47153 matches found
ESA-2014-179: EMC Replication Manager and EMC AppSync Unquoted Service Path Enumeration Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-179: EMC Replication Manager and EMC AppSync Unquoted Service Path Enumeration Vulnerability EMC Identifier: ESA-2014-179 CVE Identifier: CVE-2014-4634 Severity Rating: CVSS v2 Base Score: 6.8 AV:L/AC:L/Au:S/C:C/I:C/A:C Affected products: EMC...
Remote Code Execution via Unauthorised File upload in Cforms 14.7
Advisory: Remote Code Execution via Unauthorised File upload in Cforms 14.7 Advisory ID: - Author: Zakhar Fedotkin Affected Software: Wordpress Plugin Cforms II 14.x-14.7 Release: 12th Nov 2014 Vendor URL: https://wordpress.org/plugins/cforms2/ Vendor Status: fixed CVE-ID: -...
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
[KIS-2014-16] Osclass <= 3.4.2 (contact.php) Unrestricted File Upload Vulnerability
--------------------------------------------------------------------- Osclass = 3.4.2 contact.php Unrestricted File Upload Vulnerability --------------------------------------------------------------------- - Software Link: http://osclass.org/ - Affected Versions: Version 3.4.2 and probably prior...
[KIS-2014-19] Symantec Web Gateway <= 5.2.1 (restore.php) OS Command Injection Vulnerability
------------------------------------------------------------------------------ Symantec Web Gateway = 5.2.1 restore.php OS Command Injection Vulnerability ------------------------------------------------------------------------------ - Software Link: http://www.symantec.com/web-gateway/ - Affecte...
[The ManageOwnage Series, part X]: 0-day administrator account creation in Desktop Central
Hi, This is part 10 of the ManageOwnage series. For previous parts, see 1. This time we have a vulnerability that allows an unauthenticated user to create an administrator account, which can then be used to execute code on all devices managed by Desktop Central desktops, servers, mobile devices,...
[KIS-2014-14] Osclass <= 3.4.2 (Search::setJsonAlert) SQL Injection Vulnerability
------------------------------------------------------------------- Osclass = 3.4.2 Search::setJsonAlert SQL Injection Vulnerability ------------------------------------------------------------------- - Software Link: http://osclass.org/ - Affected Versions: Version 3.4.2 and probably prior...
[KIS-2014-15] Osclass <= 3.4.2 (ajax.php) Local File Inclusion Vulnerability
-------------------------------------------------------------- Osclass = 3.4.2 ajax.php Local File Inclusion Vulnerability -------------------------------------------------------------- - Software Link: http://osclass.org/ - Affected Versions: Version 3.4.2 and probably prior versions. -...
ESA-2014-158: RSA BSAFE® Micro Edition Suite and SSL-J Triple Handshake Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-158: RSA BSAFE® Micro Edition Suite and SSL-J Triple Handshake Vulnerability EMC Identifier: ESA-2014-158 CVE Identifier: CVE-2014-4630 Severity Rating: CVSS v2 Base Score: 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Affected Products: RSA BSAFE Micro...
mime-support shell characters injection
run-mailcap special shell characters injection...
[SECURITY] [DSA 3114-1] mime-support security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3114-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso December 29, 2014 http://www.debian.org/security/faq -...
PolarSSL DoS
Memory leak on certificate parsing...
[SECURITY] [DSA 3116-1] polarssl security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3116-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff December 30, 2014 http://www.debian.org/security/faq -...
iWifi for Chat v1.1 iOS - Denial of Service Vulnerability
Document Title: =============== iWifi for Chat v1.1 iOS - Denial of Service Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1375 Release Date: ============= 2014-12-16 Vulnerability Laboratory ID VL-ID: ====================================...
VP-2014-004 SysAid Server Arbitrary File Disclosure
Vantage Point Security Advisory 2014-004 ======================================== Title: SysAid Server Arbitrary File Disclosure ID: VP-2014-004 Vendor: SysAid Affected Product: SysAid On-Premise Affected Versions: 14.4.2 Product Website: http://www.sysaid.com/product/sysaid Author: Bernhard...
ZTE Ucell 3G Modem App - Privilege Escalation Vulnerability
Document Title: =============== ZTE Ucell 3G Modem App - Privilege Escalation Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1387 Release Date: ============= 2014-12-24 Vulnerability Laboratory ID VL-ID: ===================================...
BF and XSS vulnerabilities in D-Link DCS-2103
Hello 3APA3A! There are Brute Force and Cross-Site Scripting vulnerabilities in D-Link DCS-2103 IP camera. If previous Path Traversal and Full path disclosure vulnerabilities were post-auth, then these BF and XSS vulnerabilities are pre-auth. ------------------------- Affected products:...
ESA-2014-164: EMC Isilon InsightIQ Cross-Site Scripting Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-164: EMC Isilon InsightIQ Cross-Site Scripting Vulnerability EMC Identifier: ESA-2014-164 CVE Identifier: CVE-2014-4628 Severity Rating: CVSS v2 Base Score: 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P Affected products: • EMC Isilon InsightIQ 3.0.1 • EMC...
Stored XSS Vulnerability in CMS Serendipity v.2.0-rc1
Advisory: Stored XSS Vulnerability in CMS Serendipity v.2.0-rc1 Advisory ID: SROEADV-2014-02 Author: Steffen Rцsemann Affected Software: CMS Serendipity v.2.0-rc1 Release: 20th Dec 2014 Vendor URL: http://www.s9y.org/ Vendor Status: fixed CVE-ID: - ========================== Vulnerability...
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
Reflecting XSS Vulnerability in CMS Contenido 4.9.x-4.9.5
Advisory: Reflecting XSS Vulnerability in CMS Contenido 4.9.x-4.9.5 Advisory ID: SROEADV-2014-03 Author: Steffen Rцsemann Affected Software: CMS Contenido 4.9.x-4.9.5 Release: 10th Dec 2014 Vendor URL: http://www.contenido.org/de/ Vendor Status: fixed CVE-ID: - ==========================...
EMC RSA Adaptive Authentication authentication bypass
Incorrect processing for device binding challenge...
Vulnerabilities in Samsung SyncThru Web Service
Hello 3APA3A! There are Information Leakage and Insufficient Authorization vulnerabilities in SyncThru Web Service. This is web application for Samsung printers, particularly I found it with Samsung ML-1865W and other printers. Earlier I informed Samsung about it. ------------------------- Affect...
iBackup v10.0.0.45 - Privilege Escalation Vulnerability
Document Title: =============== iBackup v10.0.0.45 - Privilege Escalation Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1382 Release Date: ============= 2014-12-18 Vulnerability Laboratory ID VL-ID: ==================================== 13...
[ANN] Apache Struts 2.3.20 GA release available with security fix
The Apache Struts group is pleased to announce that Apache Struts 2.3.20 is available as a "General Availability" release. The GA designation is our highest quality grade. Apache Struts 2 is an elegant, extensible framework for creating enterprise-ready Java web applications. The framework is...
[CVE-2014-7807] Apache CloudStack unauthenticated LDAP binds
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 CVE-2014-7807: Apache CloudStack unauthenticated LDAP binds CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P Vendors: The Apache Software Foundation Citrix, Inc. Versions Afffected: Apache CloudStack 4.3, 4.4 Description: Apache CloudStack may be configured to...
Pimcore v3.0 & v2.3.0 CMS - SQL Injection Vulnerability
Document Title: =============== Pimcore v3.0 & v2.3.0 CMS - SQL Injection Vulnerability References Source: ==================== http://vulnerability-lab.com/getcontent.php?id=1363 Release Date: ============= 2014-12-16 Vulnerability Laboratory ID VL-ID: ==================================== 1363...
Wireless N ADSL 2/2+ Modem Router - DT5130 - Xss / URL Redirect / Command Injection
Product: Wireless N ADSL 2/2+ Modem Router Firmware Version : V2.05.C29GV Modem Type : ADSL2+ Router Modem Vendor : Technicolor Model: DT5130 Bugs: 1- Unauth Xss - CVE-2014-9142 user=teste&password=teste&...
ESA-2014-163: RSA Archer® GRC Platform Multiple Vulnerabilities
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-163: RSA Archer® GRC Platform Multiple Vulnerabilities EMC Identifier: ESA-2014-163 CVE Identifier: See below for individual identifiers Severity Rating: View details below for individual CVSSv2 scores Affected Products: RSA Archer GRC Platfo...
EMC Isilon InsightIQ crossite scripting
No description provided...
ESA-2014-173: RSA® Authentication Manager Unvalidated Redirect Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-173: RSA® Authentication Manager Unvalidated Redirect Vulnerability EMC Identifier: ESA-2014-173 CVE Identifier: CVE-2014-2516 Severity Rating: CVSS v2 Base Score: 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N Affected Products: • RSA Authentication Manager...
Apache CloudStac authentication bypass
Password is not checked for LDAP binds...
EMC RSA Archer multiple security vulnerabilities
Crossite scripting, JRE vulnerabilities...
PHPLIST v3.0.6 & v3.0.10 - SQL Injection Vulnerability
Document Title: =============== PHPLIST v3.0.6 & v3.0.10 - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1358 Release Date: ============= 2014-12-18 Vulnerability Laboratory ID VL-ID: ==================================== 135...
Technicolor DT5130 routers multiple security vulnerabilities
Code execution, crossite scripting, open redirect...
ESA-2014-160: RSA® Adaptive Authentication (On-Premise) Authentication Bypass Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-160: RSA® Adaptive Authentication On-Premise Authentication Bypass Vulnerability EMC Identifier: ESA-2014-160 CVE Identifier: CVE-2014-4631 Severity Rating: CVSS: 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Affected Products: RSA Adaptive Authentication...
EMC RSA Authentication Manager open redirect
No description provided...
Lazarus Guestbook v1.22 - Multiple Web Vulnerabilities
Document Title: =============== Lazarus Guestbook v1.22 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1386 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2239 CVE-ID: ======= CVE-2014-2239 Release Date:...
XSS and CSRF vulnerabilities in CMS Pylot
Hello 3APA3A! These are Cross-Site Scripting and Cross-Site Request Forgery vulnerabilities in CMS Pylot "Пилот" on Russian. It's Ukrainian commercial CMS from Delta-X. ------------------------- Affected products: ------------------------- Vulnerable are all versions of CMS Pylot. Developers from...
Different iOS applications vulnerabilities
Information leaks, code execution, protection bypass, etc...
[SECURITY] [DSA 3110-1] mediawiki security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3110-1 [email protected] http://www.debian.org/security/ Sebastien Delafond December 23, 2014 http://www.debian.org/security/faq -...
Mobilis MobiConnect 3G ZDServer 1.x - Privilege Escalation Vulnerability
Document Title: =============== Mobilis MobiConnect 3G ZDServer 1.x - Privilege Escalation Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1385 Release Date: ============= 2014-12-19 Vulnerability Laboratory ID VL-ID:...
Samsung SyncThru Web Service unauthenticated access
User's account is not checked...
Mobilis MobiConnect 3G ZDServer privilege escalation
Weak permissions for system service and executable files...
Cisco Security Advisory: Multiple Vulnerabilities in ntpd Affecting Cisco Products
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Multiple Vulnerabilities in ntpd Affecting Cisco Products Advisory ID: cisco-sa-20141222-ntpd Revision 1.1 Last Updated 2014 December 23 13:37 UTC GMT For Public Release 2014 December 22 16:00 UTC GMT...
FreeBSD Security Advisory FreeBSD-SA-14:31.ntp
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-14:31.ntp Security Advisory The FreeBSD Project Topic: Multiple vulnerabilities in NTP suite Category: contrib Module: ntp Announced: 2014-12-23 Affects: All...
[slackware-security] php (SSA:2014-356-02)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 slackware-security php SSA:2014-356-02 New php packages are available for Slackware 14.0, 14.1, and -current to fix security issues. Here are the details from the Slackware 14.1 ChangeLog: +--------------------------+...
SoX buffer overflows
Buffer overflows on wav parsing...
[oCERT-2014-010] SoX input sanitization errors
2014-010 SoX input sanitization errors Description: The SoX project is an open source tool for sound processing. The sox command line tool is affected by two heap-based buffer overflows, respectively located in functions startread and AdpcmReadBlock. A specially crafted wav file can be used to...
Firebird DoS
NULL pointer dereference...