 Google Dork: intext:"powered by Mihalism Multi Host" Date: 2012/8/25 Discovered By : Explo!ter Software Link: http://www.mihalismscript.com/ Version: 5.0 Tested on: Linux Contact : Emperor-team.org Spt to : Stokke Details : ++++++++++++++++++++++++++ the...
Sistem Biwes Multiple Vulnerability`
=================================================================== Sistem Biwes Multiple Vulnerability =================================================================== Author: eidelweiss @randyarios Product / software: SISTEM BIWES Vendor Site: http://sistembiwes.com/ Product Price: RM240 /...
Wordpress fckeditor Arbitrary File Upload Vulnerability
a bug in Wordpress fckeditor that allows to us to occur a File Upload Vulnerability on a Remote machin. Exploit Title : Wordpress fckeditor Arbitrary File Upload Vulnerability Author : IrIsT.Ir Discovered By : Am!r Home : http://IrIsT.Ir/forum Software Link : http://wordpress.org Security Risk :...
[SECURITY] [DSA 2535-1] rtfm security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2535-1 [email protected] http://www.debian.org/security/ Florian Weimer August 29, 2012 http://www.debian.org/security/faq -...
ZDI-12-180 : Novell ZENWorks AdminStudio ISGrid.dll ActiveX Remote Code Execution Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-180 : Novell ZENWorks AdminStudio ISGrid.dll ActiveX Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-180 August 29, 2012 - -- CVE ID: - -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P - -- Affected Vendors: Novel...
[SE-2012-01] New security issue affecting Java SE 7 Update 7
Hello All, Yesterday, an out-of-band patch was released by Oracle 1, which among other things incorporated fixes for the issues exploited by the recent Java SE 7 attack code ClassFinder / MethodFinder bugs. One of the fixes incorporated in the released update also addressed the exploitation vecto...
ZDI-12-181 : Novell iPrint nipplib.dll client-file-name Parsing Remote Code Execution Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-181 : Novell iPrint nipplib.dll client-file-name Parsing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-181 August 29, 2012 - -- CVE ID: CVE-2011-4186 - -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C - -- Affect...
EMC ApplicationXtender unauthorized access
It's possible to upload files to affected system...
ZDI-12-176 : (0Day) HP SiteScope SOAP Call getFileInternal Remote Code Execution Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-176 : 0Day HP SiteScope SOAP Call getFileInternal Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-176 August 29, 2012 - -- CVE ID: - -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C - -- Affected Vendors:...
ZDI-12-173 : (0Day) HP SiteScope SOAP Call getSiteScopeConfiguration Remote Code Execution Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-173 : 0Day HP SiteScope SOAP Call getSiteScopeConfiguration Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-173 August 29, 2012 - -- CVE ID: - -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C - -- Affected Vendors:...
Chamilo 1.8.8.4 Multiple Vulnerabilities
Chamilo 1.8.8.4 Multiple Vulnerabilities ======================== CVE: CVE-2012-4029 Issue: Reflected XSS PHPSELF in third-party app, Stored XSS PHPSELF XSS http://chamilo-1.8.8.4/main/inc/lib/phpdocx/pdf/www/examples.php/'"img src=404 onerror=alert1 Stored XSS unfiltered input categoryname...
[SECURITY] [DSA 2537-1] typo3-src security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2537-1 [email protected] http://www.debian.org/security/ Florian Weimer August 30, 2012 http://www.debian.org/security/faq -...
SOAP и UploadFileHandler.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-178 : 0Day HP SiteScope SOAP Call update Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-178 August 29, 2012 - -- CVE ID: - -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C - -- Affected Vendors: Hewlett-Packard - ...
ZDI-12-170 : (0Day) HP Application Lifecycle Management XGO.ocx ActiveX Control Remote Code Execution Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-170 : 0Day HP Application Lifecycle Management XGO.ocx ActiveX Control Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-170 August 29, 2012 - -- CVE ID: - -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P - --...
squidGuard 1.4 - Remote Denial of Service - POC
We're using squidGuard 1.4 and discovered a possible denial of service. When a user is accessing a very long URL, a internal buffer is too small and squidguard is entering emergency mode. In this mode, no blocking is done anymore. The URL for reference:...
Security advisory for Bugzilla 4.3.3, 4.2.3, 4.0.8 and 3.6.11
Summary ======= Bugzilla is a Web-based bug-tracking system used by a large number of software projects. The following security issues have been discovered in Bugzilla: When the user logs in using LDAP, the username is not escaped before being passed to LDAP which could potentially lead to LDAP...
EMC Networker formatstring vulnerability
Format string vulnerability on RPC request parsing...
Hewlett-Packard Intelligent Management Center buffer overflow
Buffer overflow in UDP/1811 service...
ZDI-12-175 : (0Day) HP SiteScope SOAP Call create Remote Code Execution Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-175 : 0Day HP SiteScope SOAP Call create Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-175 August 29, 2012 - -- CVE ID: - -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C - -- Affected Vendors: Hewlett-Packard - ...
InduSoft Thin Client ActiveX buffer overflow
ISSymbol.ocx InternationalOrder paramter heap overflow...
[SECURITY] [DSA 2536-1] otrs2 security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2536-1 [email protected] http://www.debian.org/security/ Florian Weimer August 30, 2012 http://www.debian.org/security/faq -...
AST-2012-013: ACL rules ignored when placing outbound calls by certain IAX2 users
Asterisk Project Security Advisory - AST-2012-013 Product Asterisk Summary ACL rules ignored when placing outbound calls by certain IAX2 users Nature of Advisory Unauthorized use of system Susceptibility Remote Authenticated Sessions Severity Moderate Exploits Known None Reported On 07/27/2012...
ZDI-12-182 : EMC AppXtender WxSuperCtrl650.ocx ActiveX Control Remote Code Execution Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-182 : EMC AppXtender WxSuperCtrl650.ocx ActiveX Control Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-182 August 29, 2012 - -- CVE ID: CVE-2012-2289 - -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P - -- Affect...
SEC Consult SA-20120829-0 :: Symantec Messaging Gateway - Support Backdoor
SEC Consult Vulnerability Lab Security Advisory 20120829-0 ======================================================================= title: Support Backdoor product: Symantec Messaging Gateway vulnerable version: 9.5.x fixed version: 10.0 CVE number: CVE-2012-3579 impact: Critical homepage:...
Asterisk security vulnerabilities
Asterisk Manager code execution, IAX2 protection bypass...
[security bulletin] HPSB3C02809 SSRT100377 rev.1 - HP iNode Management Center, Remote Execution of Arbitrary Code
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03473527 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03473527 Version: 1 HPSB3C02809...
HP iNode Management Center code execution
iNodeMngChecker.exe code execution on TCP/9090 request parsing...
ESA-2012-038: EMC NetWorker Format String Vulnerability
ESA-2012-038.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2012-038: EMC NetWorker Format String Vulnerability EMC Identifier: ESA-2012-038 CVE Identifier: CVE-2012-2288 Severity Rating: 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C Affected products: EMC NetWorker 7.6.3 EMC NetWorker 7.6.4 EMC NetWorke...
CommPort 1.01 <= SQL Injection Vulnerability
-------------------------------------------- CommPort 1.01 = SQL Injection Vulnerability -------------------------------------------- Discovered by: Jean Pascal Pereira [email protected] Vendor information: "A 'Community Portal' generator that can be tailored for any location. Each user gets a...
[USN-1547-1] libGData, evolution-data-server vulnerability
========================================================================== Ubuntu Security Notice USN-1547-1 August 28, 2012 libgdata, evolution-data-server vulnerability ========================================================================== A security issue affects these releases of Ubuntu a...
HP SiteScope multiple security vulnerabilities
Multiple code execution possibilities via SOAP calls and UploadFileHandler...
Paliz CMS Full Path Disclosure Vulnerability
Title: Paliz CMS Full Path Disclosure Vulnerability Vulnerable Version: all versions Vendor URL: http://palizct.com Impact: Low =========================== Vulnerability Description: =========================== Full Path Disclosure Vulnerability, enable the attacker to see the root path...
libgdata certificate spoofing
Certificate is not validated allowing man-in-the-middle attack...
Novell ZENWorks AdminStudio ActiveX memory corruption
ISGrid.dll memory corruption...
Java environment limitations bypass
There are few ways to bypass limitations and execute privileged code from the applet...
ZDI-12-172 : (0Day) HP Operations Orchestration RSScheduler Service JDBC Connector Remote Code Execution Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-172 : 0Day HP Operations Orchestration RSScheduler Service JDBC Connector Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-172 August 29, 2012 - -- CVE ID: - -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C - --...
HP Operations Orchestration SQL injection
SQL injection in TCP/9001 RSScheduler service...
OpenOffice security vulnerabilities
Multiple buffer overflows...
CVE-2012-2665 Manifest-processing errors in Apache OpenOffice 3.4.0
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 CVE-2012-2665 Manifest-processing errors in Apache OpenOffice 3.4.0 Reference: http://www.openoffice.org/security/cves/CVE-2012-2665.html Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache OpenOffice 3.4.0, all...
EMC Cloud Tiering Appliance authentication bypass
Authentication bypass is possible...
[SE-2012-01] information regarding recently discovered Java 7 attack
Hello All, This post is made in reference to recently discovered attack against Java SE 7 platform 12. We discovered that the vulnerabilities used by the attack code are similar to some of the weaknesses that we have found as part of our SE-2012-01 Java SE security research project 3. The recentl...