47153 matches found
Microsoft Office multiple security vulnerabilities
Code execution, use-after-free...
Cookie hijacking: Internet Explorer UXSS (CVE-2015-0072)
Cookie hijacking: Internet Explorer UXSS CVE-2015-0072 Host below files on webserver attacker.com and share the exploit link with victims, exploit.php --- exploit link Share with victim redirect.php --- Script to redirect on target page target page should not contain X-Frame-Options or it will fa...
Microsoft Windows multiple security vulnerabilities
Multiple Internet Explorer memory corruptions, kernel privilege escalation, group policies code execution and restrictions bypass, process creation privilege escalation, TIFF parsing information leakage...
PostgreSQL multiple security vulnerabilities
Memory corruptions, information leakage, SQL injections...
Microsoft Virtual Machine Manager privilege escalation
Insufficient users role checking...
ClamAV memory corruptions
No description provided...
libvirt information disclosure
It's possible to manipulate VIRDOMAINXMLSECURE flag...
Major Internet Explorer Vulnerability - NOT Patched
Deusen just published code and description here: http://www.deusen.co.uk/items/insider3show.3362009741042107/ which demonstrates the serious security issue. Summary An Internet Explorer vulnerability is shown here: Content of dailymail.co.uk can be changed by external domain. How To Use 1. Close...
[USN-2497-1] NTP vulnerabilities
========================================================================== Ubuntu Security Notice USN-2497-1 February 09, 2015 ntp vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...
[SECURITY] [DSA 3155-1] postgresql-9.1 security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3155-1 [email protected] http://www.debian.org/security/ Luciano Bello February 06, 2015 http://www.debian.org/security/faq -...
[ MDVSA-2015:035 ] libvirt
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:035 http://www.mandriva.com/en/support/security/ Package : libvirt Date : February 6, 2015 Affected: Business Server 1.0 Problem Description: Updated libvirt packages fix security vulnerability: The XML...
[ MDVSA-2015:032 ] php
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:032 http://www.mandriva.com/en/support/security/ Package : php Date : February 5, 2015 Affected: Business Server 1.0 Problem Description: Multiple vulnerabilities has been discovered and corrected in php:...
[SECURITY] [DSA 3152-1] unzip security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3152-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso February 03, 2015 http://www.debian.org/security/faq -...
CVE-2015-1437 XSS In ASUS Router.
Title:- Reflected XSS vulnarbility in Asus RT-N10 Plus router Author: Kaustubh G. Padwad Product: ASUS Router RT-N10 Plus Firmware: 2.1.1.1.70 Severity: HIGH Auth: Not requierd CVE ID: CVE-2015-1437 Description: Vulnerable Parameter: flag= Vulnerability Class: Cross Site Scripting...
Asus RT routers unauthorized access
Full anonymous access is allowed be default. Authentication bypass. Crossite scripting...
[ MDVSA-2015:042 ] clamav
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:042 http://www.mandriva.com/en/support/security/ Package : clamav Date : February 10, 2015 Affected: Business Server 1.0 Problem Description: Updated clamav packages fix security vulnerabilities: ClamAV 0.98...
MIT Kerberos 5 multiple security vulnerabilities
Information leakage, double free...
MITKRB5-SA-2015-001 Vulnerabilities in kadmind, libgssrpc, gss_process_context_token
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 MITKRB5-SA-2015-001 MIT krb5 Security Advisory 2015-001 Original release: 2015-02-03 Last update: 2015-02-03 Topic: Vulnerabilities in kadmind, libgssrpc, gssprocesscontexttoken VU540092 CVE-2014-5352: gssprocesscontexttoken incorrectly frees context...
ntpd multiple security vulnerabilities
Authentication bypass, buffer overflow, information leakage, restrictions bypass...
[ MDVSA-2015:031 ] busybox
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:031 http://www.mandriva.com/en/support/security/ Package : busybox Date : February 5, 2015 Affected: Business Server 1.0 Problem Description: Updated busybox packages fix security vulnerability: The modprobe...
busybox restrictions bypass
Modules loading restrictions bypass...
Apple TV multiple security vulnerabilities
Protection bypass, memory corruptions, buffer overflows, code execution, crossite access...
Android DoS
WiFi direct function DoS...
[SYSS-2014-011] FancyFon FAMOC - Cross-Site Scripting
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2014-011 Products: FAMOC Vendor: FancyFon Affected Versions: 3.16.5 Tested Versions: 3.16.5 Vulnerability Type: Cross-Site Scripting CWE-79 Risk Level: Medium Solution Status: Fixed Vendor Notification: 2014-12-19 Solution Date:...
APPLE-SA-2015-01-27-2 iOS 8.1.3
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2015-01-27-2 iOS 8.1.3 iOS 8.1.3 is now available and addresses the following: AppleFileConduit Available for: iPhone 4s and later, iPod touch 5th generation and later, iPad 2 and later Impact: A maliciously crafted afc command may allow acce...
Sefrengo CMS v1.6.1 - Multiple SQL Injection Vulnerabilities
Exploit Title: Sefrengo CMS v1.6.1 - Multiple SQL Injection Vulnerabilities Vendor: http://www.sefrengo.org/ Download link: http://forum.sefrengo.org/index.php?showtopic=3368 https://github.com/sefrengo-cms/sefrengo-1.x/tree/22c0d16bfd715631ed317cc99 0785ccede478f07 CVE ID: CVE-2015-1428...
Xen DoS
Invalid page reference handling...
Asterisk DoS
Crash on empty WebSocket frame. File descriptor leak on incompatible codecs...
FreeBSD Security Advisory FreeBSD-SA-15:02.kmem
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-15:02.kmem Security Advisory The FreeBSD Project Topic: SCTP SCTPSSVALUE kernel memory corruption and disclosure Category: core Module: sctp Announced: 2015-01-...
Apache Qpid security vulnerabilities
DoS, non-switchable anonymous access...
VMware vSphere Data Protection certificate validation bypass
Insufficient server certificate validation...
EMC Unisphere Central open redirect
Open redirect in web interface...
Apple Safari / Webkit multiple security vulnerabilities
URI spoofing, information leakage, memory corruptions...
EMC Avamar certificate protection bypass
Insufficient certificate validation...
NEW VMSA-2015-0002 VMware vSphere Data Protection product update addresses a certificate validation vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ VMware Security Advisory Advisory ID: VMSA-2015-0002 Synopsis: VMware vSphere Data Protection product update addresses a certificate validation vulnerability. Issue date:...
Unauthenticated Reflected XSS vulnarbility in Asus RT-N10 Plus router
Title:- Reflected XSS vulnarbility in Asus RT-N10 Plus router Author: Kaustubh G. Padwad Product: ASUS Router RT-N10 Plus Firmware: 2.1.1.1.70 Severity: HIGH Auth: Not requierd Description: Vulnerable Parameter: flag= Vulnerability Class: Cross Site Scripting...
Microweber 0.95 - SQL Injection Vulnerability
Exploit Title: Microweber 0.95 - SQL Injection Vulnerability Vendor: https://microweber.com/ Download link: https://microweber.com/download https://github.com/microweber/microweber CVE ID: CVE-2014-9464 Vulnerability: SQL Injection Affected version: Version 0.95 before 12/09/2014. Fixed version:...
Multiple vulnerabilities in MantisBT
Advisory ID: HTB23243 Product: MantisBT Vendor: MantisBT Team Vulnerable Versions: 1.2.17 and probably prior Tested Version: 1.2.17 Advisory Publication: December 3, 2014 without technical details Vendor Notification: December 3, 2014 Vendor Patch: January 25, 2015 Public Disclosure: January 28,...
APPLE-SA-2015-01-27-1 Apple TV 7.0.3
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2015-01-27-1 Apple TV 7.0.3 Apple TV 7.0.3 is now available and addresses the following: Apple TV Available for: Apple TV 3rd generation and later Impact: A maliciously crafted afc command may allow access to protected parts of the filesystem...
CVE-2015-0224: qpidd can be crashed by unauthenticated user
Apache Software Foundation - Security Advisory qpidd can be crashed by unauthenticated user CVE-2015-0224 CVS: 7.8 Severity: Moderate Vendor: The Apache Software Foundation Versions Affected: Apache Qpid's qpidd up to and including version 0.30 Description: In CVE-2015-0203 it was announced that...
ESA-2015-006: EMC Avamar Missing Certificate Validation Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2015-006: EMC Avamar Missing Certificate Validation Vulnerability EMC Identifier: ESA-2015-006 CVE Identifier: CVE-2014-4632 Severity Rating: CVSSv2 Base Score: 7.9 AV:A/AC:M/Au:N/C:C/I:C/A:C Affected products: • EMC Avamar Data Store ADS and Avam...
CVE-2014-8779: SSH Host keys on Pexip Infinity
Summary ======= The operating system used by Pexip Infinity does not create unique SSH host keys on deployment of new Management and Conferencing Nodes, using fixed host keys instead. Host keys are used to verify the identity of the remote host when connecting to it over SSH. These keys are...
[CVE-2015-1393] Photo Gallery (Wordpress Plugin) - SQL Injection in Version 1.2.8
CVE-2015-1393 Photo Gallery Wordpress Plugin - SQL Injection in Version 1.2.8 ---------------------------------------------------------------- Product Information: Software: Photo Gallery Wordpress Plugin Tested Version: 1.2.8, released on 15.01.2015 and has over half a million downloads...
KL-001-2015-001 : Windows 2003 tcpip.sys Privilege Escalation
KL-001-2015-001 : Microsoft Windows Server 2003 SP2 Arbitrary Write Privilege Escalation Title: Microsoft Windows Server 2003 SP2 Arbitrary Write Privilege Escalation Advisory ID: KL-001-2015-001 Publication Date: 2015.01.28 Publication URL:...
[SYSS-2014-010] FancyFon FAMOC - SQL Injection
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2014-010 Products: FAMOC Vendor: FancyFon Affected Versions: 3.16.5 Tested Versions: 3.16.5 Vulnerability Type: SQL Injection CWE-89 Risk Level: High Solution Status: Fixed Vendor Notification: 2014-12-19 Solution Date: 2015-01-23...
[AMPLIA-ARA100614] OS X Gatekeeper Bypass Vulnerability
OS X Gatekeeper Bypass Vulnerability Amplia Security - Amplia Security Research Advisory AMPLIA-ARA100614 Advisory ID: AMPLIA-ARA100614 Advisory URL: http://www.ampliasecurity.com/advisories/os-x-gatekeeper-bypass-vulnerability.html, http://www.ampliasecurity.com/advisories/AMPLIA-ARA100614.txt...
Apple iOS multiple security vulnerabilities
Protection bypass, memory corruptions, buffer overflows, code execution, crossite access...
[SECURITY] [DSA 3140-1] xen security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3140-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff January 27, 2015 http://www.debian.org/security/faq -...
[CVE-2015-1394] Photo Gallery (Wordpress Plugin) - Multiple XSS Vulnerabilities Version 1.2.8
CVE-2015-1394 Photo Gallery Wordpress Plugin - Multiple XSS Vulnerabilities Version 1.2.8 ---------------------------------------------------------------- Product Information: Software: Photo Gallery Wordpress Plugin Tested Version: 1.2.8, released on 15.01.2015 and has over half a million...
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...