[SYSS-2014-010] FancyFon FAMOC - SQL Injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2014-010 Products: FAMOC Vendor: FancyFon Affected Versions: 3.16.5 Tested Versions: 3.16.5 Vulnerability Type: SQL Injection CWE-89 Risk Level: High Solution Status: Fixed Vendor Notification: 2014-12-19 Solution Date: 2015-01-23...

VMware vSphere Data Protection certificate validation bypass

Insufficient server certificate validation...

APPLE-SA-2015-01-27-3 Safari 8.0.3, Safari 7.1.3, and Safari 6.2.3

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2015-01-27-3 Safari 8.0.3, Safari 7.1.3, and Safari 6.2.3 Safari 8.0.3, Safari 7.1.3, and Safari 6.2.3 are now available and address the following: WebKit Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10...

AST-2015-001: File descriptor leak when incompatible codecs are offered

Asterisk Project Security Advisory - AST-2015-001 Product Asterisk Summary File descriptor leak when incompatible codecs are offered Nature of Advisory Resource exhaustion Susceptibility Remote Authenticated Sessions Severity Major Exploits Known No Reported On 6 January, 2015 Reported By Y Ateya...

EMC Unisphere Central open redirect

Open redirect in web interface...

EMC Avamar certificate protection bypass

Insufficient certificate validation...

ESA-2015-006: EMC Avamar Missing Certificate Validation Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2015-006: EMC Avamar Missing Certificate Validation Vulnerability EMC Identifier: ESA-2015-006 CVE Identifier: CVE-2014-4632 Severity Rating: CVSSv2 Base Score: 7.9 AV:A/AC:M/Au:N/C:C/I:C/A:C Affected products: • EMC Avamar Data Store ADS and Avam...

[CORE-2015-0003] - FreeBSD Kernel Multiple Vulnerabilities

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ FreeBSD Kernel Multiple Vulnerabilities 1. Advisory Information Title: FreeBSD Kernel Multiple Vulnerabilities Advisory ID: CORE-2015-0003 Advisory URL: http://www.coresecurity.com/content/freebsd-kernel-multiple-vulnerabilities...

FreeBSD Security Advisory FreeBSD-SA-15:03.sctp

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-15:03.sctp Security Advisory The FreeBSD Project Topic: SCTP stream reset vulnerability Category: core Module: sctp Announced: 2015-01-27 Credits: Gerasimos...

FreeBSD Security Advisory FreeBSD-SA-15:02.kmem

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-15:02.kmem Security Advisory The FreeBSD Project Topic: SCTP SCTPSSVALUE kernel memory corruption and disclosure Category: core Module: sctp Announced: 2015-01-...

Two XSS Vulnerabilities in SupportCenter Plus

Advisory ID: HTB23247 Product: SupportCenter Plus Vendor: Zoho Corp. Vulnerable Versions: 7.9 and probably prior Tested Version: 7.9 Advisory Publication: January 7, 2015 without technical details Vendor Notification: January 7, 2015 Vendor Patch: January 23, 2015 Public Disclosure: January 28,...

Unauthenticated Reflected XSS vulnarbility in Asus RT-N10 Plus router

Title:- Reflected XSS vulnarbility in Asus RT-N10 Plus router Author: Kaustubh G. Padwad Product: ASUS Router RT-N10 Plus Firmware: 2.1.1.1.70 Severity: HIGH Auth: Not requierd Description: Vulnerable Parameter: flag= Vulnerability Class: Cross Site Scripting...

Reflected XSS vulnarbility in Asus RT-N10 Plus Router

Title:- Reflected XSS vulnarbility in Asus RT-N10 Plus router Author: Kaustubh G. Padwad Product: ASUS Router RT-N10 Plus Firmware: 2.1.1.1.70 Severity: Medium Auth: Requierd Description: Vulnerable Parameter: flag= Vulnerability Class: Cross Site Scripting...

[SYSS-2014-012] FancyFon FAMOC - Session Fixation

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2014-012 Products: FAMOC Vendor: FancyFon Affected Versions: 3.16.5 Tested Versions: 3.16.5 Vulnerability Type: Session Fixation CWE-384 Risk Level: Low Solution Status: Fixed Vendor Notification: 2014-12-19 Solution Date: 2015-01-...

[SECURITY] [DSA 3145-1] privoxy security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3145-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso January 30, 2015 http://www.debian.org/security/faq -...

Banner Effect Header Security Advisory - XSS Vulnerability - CVE-2015-1384

Information ------------ Advisory by Netsparker. Name: XSS Vulnerability in Banner Effect Header Affected Software : Banner Effect Header Affected Versions: 1.2.7 and possibly below Vendor Homepage : https://wordpress.org/plugins/banner-effect-header/ Vulnerability Type : Cross-site Scripting...

CVE-2014-8779: SSH Host keys on Pexip Infinity

Summary ======= The operating system used by Pexip Infinity does not create unique SSH host keys on deployment of new Management and Conferencing Nodes, using fixed host keys instead. Host keys are used to verify the identity of the remote host when connecting to it over SSH. These keys are...

Google Chrome / Chromium multiple security vulnerabilities

Multiple vulnerabilities on HTML and different formats parsing...

CVE-2015-0224: qpidd can be crashed by unauthenticated user

Apache Software Foundation - Security Advisory qpidd can be crashed by unauthenticated user CVE-2015-0224 CVS: 7.8 Severity: Moderate Vendor: The Apache Software Foundation Versions Affected: Apache Qpid's qpidd up to and including version 0.30 Description: In CVE-2015-0203 it was announced that...

KL-001-2015-001 : Windows 2003 tcpip.sys Privilege Escalation

KL-001-2015-001 : Microsoft Windows Server 2003 SP2 Arbitrary Write Privilege Escalation Title: Microsoft Windows Server 2003 SP2 Arbitrary Write Privilege Escalation Advisory ID: KL-001-2015-001 Publication Date: 2015.01.28 Publication URL:...

Pexip Infinity static ssh keys

Static ssh key is used on nodes creation...

Blubrry PowerPress Security Advisory - XSS Vulnerability - CVE-2015-1385

Information ------------ Advisory by Netsparker Name: XSS Vulnerability in Blubrry PowerPress Affected Software : Blubrry PowerPress Affected Versions: 6.0 and possibly below Vendor Homepage : https://wordpress.org/plugins/powerpress/ Vulnerability Type : Cross-site Scripting Severity : Important...

Apple Safari / Webkit multiple security vulnerabilities

URI spoofing, information leakage, memory corruptions...

Multiple vulnerabilities in MantisBT

Advisory ID: HTB23243 Product: MantisBT Vendor: MantisBT Team Vulnerable Versions: 1.2.17 and probably prior Tested Version: 1.2.17 Advisory Publication: December 3, 2014 without technical details Vendor Notification: December 3, 2014 Vendor Patch: January 25, 2015 Public Disclosure: January 28,...

GNU glibc gethostbyname functions buffer overflow

Buffer overflow in nsshostnamedigitsdots...

Symantec Data Center Security: Server Advanced (SDCS:SA) & SCSP security vulnerabilities

SQL injections, crossite scripting, information disclosure, protection bypass...

[SECURITY] [DSA 3133-1] privoxy security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3133-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff January 20, 2015 http://www.debian.org/security/faq -...

MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities

Mogwai Security Advisory MSA-2015-01 ---------------------------------------------------------------------- Title: WP Pixarbay Images Multiple Vulnerabilities Product: Pixarbay Images Wordpress Plugin Affected versions: 2.3 Impact: high Remote: yes Product link:...

CVE-2015-1177-xss-exponent

CVE-2015-1177-xss-exponent Information ---------------- Advisory by Octogence. Name: Reflected XSS Vulnerability in Exponent CMS Affected Software : Exponent Affected Versions: 2.3.2 and possibly below Vendor Homepage : http://www.exponentcms.org/ Vulnerability Type : Cross-site Scripting Severit...

ESA-2015-004: EMC M&R (Watch4Net) Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2015-004: EMC M&R Watch4Net Multiple Vulnerabilities EMC Identifier: ESA-2015-004 CVE Identifier: CVE-2015-0513, CVE-2015-0514, CVE-2015-0515, CVE-2015-0516, CVE-2014-4288, CVE-2014-6456, CVE-2014-6457, CVE-2014-6458, CVE-2014-6466, CVE-2014-6468,...

CVE-2015-1179-xss-mango-automation-scada

CVE-2015-1179-xss-mango-automation-scada Information ----------------- Advisory by Octogence. Name: Reflected XSS Vulnerability in Mango Automation SCADA/HMI software Affected Software : Mango Automation Affected Versions: 2.4.0 and possibly below Vendor Homepage : http://infiniteautomation.com/...

SEC Consult SA-20150122-0 :: Multiple critical vulnerabilities in Symantec Data Center Security: Server Advanced (SDCS:SA) & SCSP

SEC Consult Vulnerability Lab Security Advisory 20150122-0 ======================================================================= title: Multiple critical vulnerabilities products: Symantec Data Center Security: Server Advanced SDCS:SA Symantec Critical System Protection SCSP vulnerable version:...

elfutils directory traversal

Directory traversal on ar extraction...

AVM FRITZ!Box protection bypass

Image integrity protection bypass...

jasper library multiple security vulnerabilities

Buffer overflows in jpcdeccpsetfromcox and jpcdeccpsetfromrgn functions, double free, heap buffer overflow...

[RT-SA-2014-010] AVM FRITZ!Box Firmware Signature Bypass

Advisory: AVM FRITZ!Box: Firmware Signature Bypass The signature check of FRITZ!Box firmware images is flawed. Malicious code can be injected into firmware images without breaking the RSA signature. The code will be executed either if a manipulated firmware image is uploaded by the victim or if t...

[oCERT-2015-001] JasPer input sanitization errors

2015-001 JasPer input sanitization errors Description: The JasPer project is an open source implementation for the JPEG-2000 codec. The library is affected by an off-by-one error in a buffer boundary check in jpcdecprocesssot, leading to a heap based buffer overflow, as well as multiple...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Remote Desktop v0.9.4 Android - Multiple Vulnerabilities

Document Title: =============== Remote Desktop v0.9.4 Android - Multiple Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1413 Release Date: ============= 2015-01-20 Vulnerability Laboratory ID VL-ID: ====================================...

[SECURITY] [DSA 3134-1] sympa security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3134-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso January 20, 2015 http://www.debian.org/security/faq -...

CVE-2015-1180-xss-eventsentry

CVE-2015-1180-xss-eventsentry Information ---------------- Advisory by Octogence. Name: Reflected XSS Vulnerability in EventSentry Web Reports Interface Affected Software : EventSentry Affected Versions: 3.1.0 and possibly below Vendor Homepage : http://eventsentry.com/ Vulnerability Type :...

REWTERZ-20140101 - ManageEngine ServiceDesk SQL Injection Vulnerability

================================================================================ REWTERZ-20140101 - Rewterz - Security Advisory ================================================================================ Title: ManageEngine ServiceDesk SQL Injection Vulnerability Product: ServiceDesk Plus...

Different iOS / Android applications vulnerabilities

Information leaks, code execution, protection bypass, etc...

[USN-2481-1] Samba vulnerability

========================================================================== Ubuntu Security Notice USN-2481-1 January 22, 2015 samba vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

REWTERZ-20140102 - ManageEngine ServiceDesk Plus User Enumeration Vulnerability

================================================================================ REWTERZ-20140102 - Rewterz - Security Advisory ================================================================================ Title: ManageEngine ServiceDesk Plus User Enumeration Vulnerability Product: ServiceDesk...

Oracle / Sun / PeopleSoft / MySQL multiple security vulnerabilities

Over 150 vulnerabilities in different applications are closed in auqrterly update...

PhotoSync v1.1.3 Android - Command Inject Vulnerability

Document Title: =============== PhotoSync v1.1.3 Android - Command Inject Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1410 Release Date: ============= 2015-01-21 Vulnerability Laboratory ID VL-ID: ==================================== 14...

PhotoSync 1.1.3 Android - Command Inject Vulnerability

Document Title: =============== PhotoSync 1.1.3 Android - Command Inject Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1410 Release Date: ============= 2015-01-21 Vulnerability Laboratory ID VL-ID: ==================================== 141...

CVE-2015-1178-xss-x-cart-ecommerce

CVE-2015-1178-xss-x-cart-ecommerce Information ---------------- Advisory by Octogence. Name: Reflected XSS Vulnerability in X-CART e-Commerce software Affected Software : X-Cart Affected Versions: 5.1.8 and possibly below Vendor Homepage : https://www.x-cart.com Vulnerability Type : Cross-site...

[USN-2482-1] elfutils vulnerability

========================================================================== Ubuntu Security Notice USN-2482-1 January 23, 2015 elfutils vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...