47153 matches found
MIT krb5 privilege escalation
Under some conditions, kadm5randkeyprincipal3 returns old keys...
AST-2014-012: Mixed IP address families in access control lists may permit unwanted traffic.
Asterisk Project Security Advisory - AST-2014-012 Product Asterisk Summary Mixed IP address families in access control lists may permit unwanted traffic. Nature of Advisory Unauthorized Access Susceptibility Remote unauthenticated sessions Severity Moderate Exploits Known No Reported On 25 Octobe...
[ MDVSA-2014:215 ] gnutls
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:215 http://www.mandriva.com/en/support/security/ Package : gnutls Date : November 19, 2014 Affected: Business Server 1.0 Problem Description: Updated gnutls package fix security vulnerability: An out-of-boun...
LibreOffice use-after-free vulnereability
Ingress remote control protocol use-after-free, memory corruption in OLE preview...
[USN-2411-1] mountall vulnerability
========================================================================== Ubuntu Security Notice USN-2411-1 November 18, 2014 mountall vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...
[ MDVSA-2014:213 ] curl
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:213 http://www.mandriva.com/en/support/security/ Package : curl Date : November 18, 2014 Affected: Business Server 1.0 Problem Description: Updated curl packages fix security vulnerability: Symeon Paraschoud...
libcurl information leakage
Memory content leakage via POST...
CVE-2014-8769 tcpdump unreliable output using malformed AOVD payload
CVE-2014-8769 tcpdump unreliable output using malformed AOVD payload 1. Background tcpdump is a powerful command-line packet analyzer. It allows the user to intercept and display TCP/IP and other packets being transmitted or received over a network to which the computer is attached. 2. Summary...
Microsoft Active Directory Federation Services information leakage
It's possible to access closed session...
Microsoft SharePoint Server crossite scripting
Stored XSS...
Microsoft Office multiple security vulnerabilities
Few different memory corruptions on different documents parsing...
FreeBSD Security Advisory FreeBSD-SA-14:26.ftp
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-14:26.ftp Security Advisory The FreeBSD Project Topic: Remote command execution in ftp1 Category: core Module: ftp Announced: 2014-11-04 Credits: Jared McNeill,...
FreeBSd ftp code execution
Shell characters vulnerability on server response parsing...
IL and CSRF vulnerabilities in D-Link DAP-1360
Hello 3APA3A! There are Information Leakage and Cross-Site Request Forgery vulnerabilities in D-Link DAP-1360 Wi-Fi Access Point and Router. ------------------------- Affected products: ------------------------- Vulnerable is the next model: D-Link DAP-1360, Firmware 1.0.0. This model with other...
KL-001-2014-004 : VMWare vmx86.sys Arbitrary Kernel Read
Title: VMWare vmx86.sys Arbitrary Kernel Read Advisory ID: KL-001-2014-004 Publication Date: 2014.11.04 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2014-004.txt 1. Vulnerability Details Affected Vendor: VMWare Affected Product: Workstation Affected Version: 10.0.0.40273...
CVE-2014-6616 Softing FG-100 Webui XSS
COMPASS SECURITY ADVISORY http://www.csnc.ch/en/downloads/advisories.html Product: Softing FG-100 PB Vendor: Softing AG www.softing.com CVD ID: CVE-2014-6616 Subject: XSS Risk: High Effect: Remotely exploitable Author: Johannes Klick Daniel Marzin Ingmar Rosenhagen Date: 05.11.2014 Introduction:...
SEC Consult SA-20141106-0 :: XXE & XSS & Arbitrary File Write vulnerabilities in Symantec Endpoint Protection
SEC Consult Vulnerability Lab Security Advisory 20141106-0 ======================================================================= title: XXE & XSS & Arbitrary File Write vulnerabilities product: Symantec Endpoint Protection vulnerable version: 12.1.4023.4080 fixed version: 12.1.5 RU 5 impact:...
ZTE modems multiple security vulnereabilities
Multiple vulnerabilities in Web interface...
CA Cloud Service Management multiple security vulnerabilities
Replay-атаки, XSS, XXE, token validation vulnerability...
CA20141103-01: Security Notice for CA Cloud Service Management
-----BEGIN PGP SIGNED MESSAGE----- CA20141103-01: Security Notice for CA Cloud Service Management Issued: November 3, 2014 CA Technologies Support is alerting customers to four resolved vulnerabilities with CA Cloud Service Management. Four vulnerabilities existed that could potentially allow a...
Softing FG-100 security vulnerabilities
Backdoor accounts, crossite scripting...
FreeBSD information leakage
Kernel information disclosure in setlogin/getlogin calls...
Open-Xchange SQL injection
SQLi in jslob API...
FreeBSD OpenSSH DoS
Race condition because of invalid thread-safe library linking...
ZTE ZXDSL 831 Multiple Cross Site Scripting
TR-069 Client page: Stored. executes when users go to http://192.168.1.1/tr69cfg.html...
Symantec Endpoint Protection multiple security vulnerabilities
XSS, XXE, unauthroized files access...
ZTE ZXDSL 831CII Direct Object Reference
The modem usually serves html files & protects them with HTTP Basic authentication. however, the cgi files, does not get this protection. so simply requesting any cgi file without no authentication would give a remote attacker full access to the modem and then can easily be used to root the modem...
[SECURITY] [DSA 3066-1] qemu security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3066-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso November 06, 2014 http://www.debian.org/security/faq -...
ESA-2014-135: RSA® Web Threat Detection SQL Injection Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-135: RSA® Web Threat Detection SQL Injection Vulnerability EMC Identifier: ESA-2014-135 CVE Identifier: CVE-2014-4627 Severity Rating: CVSS v2 Base Score: 9 AV:N/AC:L/Au:S/C:C/I:C/A:C Affected Products: RSA Web Threat Detection 4.x versions...
Open-Xchange Security Advisory 2014-11-07
Product: OX App Suite Vendor: Open-Xchange GmbH Internal reference: 34765 Bug ID Vulnerability type: SQL Injection CWE-89 Vulnerable version: 7.6.0 and earlier Vulnerable component: backend Report confidence: Confirmed Solution status: Fixed by Vendor Researcher credits: SoftScheck GmbH Fixed...
CVE-2014-6617 Softing FG-100 Backdoor Account
COMPASS SECURITY ADVISORY http://www.csnc.ch/en/downloads/advisories.html Product: Softing FG-100 PB Vendor: Softing AG www.softing.com CVD ID: CVE-2014-6617 Subject: Backdoor Account Risk: High Effect: Remotely exploitable Author: Ingmar Rosenhagen Daniel Marzin Johannes Klick Date: 05.11.2014...
FreeBSD Security Advisory FreeBSD-SA-14:25.setlogin
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-14:25.setlogin Security Advisory The FreeBSD Project Topic: Kernel stack disclosure in setlogin2 / getlogin2 Category: core Module: kernel Announced: 2014-11-04...
Vulnerabilities in D-Link DAP-1360
Hello 3APA3A! There are Abuse of Functionality, Brute Force and Cross-Site Request Forgery vulnerabilities in D-Link DAP-1360 Wi-Fi Access Point and Router. ------------------------- Affected products: ------------------------- Vulnerable is the next model: D-Link DAP-1360, Firmware 1.0.0. This...
VMWare Workstation / Player DoS
Uninitialized potiner dereference on IOCTL processing...
RSA Web Threat Detection SQL injection
SQL injection by authenticated user...
ZTE 831CII Multiple Vulnerablities
Hardcoded default misconfiguration - The modem comes with admin:admin user credintials. Stored XSS - http://192.168.1.1/psilan.cgi?action=saveðIpAddress=192.168.1.1ðSubnetMask=255.255.255.0&hostname=ZXDSL83C1II&domainname=home27;alert28029;//&enblUpnp=1&enblLan2=0 Any user browsing to...
FreeBSD Security Advisory FreeBSD-SA-14:24.sshd [REVISED]
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-14:24.sshd Security Advisory The FreeBSD Project Topic: Denial of service attack against sshd8 Category: contrib Module: openssh Announced: 2014-11-04 Credits:...
Cisco RV multiple security vulnerabilities
Files access, code execution, crossite scripting...
Cisco RV Series multiple vulnerabilities
------------------------------------------------------------------------ Cisco RV Series multiple vulnerabilities ------------------------------------------------------------------------ Yorick Koster, June 2013 ------------------------------------------------------------------------ Abstract...
Cisco Security Advisory: Multiple Vulnerabilities in Cisco Small Business RV Series Routers
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Multiple Vulnerabilities in Cisco Small Business RV Series Routers Advisory ID: cisco-sa-20141105-rv Revision 1.0 For Public Release 2014 November 5 16:00 UTC GMT...
FileBug v1.5.1 iOS - Path Traversal Web Vulnerability
Document Title: =============== FileBug v1.5.1 iOS - Path Traversal Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1342 Release Date: ============= 2014-10-15 Vulnerability Laboratory ID VL-ID: ==================================== 1342...
Pidgin multiple security vulnerabilities
Insufficient certificate validation, emoticons parsing DoS, Groupwise messages DoS, information leakages via XMPP...
WebDisk+ v2.1 iOS - Code Execution Vulnerability
Document Title: =============== WebDisk+ v2.1 iOS - Code Execution Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1349 Release Date: ============= 2014-10-23 Vulnerability Laboratory ID VL-ID: ==================================== 1349 Comm...
Aircrack-ng multiple security vulnerabilities
DoS conditions, buffer overflow, integer overflow...
quassel information leakage
Memory content leakage, DoS...
[ MDVSA-2014:212 ] wget
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:212 http://www.mandriva.com/en/support/security/ Package : wget Date : October 29, 2014 Affected: Business Server 1.0 Problem Description: Updated wget package fixes security vulnerability: Wget was...
SEC Consult SA-20141029-0 :: Multiple critical vulnerabilities in Vizensoft Admin Panel
SEC Consult Vulnerability Lab Security Advisory 20141029-0 ======================================================================= title: Multiple critical vulnerabilities product: Vizensoft Admin Panel vulnerable version: 2014 fixed version: - impact: critical homepage: http://www.vizensoft.com...
Dell SonicWall GMS v7.2.x - Persistent Web Vulnerability
Document Title: =============== Dell SonicWall GMS v7.2.x - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1222 Release Date: ============= 2014-10-21 Vulnerability Laboratory ID VL-ID: ====================================...
Multiple vulnerabilities in EspoCRM
Advisory ID: HTB23238 Product: EspoCRM Vendor: http://www.espocrm.com Vulnerable Versions: 2.5.2 and probably prior Tested Version: 2.5.2 Advisory Publication: October 8, 2014 without technical details Vendor Notification: October 8, 2014 Vendor Patch: October 10, 2014 Public Disclosure: October...
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...