47153 matches found
[oss-security] PowerDNS Security Advisory 2014-02
Hi everybody, Please be aware of PowerDNS Security Advisory 2014-02 http://doc.powerdns.com/md/security/powerdns-advisory-2014-02/, which you can also find below. The good news is that the currently released version of the PowerDNS Recursor is safe. The bad news is that users of older versions wi...
[SECURITY] [DSA 3096-1] pdns-recursor security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3096-1 [email protected] http://www.debian.org/security/ Sebastien Delafond December 11, 2014 http://www.debian.org/security/faq -...
[security bulletin] HPSBMU03043 rev.1 - HP Smart Update Manager for Windows and Linux, Local Disclosure of Information
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04302476 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04302476 Version: 1 HPSBMU03043 rev....
FreeBSD stdlib fflush vulnereability
Under some condition, heap buffer overflow can be caused by invalid fflush behavior...
FreeBSD Security Advisory FreeBSD-SA-14:28.file
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-14:28.file Security Advisory The FreeBSD Project Topic: Multiple vulnerabilities in file1 and libmagic3 Category: contrib Module: file Announced: 2014-12-10...
ISC bind named DoS
Crash on recursive query parsing. Crash on GeoIP handling...
FreeBSD Security Advisory FreeBSD-SA-14:29.bind
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-14:29.bind Security Advisory The FreeBSD Project Topic: BIND remote denial of service vulnerability Category: contrib Module: bind Announced: 2014-12-10 Credits...
FreeBSD Security Advisory FreeBSD-SA-14:27.stdio
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-14:27.stdio Security Advisory The FreeBSD Project Topic: Buffer overflow in stdio Category: core Module: libc Announced: 2014-12-10 Credits: Adrian Chadd and...
OpenSSL multiple security vulnerabilities
Poodle attack. Protocol version downgrade to SSL 3.0. Memory leaks in SRTP and session tickets. Insufficient no-ssl3 protection. Data leakage via padding attack...
[oss-security] CVE question: Return of POODLE
Hi All, Before i ask my question: It seems some TLS implementations may be vulnerable to POODLE like attack if they use SSL 3.0 type padding and the padding bytes are not checked by the implementation. https://www.imperialviolet.org/2014/12/08/poodleagain.html...
[SECURITY] [DSA 3087-1] qemu security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3087-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso December 04, 2014 http://www.debian.org/security/faq -...
Mozilla Firefox / Thunderbird / Seamonkey multiple security vulnerabilities
Memory corruptions, buffer overflows, information leakage, DoS, privilege escalation...
ESA-2014-156: EMC Documentum Content Server Insecure Direct Object Reference Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-156: EMC Documentum Content Server Insecure Direct Object Reference Vulnerability EMC Identifier: ESA-2014-156 CVE Identifier: CVE-2014-4629 Severity Rating: CVSS v2 Base Score: 8.2 AV:N/AC:M/Au:S/C:C/I:P/A:C Affected products: • All EMC...
[oCERT-2014-009] JasPer input sanitization errors
2014-009 JasPer input sanitization errors Description: The JasPer project is an open source implementation for the JPEG-2000 codec. The library is affected by two heap-based buffer overflows which can lead to arbitrary code execution. The vulnerability is present in functions jpcdeccpsetfromcox a...
qemu multiple security vulnerabilities
Multiple memory corruptions, DoS, information leakage...
tcpdump multiple security vulnerabilities
DoS, code execution, information leakage...
[SECURITY] [DSA 3086-1] tcpdump security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3086-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso December 03, 2014 http://www.debian.org/security/faq -...
D-Link DAP-1360 multiple security vulnerabilities
Crossite request forgery, information leakage, crossite scripting in web interface...
IBM Endpoint Manager code execution
Code execution in Mobile Device Management Components...
[RT-SA-2014-012] Unauthenticated Remote Code Execution in IBM Endpoint Manager Mobile Device Management Components
Advisory: Unauthenticated Remote Code Execution in IBM Endpoint Manager Mobile Device Management Components During a penetration test, RedTeam Pentesting discovered that several IBM Endpoint Manager Components are based on Ruby on Rails and use static secrettoken values. With these values,...
OpenVPN DoS
DoS after authentication via control characters...
CSRF and XSS vulnerabilities in D-Link DAP-1360
Hello 3APA3A! There are Cross-Site Request Forgery and Cross-Site Scripting vulnerabilities in D-Link DAP-1360 Wi-Fi Access Point and Router. In addition to previous Abuse of Functionality, Brute Force, Information Leakage, Cross-Site Request Forgery and Cross-Site Scripting vulnerabilities in...
[USN-2430-1] OpenVPN vulnerability
========================================================================== Ubuntu Security Notice USN-2430-1 December 02, 2014 openvpn vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...
EntryPass N5200 information leakage
Memory content leakage...
[ MDVSA-2014:228 ] phpmyadmin
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:228 http://www.mandriva.com/en/support/security/ Package : phpmyadmin Date : November 26, 2014 Affected: Business Server 1.0 Problem Description: Multiple vulnerabilities has been discovered and corrected in...
[ MDVSA-2014:237 ] perl-Mojolicious
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:237 http://www.mandriva.com/en/support/security/ Package : perl-Mojolicious Date : November 28, 2014 Affected: Business Server 1.0 Problem Description: Updated perl-Mojolicious package fixes security...
PicsArt Photo Studio missed SSL certificate check
No description provided...
Prey Anti-Theft for Android missing SSL certificate validation [STIC-2014-0731]
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Fundacion Dr. Manuel Sadosky - Programa STIC Advisory www.fundacionsadosky.org.ar Prey Anti-Theft for Android missing SSL certificate validation 1. Advisory Information Title: Prey Anti-Theft for Android missing SSL certificate validation Advisory ID:...
NetFlow Analyzer security vulnerabilities
Directory traversal...
Modx CMS CSRF Bypass & XSS Vulnerabilities
Public Disclosure - http://hacktivity.websecgeeks.com/modx-csrf-and-xss/ =========================================== Product: MODX Revolution Severity: Critical Versions: 2.0.0–2.2.14 Vulnerability type: CSRF & XSS Report date: 2014-Jul-10 Fixed date: 2014-Jul-15 Description A significant...
[ MDVSA-2014:221 ] php-smarty
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:221 http://www.mandriva.com/en/support/security/ Package : php-smarty Date : November 21, 2014 Affected: Business Server 1.0 Problem Description: References: https://vulners.com/cve/CVE-2012-4437...
MercadoLibre missing SSL certificate checks
No description provided...
Prey Anti-theft missing SSL certificate check
No description provided...
CVE-2014-8419 - CodeMeter Weak Service Permissions
CodeMeter Weak Service Permissions Vendor Website : http://www.codemeter.com INDEX --------------------------------------- 1. Background 2. Description 3. Affected Products 4. Vulnerability 5. Solution 6. Credit 7. Disclosure Timeline 8. CVE 1. BACKGROUND ---------------------------------------...
Reflected Cross-Site Scripting (XSS) in Simple Email Form Joomla Extension
Advisory ID: HTB23241 Product: Simple Email Form Joomla Extension Vendor: Doug Bierer Vulnerable Versions: 1.8.5 and probably prior Tested Version: 1.8.5 Advisory Publication: October 29, 2014 without technical details Vendor Notification: October 29, 2014 Public Disclosure: November 19, 2014...
CVE-2014-3629: Apache Qpid's qpidd can be induced to make http requests
Apache Software Foundation - Security Advisory Apache Qpid's qpidd can be induced to make http requests CVE-2014-3629 CVS: 3 Severity: Low Vendor: The Apache Software Foundation Versions Affected: Apache Qpid's qpidd up to and including version 0.30, where xml exchange module is loaded Descriptio...
[CORE-2014-0010] - Advantech WebAccess Stack-based Buffer Overflow
Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Advantech WebAccess Stack-based Buffer Overflow 1. Advisory Information Title: Advantech WebAccess Stack-based Buffer Overflow Advisory ID: CORE-2014-0010 Advisory URL:...
[ MDVSA-2014:233 ] wordpress
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:233 http://www.mandriva.com/en/support/security/ Package : wordpress Date : November 27, 2014 Affected: Business Server 1.0 Problem Description: Updated wordpress package fixes security vulnerabilities: XSS ...
Advantech EKI-6340 code execution
Shell commands injection in Web interface...
CVE-2014-8683 XSS in Gogs Markdown Renderer
-----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 XSS in Gogs Markdown Renderer ============================= Researcher: Timo Schmid [email protected] Description =========== GogsGo Git Service is a painless self-hosted Git Service written in Go. taken from 1 It is very similiar to the github...
CVE-2014-8732
CVE-2014-8732 CVSSv2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:H/RL:U/RC:C CVSSv2 Base Score=7.5 CVSSv2 Temp Score=7.5 OWASP Top 10 classification: A3 - Cross Site Scripting There is a stored xss vulnerability in phpMemcachedAdmin. Most of the user-specified input fields which are displayed on several...
Vulnerabilities in D-Link DCS-2103
Hello 3APA3A! There are Directory Traversal and Full path disclosure vulnerabilities in D-Link DCS-2103 IP camera. ------------------------- Affected products: ------------------------- Vulnerable is the next model: D-Link DCS-2103, Firmware 1.0.0. This model with other firmware versions also mus...
[USN-2410-1] Oxide vulnerabilities
========================================================================== Ubuntu Security Notice USN-2410-1 November 19, 2014 oxide-qt vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives:...
[USN-2407-1] OpenStack Nova vulnerabilities
========================================================================== Ubuntu Security Notice USN-2407-1 November 11, 2014 nova vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...
[The ManageOwnage Series, part IX]: 0-day arbitrary file download in NetFlow Analyzer and IT360
Hi, This is part 9 of the ManageOwnage series. For previous parts see 1. Today we have yet another 0 day - an arbitrary file download vulnerability that be exploited unauthenticated in NetFlow Analyzer and authenticated in IT360. I'm releasing this as a 0 day because ManageEngine have been making...
[SECURITY] [DSA 3083-1] mutt security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3083-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso November 30, 2014 http://www.debian.org/security/faq -...
Arbitrary File Upload in HelpDEZk
Advisory ID: HTB23239 Product: HelpDEZk Vendor: HelpDEZk Vulnerable Versions: 1.0.1 and probably prior Tested Version: 1.0.1 Advisory Publication: October 15, 2014 without technical details Vendor Notification: October 15, 2014 Public Disclosure: November 5, 2014 Vulnerability Type: Unrestricted...
Missing SSL certificate validation in MercadoLibre app for Android [STIC-2014-0211]
Fundacion Dr. Manuel Sadosky - Programa STIC Advisory www.fundacionsadosky.org.ar Missing SSL certificate validation in MercadoLibre app for Android 1. Advisory Information Title: Missing SSL cert validation in MercadoLibre app for Android Advisory ID: STIC-2014-0211 Advisory URL:...
[RT-SA-2014-011] EntryPass N5200 Credentials Disclosure
Advisory: EntryPass N5200 Credentials Disclosure EntryPass N5200 Active Network Control Panels allow the unauthenticated downloading of information that includes the current administrative username and password. Details ======= Product: EntryPass N5200 Active Network Control Panel Affected...