Certificate trust vulnerability in Websense Content Gateway

SUMMARY Websense Content Gateway proxy explicitly trusts compromised certificate authorities Affected versions: Content Gateway 7.8.x Not affected: Content Gateway 7.7.x, 8.0 DESCRIPTION Websense Content Gateway is a filtering web proxy and content inspection application based on a modified...

Sidu 5.2 Admin XSS Vulnerability

Affected Vendor: www.topnew.net/sidu/ Credits: John Page hyp3rlinx Domains: hyp3rlinx.altervista.org Source: http://hyp3rlinx.altervista.org/advisories/AS-SIDU0513.txt Product: Sidu version 5.2 is a web based database front-end administration tool. Advisory Information:...

Pure Faction game server buffer overflow

Buffer overflow via game chat...

Websense Content Gateway certificates check vulnereability

Compromised certificates are incorrectly checked...

Apache Tomcat security vulnerabilities

Resources exhaustion, restrictions bypass...

Cisco Telepresence security vulnerabilities

Code execution, authentication bypass, DoS...

Server buffer overflow in Pure Faction <= 3.0c

Application: Pure Faction http://www.purefaction.org Versions: = 3.0c Platforms: Windows Bug: server buffer overflow Risk: highly critical Exploitation: remote and automatic requires attacker to have joined server Date: 13 Mar 2015 Author: soulsgetnothing e-mail: soulsgetnothing at hotmail dot co...

Web India Solutions CMS 2015 - SQL Injection Vulnerability

Document Title: =============== Web India Solutions CMS 2015 - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1495 Release Date: ============= 2015-05-13 Vulnerability Laboratory ID VL-ID: ====================================...

SAP applications buffer overflow

Buffer overflow in LZC/LZH implementation...

Concrete5 Security Advisory - Multiple XSS Vulnerabilities - CVE-2015-2250

Information -------------------- Advisory by Netsparker. Name: Multiple XSS Vulnerabilities in Concrete5 Affected Software : Concrete5 Affected Versions: 5.7.3.1 and possibly below Vendor Homepage : https://www.concrete5.org Vulnerability Type : Cross-site Scripting Severity : Important CVE-ID:...

[USN-2608-1] QEMU vulnerabilities

========================================================================== Ubuntu Security Notice USN-2608-1 May 13, 2015 qemu, qemu-kvm vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives...

[SECURITY] CVE-2014-7810: Apache Tomcat Security Manager Bypass

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 CVE-2014-7810 Security Manager Bypass Severity: Moderate Vendor: The Apache Software Foundation Versions Affected: - - Apache Tomcat 8.0.0-RC1 to 8.0.15 - - Apache Tomcat 7.0.0 to 7.0.57 - - Apache Tomcat 6.0.0 to 6.0.43 Description: Malicious web...

[CORE-2015-0009] - SAP LZC/LZH Compression Multiple Vulnerabilities

Advisory Information Title: SAP LZC/LZH Compression Multiple Vulnerabilities Advisory ID: CORE-2015-0009 Advisory URL: http://www.coresecurity.com/advisories/sap-lzc-lzh-compression-multiple-vulnerabilities Date published: 2015-05-12 Date of last update: 2015-05-12 Vendors contacted: SAP Release...

Microsoft SharePoint Server code execution

Code execution via document content...

Adobe Reader / Acrobat multiple security vulnerabilities

Memory corruptions, buffer overlfows, restrictions bypass, DoS...

Microsoft Windows multiple security vulnerabilities

Buffer overflow, memory corruption, code execution, privilege escalation, restrictions bupass, DoS, information disclosure...

Mozilla Firefox / Thunderbird / Seamonkey multiple security vulnerabilities

Multiple buffer overflows, memory corruptions, information disclosures, restriction bypass...

Adobe Flash Player multiple security vulnerabilities

Buffer overflows, memory corruptions, integer overflows, race conditions, restriction bypass...

Microsoft Office memory corruptions

Memory corruptions on documents parsing...

EMC Documentum xCelerated Management System information disclosure

Service password is stored in .bat file...

[ MDVSA-2015:087 ] egroupware

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:087 http://www.mandriva.com/en/support/security/ Package : egroupware Date : March 28, 2015 Affected: Business Server 2.0 Problem Description: Updated egroupware packages fix security vulnerabilities:...

Reflected XSS Vulnerability In Manage Engine Firewall Analyzer

======================================================================== =======Reflected XSS Vulnerability In Manage Engine Firewall Analyzer ======================================================================== ======= . contents:: Table Of Content Overview ======== Title : Reflected XSS...

Encaps PHP/Flash Gallery 2.3.22s Database Puffing Up Exploit

Hi guys, ref: http://www.milw00rm.com/exploits/5179 !/usr/bin/perl -w Title : Encaps PHP/Flash Gallery 2.3.22s Database Puffing Up Exploit Vendor : http://www.encaps.net Download : http://sourceforge.net/projects/encapsnet/files/ Author : ZoRLu / [email protected] Website : milw00rm.com /...

Lychee 2.7.1 remote code execution

Advisory ID: SGMA15-002 Title: Lychee remote code execution Product: Lychee Version: 2.7.1 and probably prior Vendor: lychee.electerious.com Vulnerability type: Remote Code Execution Risk level: High Credit: Filippo Cavallarin - segment.technology CVE: N/A Vendor notification: 2015-04-12 Vendor...

Fortinet FortiAnalyzer & FortiManager - Client Side Cross Site Scripting Vulnerability

Document Title: =============== Fortinet FortiAnalyzer & FortiManager - Client Side Cross Site Scripting Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1354 Security Bulletin FortiGuard: http://www.fortiguard.com/advisory/FG-IR-15-005/ PSI...

[USN-2607-1] Module::Signature vulnerabilities

========================================================================== Ubuntu Security Notice USN-2607-1 May 12, 2015 libmodule-signature-perl vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its...

[SECURITY] [DSA 3227-1] movabletype-opensource security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3227-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso April 15, 2015 http://www.debian.org/security/faq -...

NetworkManager directory traversal

File access on modem device handling...

Novell ZenWorks Configuration Management code execution

Code execution via web interface...

GoAutoDial 3.3 multiple vulnerabilities

Affected software: GoAutoDial Affected version: 3.3-1406088000 GoAdmin and previous releases of GoAutodial 3.3 Associated CVEs: CVE-2015-2842, CVE-2015-2843, CVE-2015-2844, CVE-2015-2845 Vendor advisory: http://goautodial.org/news/21 Abstract: Multiple vulnerabilties exist in the GoAutodial 3.3...

ESA-2015-044: EMC Documentum xMS Sensitive Information Disclosure Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2015-044: EMC Documentum xMS Sensitive Information Disclosure Vulnerability EMC Identifier: ESA-2015-044 CVE Identifier: CVE-2015-0527 Severity Rating: CVSS v2 Base Score: 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C Affected products: • EMC Documentum xCelerat...

Reflected Cross-Site Scripting vulnerability in asdoc generated documentation

------------------------------------------------------------------------ Reflected Cross-Site Scripting vulnerability in asdoc generated documentation ------------------------------------------------------------------------ Radjnies Bhansingh, March 2014...

[SECURITY] [DSA 3258-1] quassel security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3258-1 [email protected] http://www.debian.org/security/ Alessandro Ghedini May 12, 2015 http://www.debian.org/security/faq -...

Reflected Cross-Site Scripting vulnerability in asdoc generated documentation

------------------------------------------------------------------------ Reflected Cross-Site Scripting vulnerability in asdoc generated documentation ------------------------------------------------------------------------ Radjnies Bhansingh, March 2014...

WSO2 Identity Server multiple vulnerabilities

Hi, WSO2 Identity Server http://wso2.com/products/identity-server/ version 4.5.0/4.6.0/5.0.0 is prone to multiple vulnerabilities, including authentication bypass. Timeline: 09.10.2014 - Vendor notified 22.11.2014 - Vendor confirmed 04.12.2014 - Patches released 25.03.2015 - Bugtraq disclosure...

Advisory: CVE-2014-9707: GoAhead Web Server 3.0.0 - 3.4.1

Affected software: GoAhead Web Server Affected versions: 3.0.0 - 3.4.1 3.x.x series before 3.4.2 CVE ID: CVE-2014-9707 Description: The server incorrectly normalizes HTTP request URIs that contain path segments that start with a "." but are not entirely equal to "." or ".." eg. ".x". By sending a...

[ MDVSA-2015:200 ] mediawiki

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:200 http://www.mandriva.com/en/support/security/ Package : mediawiki Date : April 10, 2015 Affected: Business Server 1.0 Problem Description: Updated mediawiki packages fix security vulnerabilities: In...

HotExBilling Manager Cross-site scripting (XSS) vulnerability

Title: ==== HotExBilling Manager – Cross-site scripting XSS vulnerability Credit: ====== Name: Bhadresh Patel Company/affiliation: HelpAG Website: www.helpag.com CVE: ===== CVE-2015-2781 Date: ==== 12-03-2015 dd/mm/yyyy Vendor: ====== Hotspot Express has been in the billing solution business sinc...

[ MDVSA-2015:181 ] drupal

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:181 http://www.mandriva.com/en/support/security/ Package : drupal Date : March 30, 2015 Affected: Business Server 1.0 Problem Description: Updated drupal packages fix security vulnerabilities: An information...

[SECURITY] [DSA 3257-1] mercurial security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3257-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso May 11, 2015 http://www.debian.org/security/faq -...

[USN-2558-1] Mailman vulnerability

========================================================================== Ubuntu Security Notice USN-2558-1 April 07, 2015 mailman vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

Avsarsoft Matbaa Script - Multiple Vulnerabilities

Title : Avsarsoft Matbaa Script - Multiple Vulnerabilities Author : ZoRLu / [email protected] Website : milw00rm.com / milw00rm.net / milw00rm.org Twitter : https://twitter.com/milw00rm or @milw00rm Test : Windows7 Ultimate Discovery : 15/04/15 Publish : 23/04/15 Thks : exploit-db.com,...

Fortinet FortiAnalyzer and FortiManager crossite scripting

Crossite scripting in web interface...

[SECURITY] [DSA 3218-1] wesnoth-1.10 security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3218-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff April 10, 2015 http://www.debian.org/security/faq -...

Appweb web server DoS

NULL poiinter dereference on Range: header parsing...

mercurial code execution

Code injection via clone command...

[CVE-2015-0779]: Novell ZenWorks Configuration Management remote code execution

Hi, I've found a reported an unrestricted file upload vulnerability in Novell ZenWorks Configuration Management which can be abused to achieve remote code execution. The full advisory text is below, and can also be obtained from my repo 1. A Metasploit module has been submitted and should hopeful...

quassel SQL injection

SQL injection via messages...

[ MDVSA-2015:167 ] glpi

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:167 http://www.mandriva.com/en/support/security/ Package : glpi Date : March 30, 2015 Affected: Business Server 2.0 Problem Description: Updated glpi package fixes security vulnerabilities: Due to a bug in...

SEC Consult SA-20150409-0 :: Multiple XSS & XSRF vulnerabilities in Comalatech Comala Workflows

SEC Consult Vulnerability Lab Security Advisory 20150409-0 ======================================================================= title: Multiple XSS & XSRF vulnerabilities product: Comalatech Comala Workflows vulnerable version: = 4.6.1 fixed version: 4.6.2 for Confluence 5.4+ and 4.5.4 for...