APPLE-SA-2015-06-30-2 OS X Yosemite v10.10.4 and Security Update 2015-005

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2015-06-30-2 OS X Yosemite v10.10.4 and Security Update 2015-005 OS X Yosemite v10.10.4 and Security Update 2015-005 are now available and address the following: Admin Framework Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10 to...

Apple QuickTime multiple security vulnerabilities

Multiple memory corruptions on different formats handling...

IBM Domino Web Server crossite scripting

No description provided...

CollabNet Subversion Edge downloadHook local file inclusion

Vuln Title: Local file inclusion in CollabNet Subversion Edge Management Frontend via logfile "filename" parameter of the "downloadHook" action Date: 28.06.2015 Author: otr Software Link: https://www.open.collab.net/downloads/svnedge Vendor: CollabNet Version: 4.0.11 Tested on: Fedora Linux Type:...

[SECURITY] [DSA 3293-1] pyjwt security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3293-1 [email protected] https://www.debian.org/security/ Alessandro Ghedini June 20, 2015 https://www.debian.org/security/faq -...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

[oCERT-2015-008] FreeRADIUS insufficent CRL application

2015-008 FreeRADIUS insufficent CRL application Description: The FreeRADIUS server is an open source project that provides a RADIUS implementation. The FreeRADIUS server relies on OpenSSL to perform certificate validation, including Certificate Revocation List CRL checks. The FreeRADIUS usage of...

[SECURITY] [DSA 3294-1] wireshark security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3294-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff June 23, 2015 https://www.debian.org/security/faq -...

wireshark multiple security vulnerabilities

Multiple memory corruptions in different dissectors...

[ERPSCAN-15-010] SYBASE SQL Anywhere 12 and 16 - DoS

ERPSCAN Research Advisory ERPSCAN-15-010 SYBASE SQL Anywhere 12 and 16 - DoS Application: SYBASE SQL Anywhere 12 and 16 Versions Affected: SYBASE SQL Anywhere 12 and 16, probably others Vendor URL: http://SAP.com Bugs: DoS Sent: 09.12.2014 Reported: 09.12.2014 Vendor response: 10.12.2014 Date of...

SAP Afaria security vulnerabilities

DoS, authentication bypass...

[USN-2651-1] GNU patch vulnerabilities

========================================================================== Ubuntu Security Notice USN-2651-1 June 22, 2015 patch vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubun...

[ERPSCAN-15-005] SAP Mobile Platform - XXE

ERPSCAN Research Advisory ERPSCAN-15-005 SAP Mobile Platform - XXE Application: SAP Mobile Platform 2.3 Versions Affected: SAP Mobile Platform 2.3, probably others Vendor URL: http://SAP.com Bugs: XML eXternal Entity Sent: 06.11.14 Reported: 06.11.14 Vendor response: 07.11.14 Date of Public...

[ERPSCAN-15-011] SAP Mobile Platform 3.0 - XXE

ERPSCAN Research Advisory ERPSCAN-15-011 SAP Mobile Platform 3.0 - XXE Application: SAP Mobile Platform 3.0 Versions Affected: SAP Mobile Platform 3.0, probably others Vendor URL: http://SAP.com Bugs: XML eXternal Entity Sent: 29.12.2014 Reported: 29.12.2014 Vendor response: 30.12.2014 Date of...

ESA-2015-102: EMC Unisphere for VMAX Remote Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2015-102: EMC Unisphere for VMAX Remote Code Execution Vulnerability EMC Identifier: ESA-2015-102 CVE Identifier: CVE-2015-0545 Severity Rating: CVSS v2 Base Score: 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C Affected products: • EMC Unisphere for VMAX 8.0.0 ...

Cisco Virtual WSA / ESA / SMA default keys

Default ssh keys are installed...

[ERPSCAN-15-003] SAP NetWeaver Dispatcher Buffer Overflow - RCE, DoS

ERPSCAN Research Advisory ERPSCAN-15-003 SAP NetWeaver Dispatcher Buffer Overflow - RCE, DoS Application: SAP NetWeaver Dispatcher Versions Affected: SAP NetWeaver Dispatcher, probably others Vendor URL: http://SAP.com Bugs: RCE Sent: 25.08.14 Reported: 25.08.14 Vendor response: 25.08.14 Date of...

ESA-2015-109: EMC Documentum D2 Cross-Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2015-109: EMC Documentum D2 Cross-Site Scripting Vulnerability EMC Identifier: ESA-2015-109 CVE Identifier: CVE-2015-0549 Severity Rating: CVSS v2 Base Score: 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P Affected products: EMC Documentum D2 version 4.1 EMC...

[ERPSCAN-15-004] SAP NetWeaver Portal XMLValidationComponent - XXE

ERPSCAN Research Advisory ERPSCAN-15-004 SAP NetWeaver Portal XMLValidationComponent - XXE Application: SAP NetWeaver Portal 7.31 Versions Affected: SAP NetWeaver Portal 7.31, probably others Vendor URL: http://SAP.com Bugs: XML eXternal Entity Sent: 06.11.2014 Reported: 06.11.2014 Vendor respons...

[ERPSCAN-15-006] SAP NetWeaver Portal ReportXmlViewer - XXE

ERPSCAN Research Advisory ERPSCAN-15-006 SAP NetWeaver Portal ReportXmlViewer - XXE Application: SAP NetWeaver Portal 7.31 Versions Affected: SAP NetWeaver Portal 7.31, probably others Vendor URL: http://SAP.com Bugs: XXE Sent: 09.12.2014 Reported: 09.12.2014 Vendor response: 10.12.2014 Date of...

CVE-2015-4464 Insufficient Authorization Checks Request Handling Remote Authentication Bypass for Kguard Digital Video Recorders

CVEID: CVE-2015-4464 SUBJECT: Insufficient Authorization Checks Request Handling Remote Authentication Bypass for Kguard Digital Video Recorders DESCRIPTION: A deficiency in handling authentication and authorization has been found with Kguard 104/108/v2 models. While password-based authentication...

FreeRADIUS

Insufficient certificate revocations checks...

[ERPSCAN-15-009] SAP Afaria 7 XcListener - Missing authorization check

ERPSCAN Research Advisory ERPSCAN-15-009 SAP Afaria 7 XcListener - Missing authorization check Application: SAP Afaria 7 Versions Affected: SAP Afaria 7, probably others Vendor URL: http://SAP.com Bugs: Missing authorization check Sent: 09.12.2014 Reported: 09.12.2014 Vendor response: 10.12.2014...

GNU patch security vulnerabilities

DoS, directory traversal...

EMC Unisphere for VMAX code execution

JDWP access is possible...

ESA-2015-110: EMC Documentum Thumbnail Server Directory Traversal Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2015-110: EMC Documentum Thumbnail Server Directory Traversal Vulnerability EMC Identifier: ESA-2015-110 CVE Identifier: CVE-2015-0550 Severity Rating: CVSS v2 Base Score: 8.5 AV:N/AC:L/Au:N/C:C/I:N/A:P Affected products: • EMC Documentum Thumbnai...

Netgear Prosafe VPN Firewalls - Multiple vulnerabilities

About Encripto AS ================= Encripto is a Norwegian company which provides specialized services within IT-security. Our core expertise is security testing, network security monitoring and training. Encripto is committed to information security. We do research to discover trends, new...

Netgear Prosafe multiple security vulnerabilities

XSS, headers injection, SQL injection...

SAP NetWeather multiple security vulnerabilities

Information disclosure, XXE injection, code execution, DoS...

[ERPSCAN-15-007] SAP Management Console ReadProfile Parameters - Information disclosure

ERPSCAN Research Advisory ERPSCAN-15-007 SAP Management Console ReadProfile Parameters - Information disclosure Application: SAP Management Console Versions Affected: SAP NW 7.4 Management Console, probably others Vendor URL: http://SAP.com Bugs: Information disclosure Sent: 09.12.2014 Reported:...

Kguard Digital Video Recorders security vulnerabilities

Authentication bypass, commands injection, DoS...

SAP SYBASE SQL Anywhere DoS

DoS on request processing...

VCE3570: VCE Vision(TM) Intelligent Operations Cryptographic and Cleartext Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 VCE3570: VCE VisionTM Intelligent Operations Cryptographic and Cleartext Vulnerabilities CVE Identifier: CVE-2015-4056, CVE-2015-4057 Severity Rating: CVSSv2 Base Score: See below for individual scores for each CVE Affected products: VCE Vision...

p7zip deirectory trversal

Directory traversal on archive extraction...

WebdesignJiNi Cms Sql Injection Vulnerability

Sql Injection Vulnerability in WebdesignJiNi Cms in All Version @@@ @@@@@@@@@@@ @@@@@ @@@@@@@@@@ @@@ @@@@@@@ @@@ @@@@@@@@@@@ @@@ @@ @@@ @@ @@@ @@@@@@@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@@@@@@@@@ @@@ @ @@@@@@@@@@ @@@ @@@@@@ @@@ @@@@@@@@@@@ @@@ @@ @@@ @@ @@@...

[SECURITY] [DSA 3289-1] p7zip security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3289-1 [email protected] https://www.debian.org/security/ Ben Hutchings June 15, 2015 https://www.debian.org/security/faq -...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

ESA-2015-106: EMC Unified Infrastructure Manager/Provisioning (UIM/P) Authentication Bypass Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2015-106: EMC Unified Infrastructure Manager/Provisioning UIM/P Authentication Bypass Vulnerability EMC Identifier: ESA-2015-106 CVE Identifier: CVE-2015-0546 Severity Rating: CVSS v2 Base Score: 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C Affected products: ...

My Wifi Router buffer overflow

Buffer overflow on user authentication...

[SECURITY] [DSA 3291-1] drupal7 security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3291-1 [email protected] https://www.debian.org/security/ Sebastien Delafond June 18, 2015 https://www.debian.org/security/faq -...

Linux kernel security vulnerabilities

DoS, privilege escalations...

EMC Unified Infrastructure Manager/Provisioning authentication bypass

Authentication bypass if LDAP authentication is used...

VCE Vision Intelligent Operations weak cryptography

Weak cyphers usage, sensitive information transmitted in cleartext...

Reflected Cross-Site Scripting (XSS) in SearchBlox

Advisory ID: HTB23256 Product: SearchBlox Vendor: SearchBlox Software, Inc. Vulnerable Versions: 8.2 and probably prior Tested Version: 8.2 Advisory Publication: April 22, 2015 without technical details Vendor Notification: April 22, 2015 Vendor Patch: May 26, 2015 Public Disclosure: June 17, 201...

[RT-SA-2015-002] SQL Injection in TYPO3 Extension Akronymmanager

Advisory: SQL Injection in TYPO3 Extension Akronymmanager An SQL injection vulnerability in the TYPO3 extension "Akronymmanager" allows authenticated attackers to inject SQL statements and thereby read data from the TYPO3 database. Details ======= Product: sbakronymmanager Affected Versions: =0.5...

OpenStack cinder privilege escalation

Authorized user can access any files...

wpa_supplicant multiple security vulnerabilities

Buffer overflows, DoS vulnerabilities...

[USN-2650-1] wpa_supplicant and hostapd vulnerabilities

========================================================================== Ubuntu Security Notice USN-2650-1 June 16, 2015 wpa, wpasupplicant vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its...

BlackCat CMS v1.1.1 Arbitrary File Download Vulnerability

Exploit Title: BlackCat CMS v1.1.1 Arbitrary File Download Vulnerability Date: 2015/06/16 Vendor Homepage: http://blackcat-cms.org/ Software Link: http://blackcat-cms.org/temp/packetyzer/blackcatcms2fo3PXdKj1.zip Version: v1.1.1 Tested on: Centos 6.5,PHP 5.4.41 Category: webapps Description...

[SECURITY] [DSA 3292-1] cinder security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3292-1 [email protected] https://www.debian.org/security/ Sebastien Delafond June 19, 2015 https://www.debian.org/security/faq -...