47153 matches found
Open-Xchange Security Advisory 2015-04-27
Product: Open-Xchange Server 6 / OX AppSuite Vendor: Open-Xchange GmbH Internal reference: 35982 Bug ID Vulnerability type: Cross-Site Scripting CWE-80 Vulnerable version: 7.6.1 Vulnerable component: backend Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 7.6.1-rev21...
GoAhead Web Server security vulnerabilities
Directory traversal, buffer overflow...
Battle of Wesnoth directory traversal
Directory traversal on maps loading...
Wolf CMS 0.8.2 Arbitrary File Upload Vulnerability
,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground Hacking Team .. +---------------------------^----------| ,-------, | / XXXXXX /| / / XXXXXX / / / XXXXXX / / XXXXXX / / XXXXXX / ------' Exploit Title : Wolf CMS Arbitrary File Upload Exploit Date : 16 April 20...
[USN-2581-1] NetworkManager vulnerability
========================================================================== Ubuntu Security Notice USN-2581-1 April 28, 2015 network-manager vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivative...
Manage Engine Desktop Central 9 - CVE-2015-2560 - Unauthorised administrative password reset
A vulnerability exists in the Manage Engine Desktop Central 9 application that affects version build 90130. This may affect earlier releases as well. The vulnerability allows a remote unauthenticated user to change the password of any Manage Engine Desktop Central user with the ‘Administrator’ ro...
Advisory: CVE-2014-9708: Appweb Web Server
Affected software: Appweb Web Server CVE ID: CVE-2014-9708 Description: An HTTP request with a Range header of the form "Range: x=," ie. with an empty range value will cause a null pointer dereference, leading to a remotely-triggerable DoS. Fixed versions: 4.6.6, 5.2.1 Bug entry:...
ESA-2015-049: EMC Isilon OneFS Privilege Escalation Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2015-049: EMC Isilon OneFS Privilege Escalation Vulnerability EMC Identifier: ESA-2015-049 CVE Identifier: CVE-2015-0528 Severity Rating: CVSS v2 Base Score: 6.8 AV:L/AC:L/Au:S/C:C/I:C/A:C Affected products: • EMC Isilon OneFS 7.2.0.0 • EMC Isilon...
[ MDVSA-2015:097 ] php-ZendFramework
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:097 http://www.mandriva.com/en/support/security/ Package : php-ZendFramework Date : March 28, 2015 Affected: Business Server 2.0 Problem Description: Updated php-ZendFramework packages fix multiple...
[CVE-2015-0779]: Novell ZenWorks Configuration Management remote code execution
Hi, I've found a reported an unrestricted file upload vulnerability in Novell ZenWorks Configuration Management which can be abused to achieve remote code execution. The full advisory text is below, and can also be obtained from my repo 1. A Metasploit module has been submitted and should hopeful...
[SECURITY] [DSA 3257-1] mercurial security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3257-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso May 11, 2015 http://www.debian.org/security/faq -...
Open-Xchange crossite scripting
Crossite scripting via attachment...
[ MDVSA-2015:185 ] dokuwiki
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:185 http://www.mandriva.com/en/support/security/ Package : dokuwiki Date : March 31, 2015 Affected: Business Server 1.0 Problem Description: Updated dokuwiki packages fix security vulnerabilities:...
[SECURITY] [DSA 3230-1] django-markupfield security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3230-1 [email protected] http://www.debian.org/security/ Alessandro Ghedini April 20, 2015 http://www.debian.org/security/faq -...
[ MDVSA-2015:186 ] phpmyadmin
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:186 http://www.mandriva.com/en/support/security/ Package : phpmyadmin Date : March 31, 2015 Affected: Business Server 1.0 Problem Description: A vulnerability has been discovered and corrected in phpmyadmin:...
Google Analytics by Yoast stored XSS #2
OVERVIEW ========== Google Analytics by Yoast is one of the most popular WordPress plug-ins with over 7 million downloads and "1+ million" active installs. Last month Yoast patched a stored XSS we reported in the plug-in. Shortly after this we identified another bug of a similar severity. The...
Palo Alto Traps Server XSS
Stored XSS in logs...
[CVE-2014-5361][CVE-2014-5362]Landesk Management Suite RFI & CSRF Security Vulnerabilities
Exploit Title: Landesk Management Suite RFI and CSRF vulnerabilities Product: Landesk Management Suite Vulnerable Versions: 9.5 and possible previous versions, 9.6 Tested Version: 9.5 Advisory Publication: 16/04/2015 Latest Update: 16/04/2015 Vulnerability Type: Cross-site request forgery CWE-352...
Multiple Cross-Site Scripting (XSS) in FreePBX
Advisory ID: HTB23253 Product: FreePBX Vendor: Sangoma Technologies Vulnerable Versions: 12.0.43 and probably prior Tested Version: 12.0.43 Advisory Publication: March 18, 2015 without technical details Vendor Notification: March 18, 2015 Vendor Patch: March 27, 2015 Public Disclosure: April 22,...
EMC Isilon OneFS privilege escalation
Local files access...
CVE-2015-2223: Palo Alto Traps Server Stored XSS
------------------------------------------------------------------------ Product: Palo Alto Traps Server formerly Cyvera Endpoint Protection Vendor: Palo Alto Networks Vulnerable Versions: 3.1.2.1546 Tested Version: 3.1.2.1546 Advisory Publication: 29 March 2015 Vendor Notification: 17 October 20...
[CVE-2015-2926] XSS vuln in phpTrafficA
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Product: phpTrafficA Product page: http://soft.zoneo.net/phpTrafficA/ Affected versions: Up to and including 2.3 latest as of writing. Description: The user agent string provided by the browser is not sanitized nor escaped when handled. This string ...
[SECURITY ANNOUNCEMENT] CVE-2015-0225
CVE-2015-0225: Apache Cassandra remote execution of arbitrary code Severity: Important Vendor: The Apache Software Foundation Versions Affected: Cassandra 1.2.0 to 1.2.19 Cassandra 2.0.0 to 2.0.13 Cassandra 2.1.0 to 2.1.3 Description: Under its default configuration, Cassandra binds an...
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
SonicWall SonicOS crossite scripting
No description provided...
[security bulletin] HPSBGN03328 rev.1 - Network Virtualization for HP LoadRunner and Performance Center, Remote Information Disclosure
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04657310 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04657310 Version: 1 HPSBGN03328 rev....
CSRF to add admin user Vulnerability In Manage Engine Device Expert
=============================================================================== CSRF to add admin user Vulnerability In Manage Engine Device Expert =============================================================================== . contents:: Table Of Content Overview ======== Title : CSRF to add...
Arbitrary Variable Overwrite in eShop WordPress Plugin
Advisory ID: HTB23255 Product: eShop WordPress plugin Vendor: Rich Pedley Vulnerable Versions: 6.3.11 and probably prior Tested Version: 6.3.11 Advisory Publication: April 15, 2015 without technical details Vendor Notification: April 15, 2015 Public Disclosure: May 6, 2015 Vulnerability Type: Cod...
BullGuard antiviral applications authentication bypass
Access limitation are checked in client application...
HP Integrated Lights-Out multiple security vulnereabilities
Code execution, privilege escalation, DoS, restrictions bypass...
[SYSS-2014-007] FrontRange DSM - Multiple Vulnerabilities
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2014-007 Product: FrontRange DSM Vendor: FrontRange Solutions USA Inc. and/or its affiliates Affected Versions: v7.2.1.2020, v7.2.2.2331 Tested Versions: v7.2.1.2020, v7.2.2.2331 Vulnerability Type: Use of Hard-coded Cryptographic...
Wordpress Twenty Fifteen Theme - DOM XSS Vulnerability - CVE-2015-3429
Information -------------------- Advisory by Netsparker. Name: DOM XSS Vulnerability in Twenty Fifteen WordPress Theme Affected Software : WordPress Affected Versions: 4.2.1 and probably below Vendor Homepage : https://wordpress.org/ and https://wordpress.org/themes/twentyfifteen/ Vulnerability...
CSRF/XSS In Ultimate Profile Builder by CMSLive Wordpress Plugin
================================================================ CSRF/Stored XSS Vulnerability in Ultimate profile Builder Plugin ================================================================ . contents:: Table Of Content Overview ======== Title :CSRF and Stored XSS Vulnerability in Ultimate...
Stored XSS Vulnerability In Manage Engine Device Expert
=============================================================================== Stored XSS Vulnerability In Manage Engine Device Expert =============================================================================== . contents:: Table Of Content Overview ======== Title :Stored XSS Vulnerability I...
[SECURITY] [DSA 3254-1] suricata security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3254-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso May 09, 2015 http://www.debian.org/security/faq -...
HP Data Protector multiple security vulnerabilities
DoS, code execution, privilege escalation...
HP Capture and Route information disclosure
No description provided...
Filezilla FTP server bounce attack
DATA connection IP address is not restricted...
CSRF/XSS In Ad_Button Wordpress
================================================================ CSRF/Stored XSS Vulnerability in Ad Buttons Plugin ================================================================ . contents:: Table Of Content Overview ======== Title :CSRF and Stored XSS Vulnerability in Ad Buttons Wordpress...
[SECURITY] CVE-2014-0230: Apache Tomcat DoS
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 CVE-2014-0230 Denial of Service Severity: Low Vendor: The Apache Software Foundation Versions Affected: - - Apache Tomcat 8.0.0-RC1 to 8.0.8 - - Apache Tomcat 7.0.0 to 7.0.54 - - Apache Tomcat 6.0.0 to 6.0.43 Description: When a response for a reque...
[security bulletin] HPSBMU03292 rev.1 - HP Operations Orchestration Authentication Bypass
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04595607 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04595607 Version: 1 HPSBMU03292 rev....
vPhoto-Album v4.2 iOS - File Include Web Vulnerability
Document Title: =============== vPhoto-Album v4.2 iOS - File Include Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1477 Release Date: ============= 2015-05-05 Vulnerability Laboratory ID VL-ID: ==================================== 147...
Advisory: Filezilla FTP server is vulnerable to FTP PORT bounce
Dear list A security advisory for Filezilla FTP server versions 0.8.0-0.9.50 is available at http://www.securitygalore.com/site3/filezillaftpserveradvisory A new version of Filezilla FTP server 0.9.51 is available for immediate download at https://filezilla-project.org/download.php?type=server I...
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
Wordpress plugin Simple Ads Manager - Multiple SQL Injection
Vulnerability title: Wordpress plugin Simple Ads Manager - Multiple SQL Injection Product: Wordpress plugin Simple Ads Manager Vendor: https://profiles.wordpress.org/minimus/ Affected version: Simple Ads Manager 2.5.94 and 2.5.96 Download link: https://wordpress.org/plugins/simple-ads-manager/ CV...
CVE-2015-2755 WordPress AB Google Map Travel CSRF / XSS
=============================================================================== CSRF/Stored XSS Vulnerability in AB Google Map Travel AB-MAP Wordpress Plugin =============================================================================== . contents:: Table Of Content Overview ======== Title :Stor...
CSRF & XSS Wing FTP Server Admin <= v4.4.5
Wing FTP Server Admin 4.4.5 - CSRF & Cross Site Scripting Vulnerabilities Release Date: ============= 2015-04-28 Source: ==================================== http://hyp3rlinx.altervista.org/advisories/AS-WFTP0328.txt Common Vulnerability Scoring System: ==================================== Overal...
Multiple Vulnerabilities in TheCartPress WordPress plugin
Advisory ID: HTB23254 Product: TheCartPress WordPress plugin Vendor: TheCartPress team Vulnerable Versions: 1.3.9 and probably prior Tested Version: 1.3.9 Advisory Publication: April 8, 2015 without technical details Vendor Notification: April 8, 2015 Public Disclosure: April 29, 2015 Vulnerabili...
Remote File Upload Vulnerability in WordPress Ultimate Product Catalogue Plugin
Product Description: ------------------- Ultimate Product Catalog plugin is designed to help WordPress sites administrators display products quickly and easily in an attractive and customizable layout, making your catalogue easy to browse, sort and update with categories, sub-categories, and tags...
Wordpress plugin Simple Ads Manager - SQL Injection
Vulnerability title: Wordpress plugin Simple Ads Manager - SQL Injection Product: Wordpress plugin Simple Ads Manager Vendor: https://profiles.wordpress.org/minimus/ Affected version: Simple Ads Manager 2.5.94 and 2.5.96 Download link: https://wordpress.org/plugins/simple-ads-manager/ CVE ID:...