Apache Tomcat security vulnerabilities

Resources exhaustion, restrictions bypass...

[CORE-2015-0009] - SAP LZC/LZH Compression Multiple Vulnerabilities

Advisory Information Title: SAP LZC/LZH Compression Multiple Vulnerabilities Advisory ID: CORE-2015-0009 Advisory URL: http://www.coresecurity.com/advisories/sap-lzc-lzh-compression-multiple-vulnerabilities Date published: 2015-05-12 Date of last update: 2015-05-12 Vendors contacted: SAP Release...

Concrete5 Security Advisory - Multiple XSS Vulnerabilities - CVE-2015-2250

Information -------------------- Advisory by Netsparker. Name: Multiple XSS Vulnerabilities in Concrete5 Affected Software : Concrete5 Affected Versions: 5.7.3.1 and possibly below Vendor Homepage : https://www.concrete5.org Vulnerability Type : Cross-site Scripting Severity : Important CVE-ID:...

[USN-2608-1] QEMU vulnerabilities

========================================================================== Ubuntu Security Notice USN-2608-1 May 13, 2015 qemu, qemu-kvm vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives...

Cisco Telepresence security vulnerabilities

Code execution, authentication bypass, DoS...

[SECURITY] CVE-2014-7810: Apache Tomcat Security Manager Bypass

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 CVE-2014-7810 Security Manager Bypass Severity: Moderate Vendor: The Apache Software Foundation Versions Affected: - - Apache Tomcat 8.0.0-RC1 to 8.0.15 - - Apache Tomcat 7.0.0 to 7.0.57 - - Apache Tomcat 6.0.0 to 6.0.43 Description: Malicious web...

Web India Solutions CMS 2015 - SQL Injection Vulnerability

Document Title: =============== Web India Solutions CMS 2015 - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1495 Release Date: ============= 2015-05-13 Vulnerability Laboratory ID VL-ID: ====================================...

libvirt / qemu security vulnerabilities

Crash on PCI registers, IDE controller and Physical Region Descriptor Table decoder. Code execution...

Websense Content Gateway certificates check vulnereability

Compromised certificates are incorrectly checked...

Sidu 5.2 Admin XSS Vulnerability

Affected Vendor: www.topnew.net/sidu/ Credits: John Page hyp3rlinx Domains: hyp3rlinx.altervista.org Source: http://hyp3rlinx.altervista.org/advisories/AS-SIDU0513.txt Product: Sidu version 5.2 is a web based database front-end administration tool. Advisory Information:...

SAP applications buffer overflow

Buffer overflow in LZC/LZH implementation...

Pure Faction game server buffer overflow

Buffer overflow via game chat...

Certificate trust vulnerability in Websense Content Gateway

SUMMARY Websense Content Gateway proxy explicitly trusts compromised certificate authorities Affected versions: Content Gateway 7.8.x Not affected: Content Gateway 7.7.x, 8.0 DESCRIPTION Websense Content Gateway is a filtering web proxy and content inspection application based on a modified...

Adobe Flash Player multiple security vulnerabilities

Buffer overflows, memory corruptions, integer overflows, race conditions, restriction bypass...

Mozilla Firefox / Thunderbird / Seamonkey multiple security vulnerabilities

Multiple buffer overflows, memory corruptions, information disclosures, restriction bypass...

Adobe Reader / Acrobat multiple security vulnerabilities

Memory corruptions, buffer overlfows, restrictions bypass, DoS...

Microsoft Windows multiple security vulnerabilities

Buffer overflow, memory corruption, code execution, privilege escalation, restrictions bupass, DoS, information disclosure...

Microsoft SharePoint Server code execution

Code execution via document content...

Microsoft Office memory corruptions

Memory corruptions on documents parsing...

EMC Documentum xCelerated Management System information disclosure

Service password is stored in .bat file...

quassel SQL injection

SQL injection via messages...

GoAutoDial 3.3 multiple vulnerabilities

Affected software: GoAutoDial Affected version: 3.3-1406088000 GoAdmin and previous releases of GoAutodial 3.3 Associated CVEs: CVE-2015-2842, CVE-2015-2843, CVE-2015-2844, CVE-2015-2845 Vendor advisory: http://goautodial.org/news/21 Abstract: Multiple vulnerabilties exist in the GoAutodial 3.3...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

[SECURITY ANNOUNCEMENT] CVE-2015-0225

CVE-2015-0225: Apache Cassandra remote execution of arbitrary code Severity: Important Vendor: The Apache Software Foundation Versions Affected: Cassandra 1.2.0 to 1.2.19 Cassandra 2.0.0 to 2.0.13 Cassandra 2.1.0 to 2.1.3 Description: Under its default configuration, Cassandra binds an...

[USN-2607-1] Module::Signature vulnerabilities

========================================================================== Ubuntu Security Notice USN-2607-1 May 12, 2015 libmodule-signature-perl vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its...

EMC Isilon OneFS privilege escalation

Local files access...

ESA-2015-049: EMC Isilon OneFS Privilege Escalation Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2015-049: EMC Isilon OneFS Privilege Escalation Vulnerability EMC Identifier: ESA-2015-049 CVE Identifier: CVE-2015-0528 Severity Rating: CVSS v2 Base Score: 6.8 AV:L/AC:L/Au:S/C:C/I:C/A:C Affected products: • EMC Isilon OneFS 7.2.0.0 • EMC Isilon...

[CVE-2015-2926] XSS vuln in phpTrafficA

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Product: phpTrafficA Product page: http://soft.zoneo.net/phpTrafficA/ Affected versions: Up to and including 2.3 latest as of writing. Description: The user agent string provided by the browser is not sanitized nor escaped when handled. This string ...

[ MDVSA-2015:181 ] drupal

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:181 http://www.mandriva.com/en/support/security/ Package : drupal Date : March 30, 2015 Affected: Business Server 1.0 Problem Description: Updated drupal packages fix security vulnerabilities: An information...

Avsarsoft Matbaa Script - Multiple Vulnerabilities

Title : Avsarsoft Matbaa Script - Multiple Vulnerabilities Author : ZoRLu / [email protected] Website : milw00rm.com / milw00rm.net / milw00rm.org Twitter : https://twitter.com/milw00rm or @milw00rm Test : Windows7 Ultimate Discovery : 15/04/15 Publish : 23/04/15 Thks : exploit-db.com,...

Battle of Wesnoth directory traversal

Directory traversal on maps loading...

Advisory: CVE-2014-9707: GoAhead Web Server 3.0.0 - 3.4.1

Affected software: GoAhead Web Server Affected versions: 3.0.0 - 3.4.1 3.x.x series before 3.4.2 CVE ID: CVE-2014-9707 Description: The server incorrectly normalizes HTTP request URIs that contain path segments that start with a "." but are not entirely equal to "." or ".." eg. ".x". By sending a...

Palo Alto Traps Server XSS

Stored XSS in logs...

[SECURITY] [DSA 3230-1] django-markupfield security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3230-1 [email protected] http://www.debian.org/security/ Alessandro Ghedini April 20, 2015 http://www.debian.org/security/faq -...

Reflected XSS Vulnerability In Manage Engine Firewall Analyzer

======================================================================== =======Reflected XSS Vulnerability In Manage Engine Firewall Analyzer ======================================================================== ======= . contents:: Table Of Content Overview ======== Title : Reflected XSS...

NetworkManager directory traversal

File access on modem device handling...

Reflected Cross-Site Scripting vulnerability in asdoc generated documentation

------------------------------------------------------------------------ Reflected Cross-Site Scripting vulnerability in asdoc generated documentation ------------------------------------------------------------------------ Radjnies Bhansingh, March 2014...

ESA-2015-044: EMC Documentum xMS Sensitive Information Disclosure Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2015-044: EMC Documentum xMS Sensitive Information Disclosure Vulnerability EMC Identifier: ESA-2015-044 CVE Identifier: CVE-2015-0527 Severity Rating: CVSS v2 Base Score: 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C Affected products: • EMC Documentum xCelerat...

Fortinet FortiAnalyzer and FortiManager crossite scripting

Crossite scripting in web interface...

[CVE-2014-5361][CVE-2014-5362]Landesk Management Suite RFI & CSRF Security Vulnerabilities

Exploit Title: Landesk Management Suite RFI and CSRF vulnerabilities Product: Landesk Management Suite Vulnerable Versions: 9.5 and possible previous versions, 9.6 Tested Version: 9.5 Advisory Publication: 16/04/2015 Latest Update: 16/04/2015 Vulnerability Type: Cross-site request forgery CWE-352...

Fortinet FortiAnalyzer & FortiManager - Client Side Cross Site Scripting Vulnerability

Document Title: =============== Fortinet FortiAnalyzer & FortiManager - Client Side Cross Site Scripting Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1354 Security Bulletin FortiGuard: http://www.fortiguard.com/advisory/FG-IR-15-005/ PSI...

CVE-2015-2223: Palo Alto Traps Server Stored XSS

------------------------------------------------------------------------ Product: Palo Alto Traps Server formerly Cyvera Endpoint Protection Vendor: Palo Alto Networks Vulnerable Versions: 3.1.2.1546 Tested Version: 3.1.2.1546 Advisory Publication: 29 March 2015 Vendor Notification: 17 October 20...

[ MDVSA-2015:087 ] egroupware

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:087 http://www.mandriva.com/en/support/security/ Package : egroupware Date : March 28, 2015 Affected: Business Server 2.0 Problem Description: Updated egroupware packages fix security vulnerabilities:...

HotExBilling Manager Cross-site scripting (XSS) vulnerability

Title: ==== HotExBilling Manager – Cross-site scripting XSS vulnerability Credit: ====== Name: Bhadresh Patel Company/affiliation: HelpAG Website: www.helpag.com CVE: ===== CVE-2015-2781 Date: ==== 12-03-2015 dd/mm/yyyy Vendor: ====== Hotspot Express has been in the billing solution business sinc...

perl-Module-Signature content spoofing

Unsigned content can be interpreted as a signed...

Advisory: CVE-2014-9708: Appweb Web Server

Affected software: Appweb Web Server CVE ID: CVE-2014-9708 Description: An HTTP request with a Range header of the form "Range: x=," ie. with an empty range value will cause a null pointer dereference, leading to a remotely-triggerable DoS. Fixed versions: 4.6.6, 5.2.1 Bug entry:...

[ MDVSA-2015:200 ] mediawiki

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:200 http://www.mandriva.com/en/support/security/ Package : mediawiki Date : April 10, 2015 Affected: Business Server 1.0 Problem Description: Updated mediawiki packages fix security vulnerabilities: In...

GoAhead Web Server security vulnerabilities

Directory traversal, buffer overflow...

[USN-2581-1] NetworkManager vulnerability

========================================================================== Ubuntu Security Notice USN-2581-1 April 28, 2015 network-manager vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivative...

Multiple Cross-Site Scripting (XSS) in FreePBX

Advisory ID: HTB23253 Product: FreePBX Vendor: Sangoma Technologies Vulnerable Versions: 12.0.43 and probably prior Tested Version: 12.0.43 Advisory Publication: March 18, 2015 without technical details Vendor Notification: March 18, 2015 Vendor Patch: March 27, 2015 Public Disclosure: April 22,...