[security bulletin] HPSBGN03329 rev.1 - HP SDN VAN Controller, Remote Denial of Service (DoS), Distributed Denial of Service (DDoS)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04657823 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04657823 Version: 1 HPSBGN03329 rev....

Alienvault OSSIM/USM Multiple Vulnerabilities

Details ======= Product: Alienvault OSSIM/USM Vulnerability: Multiple Vulnerabilities XSS, SQLi, Command Execution Author: Peter Lapp, [email protected] CVE: None assigned Vulnerable Versions: Tested on 4.14, 4.15, and 5.0. It likely affects all previous versions as well. Fixed Version: No fix ha...

Reflected XSS Vulnerability in XSS In Manage Engine Device Expert

=============================================================================== Reflected XSS Vulnerability in XSS In Manage Engine Device Expert =============================================================================== . contents:: Table Of Content Overview ======== Title :Reflected XSS...

CSRF/XSS In Embed ArticlesWordpress Plugin

====================================================== CSRF/Stored XSS Vulnerability in embed articles Plugin ====================================================== . contents:: Table Of Content Overview ======== Title :CSRF and Stored XSS Vulnerability in embed-articles Wordpress Plugin Author:...

vBulletin 4.x.x 'visitormessage.php' Remote Code Injection Vulnerability

Exploit Title: vBulletin 4.x.x 'visitormessage.php' Remote Code Injection Vulnerability + Discovered By: Dariush Nasirpour Net.Edit0r + My Homepage: black-hg.org / nasirpour.info + Date: 2015 27 February + Vendor Homepage: vBulletin.com + Tested on: vBulletin 4.2.2 + Greeting : Ali Razmjoo -...

libicu security vulnerabilities

Buffer overflow, integer overflow...

Sqlbuddy Directory Traversal Read Arbitrary Files Vulnerability

Sqlbuddy Directory Traversal Read Arbitrary Files Vulnerability. Vendor: http://www.sqlbuddy.com Release Date: ============= 05-08-2015 Source: ==================================== http://hyp3rlinx.altervista.org/advisories/AS-SQLBUDDY0508.txt Product: =============================== sqlbuddy...

HP TippingPoint Security Management System / TippingPoint Virtual Security Management System code execution

Code execution via web interface...

TORNADO Computer Trading CMS - SQL Injection Vulnerability

Document Title: =============== TORNADO Computer Trading CMS - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1489 Release Date: ============= 2015-05-05 Vulnerability Laboratory ID VL-ID: ====================================...

zeromq3 / libzmq downgrade attack

Protocol version downgrade attack is possible...

SonicWall SonicOS 7.5.0.12 & 6.x - Client Side Cross Site Scripting Vulnerability

Document Title: =============== SonicWall SonicOS 7.5.0.12 & 6.x - Client Side Cross Site Scripting Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1359 Release Date: ============= 2015-04-23 Vulnerability Laboratory ID VL-ID:...

Cross-Site Request Forgery (CSRF) Vulnerability in ManageEngine Network Configuration

Title:- Cross-Site Request Forgery CSRF Vulnerability in ManageEngine Network Configuration Management Author: Kaustubh G. Padwad Vendor: ZOHO Corp Product: ManageEngine Network Configuration Manager Tested Version: : Network Configuration Manager Build 11000 Severity: HIGH About the Product:...

libtasn1 buffer overflow

Heap buffer overflow on DER decoding...

[SYSS-2015-017] BullGuard Internet Security - Authentication Bypass

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2015-017 Product: BullGuard Internet Security Vendor: BullGuard Ltd. Affected Versions: 15.0.297 Tested Versions: 15.0.297 Vulnerability Type: Authentication Bypass Using an Alternate Path or Channel CWE-288 Risk Level: Medium...

[ MDVSA-2015:232 ] libtasn1

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:232 http://www.mandriva.com/en/support/security/ Package : libtasn1 Date : May 8, 2015 Affected: Business Server 1.0, Business Server 2.0 Problem Description: Updated libtasn1 packages fix security...

Linux kernel multiple security vulnerabilities

DoS, privilege escalation, protection bypass...

Grindr v2.1.1 iOS & Account System - Breach Attack Vulnerability

Document Title: =============== Grindr v2.1.1 iOS & Account System - Breach Attack Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1420 Release Date: ============= 2015-05-03 Vulnerability Laboratory ID VL-ID:...

Apple Safari / Webkit multiple security vulnerabilities

Multiple memory corruptions, files access, interface spoofing...

[USN-2597-2] Linux kernel (Trusty HWE) regression

========================================================================== Ubuntu Security Notice USN-2597-2 May 08, 2015 linux-lts-trusty regression ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

Album Streamer v2.0 iOS - Directory Traversal Vulnerability

Document Title: =============== Album Streamer v2.0 iOS - Directory Traversal Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1481 Release Date: ============= 2015-05-07 Vulnerability Laboratory ID VL-ID: ===================================...

[SYSS-2015-019] BullGuard Antivirus - Authentication Bypass

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2015-019 Product: BullGuard Antivirus Vendor: BullGuard Ltd. Affected Versions: 15.0.297 Tested Versions: 15.0.297 Vulnerability Type: Authentication Bypass Using an Alternate Path or Channel CWE-288 Risk Level: Medium Solution...

APPLE-SA-2015-05-06-1 Safari 8.0.6, Safari 7.1.6, and Safari 6.2.6

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2015-05-06-1 Safari 8.0.6, Safari 7.1.6, and Safari 6.2.6 Safari 8.0.6, Safari 7.1.6, and Safari 6.2.6 are now available and address the following: WebKit Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, and OS X Yosemite...

[SYSS-2015-018] BullGuard Premium Protection - Authentication Bypass

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2015-018 Product: BullGuard Premium Protection Vendor: BullGuard Ltd. Affected Versions: 15.0.297 Tested Versions: 15.0.297 Vulnerability Type: Authentication Bypass Using an Alternate Path or Channel CWE-288 Risk Level: Medium...

owncloud multiple security vulnerabilities

CSRF, XSS, limitations bypass...

[SECURITY] [DSA 3244-1] owncloud security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3244-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso May 02, 2015 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3241-1] elasticsearch security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3241-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff April 29, 2015 http://www.debian.org/security/faq -...

PHP security vulnerabilities

apache2handler code execution, memory corruption on archives parsing...

[USN-2583-1] Linux kernel vulnerability

========================================================================== Ubuntu Security Notice USN-2583-1 April 30, 2015 linux vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubunt...

SQLite multiple security vulnerabilities

Over 20 errors, including uninitialized memory access...

HUAWEI MobiConnect 23.9.17.216 - Privilege Escalation Vulnerability

Document Title: =============== HUAWEI MobiConnect 23.9.17.216 - Privilege Escalation Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1389 Release Date: ============= 2015-05-04 Vulnerability Laboratory ID VL-ID:...

libphp-snoopy code execution

No description provided...

OpenFire certificate validation vulnerability

No description provided...

Dnsmasq 2.72 Unchecked returned value

"Dnsmasq 2.72 Unchecked returned value" Description ------------------------------------------------------------ Dnsmasq does not properly check the return value of the setupreply function called during a tcp connection by the tcprequest function. This return value is then used as a size argument...

[ MDVSA-2015:211 ] glusterfs

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:211 http://www.mandriva.com/en/support/security/ Package : glusterfs Date : April 27, 2015 Affected: Business Server 2.0 Problem Description: Updated glusterfs packages fix security vulnerability: glusterfs...

ProFTPD unauthorized files access

Unauthorized files copy via modcopy...

GNU glibc security vulnerabilities

пgethostbynamer buffer overflow, getaddrinfo race conditions...

[SECURITY] [DSA 3237-1] linux security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3237-1 [email protected] http://www.debian.org/security/ Ben Hutchings April 26, 2015 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3248-1] libphp-snoopy security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3248-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff May 02, 2015 http://www.debian.org/security/faq -...

[USN-2578-1] LibreOffice vulnerabilities

========================================================================== Ubuntu Security Notice USN-2578-1 April 27, 2015 libreoffice vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives:...

usb-creator privilege escalation

No description provided...

Wireless File Transfer Pro Android - Multiple CSRF Vulnerabilities

Document Title: =============== Wireless File Transfer Pro Android - CSRF Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1437 Release Date: ============= 2015-02-25 Vulnerability Laboratory ID VL-ID: ====================================...

Linux ASLR mmap weakness: Reducing entropy by half

A bug in Linux ASLR implementation has been found. The issue is that the mmap base address for processes is not properly randomized on some architectures due to an improper bit-mask manipulation. Affected systems have reduced the mmap area entropy of the processes by half. The number of possible...

[slackware-security] proftpd (SSA:2015-111-12)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 slackware-security proftpd SSA:2015-111-12 New proftpd packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix a security issue. Here are the details from the Slackware 14.1 ChangeLog: +--------------------------+...

[USN-2577-1] wpa_supplicant vulnerability

========================================================================== Ubuntu Security Notice USN-2577-1 April 23, 2015 wpa vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu...

[USN-2576-1] usb-creator vulnerability

========================================================================== Ubuntu Security Notice USN-2576-1 April 23, 2015 usb-creator vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

Elasticsearch directory traversal

Directory traversal via requests to /plugin...

[USN-2591-1] curl vulnerabilities

========================================================================== Ubuntu Security Notice USN-2591-1 April 30, 2015 curl vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubun...

[ MDVSA-2015:210 ] qemu

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:210 http://www.mandriva.com/en/support/security/ Package : qemu Date : April 27, 2015 Affected: Business Server 1.0, Business Server 2.0 Problem Description: Updated qemu packages fix security vulnerabilitie...

[ MDVSA-2015:209 ] php

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:209 http://www.mandriva.com/en/support/security/ Package : php Date : April 27, 2015 Affected: Business Server 1.0, Business Server 2.0 Problem Description: Updated php packages fix security vulnerabilities:...

[ MDVSA-2015:217 ] sqlite3

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:217 http://www.mandriva.com/en/support/security/ Package : sqlite3 Date : April 30, 2015 Affected: Business Server 1.0, Business Server 2.0 Problem Description: Multiple vulnerabilities has been found and...