47153 matches found
HP SiteScope authentication bypass
No description provided...
[oCERT-2014-004] Ansible input sanitization errors
2014-004 Ansible input sanitization errors Description: The Ansible project is an open source configuration management platform. The Ansible platform suffers from input sanitization errors that allow arbitrary code execution as well as information leak, in case an attacker is able to control...
SEC Consult SA-20140630-0 :: Multiple vulnerabilities in IBM Algorithmics RICOS
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory 20140630-0 ======================================================================= title: Multiple severe vulnerabilities product: IBM Algorithmics RICOS vulnerable version: 4.5.0 - 4.7.0 fixed version:...
Lime Survey 2-05+ Multiple Vulnerabilities
Lime Survey Multiple Vulnerabilities ======================================================================= ADVISORY INFORMATION Title: Lime Survey Multiple Vulnerabilities Discovery date: 02/07/2014 Release date: 03/07/2014 Vendor Homepage: www.limesurvey.org Version: Lime Survey 2.05+ Build...
Multiple Cross-Site Scripting (XSS) in WP Google Maps WordPress Plugin
Advisory ID: HTB23236 Product: WP Google Maps WordPress plugin Vendor: WP Google Maps Vulnerable Versions: 6.0.26 and probably prior Tested Version: 6.0.26 Advisory Publication: September 24, 2014 without technical details Vendor Notification: September 24, 2014 Vendor Patch: September 29, 2014...
IP.Board 3.4 cross-site scripting in Referer header
+-------------------------------------------------------------------- + + IP.Board 3.4 cross-site scripting in Referer header + +-------------------------------------------------------------------- + vendor site........: http://www.invisionpower.com + Affected Software .: IP.Board 3.4 + Class...
CVE-2014-4331 OctavoCMS reflected XSS vulnerability
This proprietary content management software is vulnerable to reflected XSS on the file admin/viewer.php, src parameter. Current release on their demo site is vulnerable, same as other few sites I could find. PoC:...
SEC Consult SA-20140710-3 :: Design Issue / Password Disclosure in WAGO-I/O-SYSTEM with CODESYS V2.3 WebVisu
SEC Consult Vulnerability Lab Security Advisory 20140710-3 ======================================================================= title: Design Issue / Password Disclosure product: All WAGO-I/O-SYSTEMs which provide a CODESYS V2.3 WebVisu vulnerable version: Systems which are programmable with =...
SEC Consult SA-20140710-2 :: Multiple critical vulnerabilites in Schrack MICROCONTROL emergency light system
SEC Consult Vulnerability Lab Security Advisory 20140710-2 ======================================================================= title: Multiple critical vulnerabilites product: Schrack MICROCONTROL emergency light system vulnerable version: before 1.7.0 937 fixed version: 1.7.0 937 impact:...
Schrack MICROCONTROL multiple security vulnerabilities
Multiple bugs in web interface...
SEC Consult SA-20140710-1 :: Multiple high risk vulnerabilities in Shopizer webshop
SEC Consult Vulnerability Lab Security Advisory 20140710-1 ======================================================================= title: Multiple high risk vulnerabilities in Shopizer webshop product: Shopizer vulnerable version: 1.1.5 and below fixed version: v2 new codebase impact: high...
CVE-2014-3149 - Reflected Cross-Site Scripting (XSS) in "Invision Power IP.Board"
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2014-3149 =================== "Reflected Cross-Site Scripting XSS" CWE-79 vulnerability in "Invision Power IP.Board" product Vendor =================== Invision Power Services Inc. Product =================== IP.Board "IP.Board is the leading...
Weak Local Database Credentials in Infoblox Network Automation
Product: Network Automation • NetMRI • Switch Port Manager • Automation Change Manager • Security Device Controller Vendor: InfoBlox Vulnerable Versions: 6.4.X.X-6.8.4.X Tested Version: 6.8.2.11 Vendor Notification: May 12th, 2014 Public Disclosure: July 9th, 2014 Vulnerability Type: OS Command...
[oCERT-2014-004] Ansible input sanitization errors
2014-004 Ansible input sanitization errors Description: The Ansible project is an open source configuration management platform. The Ansible platform suffers from input sanitization errors that allow arbitrary code execution as well as information leak, in case an attacker is able to control...
[KIS-2014-08] OpenCart <= 1.5.6.4 (cart.php) PHP Object Injection Vulnerability
----------------------------------------------------------------- OpenCart = 1.5.6.4 cart.php PHP Object Injection Vulnerability ----------------------------------------------------------------- - Software Link: http://www.opencart.com/ - Affected Versions: Version 1.5.6.4 and prior versions. -...
LiveZilla 5.3.0.7 Security Issue
I had reported few xss issues on LiveZilla 5.3.0.7 . They fixed it properly and informed me. Now latest build is 5.3.0.8 / 2014-09-25. http://changelog.livezilla.net/ Can you help me regarding CVE. I can send you the vulnerability details...
Reflected Cross-Site Scripting (XSS) in MaxButtons WordPress Plugin
Advisory ID: HTB23237 Product: MaxButtons WordPress plugin Vendor: Max Foundry Vulnerable Versions: 1.26.0 and probably prior Tested Version: 1.26.0 Advisory Publication: September 24, 2014 without technical details Vendor Notification: September 24, 2014 Vendor Patch: October 2, 2014 Public...
[SECURITY] [DSA 2982-1] ruby-activerecord-3.2 security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2982-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff July 19, 2014 http://www.debian.org/security/faq -...
[security bulletin] HPSBMU03059 rev.1 - HP SiteScope, Remote Authentication Bypass
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04355129 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04355129 Version: 1 HPSBMU03059 rev....
[security bulletin] HPSBMU03064 rev.1 - HP Universal CMDB, Remote Information Disclosure, Execution of Code
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04357076 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04357076 Version: 1 HPSBMU03064 rev....
CVE-2014-3863 - Stored XSS in JChatSocial
CVE-2014-3863 =================== "Stored Cross-Site Scripting XSS" CWE-79 vulnerability in "JChatSocial" Joomla extension. Vendor =================== Joomla! Extensions Store Product =================== JChatSocial: the Joomla live chat "JChatSocial is a powerful chat system for Joomla with a lo...
two browser mem disclosure bugs (CVE-2014-1580 and CVE-something-or-other)
First of all, CVE-2014-1580 MSFA 2014-78 is a bug that caused Firefox prior to version 33 released today to leak bits of uninitialized memory when rendering certain types of truncated images onto canvas. Mozilla's advisory is here: https://www.mozilla.org/security/announce/2014/mfsa2014-78.html B...
SEC Consult SA-20140716-0 :: Multiple SSRF vulnerabilities in Alfresco Community Edition
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory 20140716-0 ======================================================================= title: Multiple SSRF vulnerabilities product: Alfresco Community Edition vulnerable version: =4.2.f fixed version: 5.0.a...
IBM Algorithmics RICOS multiple security vulnerabilities
Information leakage, crossite scripting, CSRF, privilege escalation, unauthorized accesss...
LPAR2RRD code execution
No description provided...
Kunena Forum Extension for Joomla Multiple SQL Injection Vulnerabilities
Kunena forum extension for Joomla multiple SQL injection vulnerabilities Class: Input Validation Error CVE: N/A Remote: Yes Local: No Published: 02/07/2014 Credit: Raymond Rizk of Dionach [email protected] Vendor: Kunena Vulnerable: Kunena v3.0.5 Solution Status: Fixed by Vendor Kunena Forum is...
[security bulletin] HPSBMU03061 rev.1 - HP Release Control, Disclosure of Privileged Information and Elevation of Privilege
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04352674 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04352674 Version: 1 HPSBMU03061 rev....
Web Login Bruteforce in Symantec Endpoint Protection Manager 12.1.4023.4080
We discovered a vulnerability in the Symantec Endpoint Protection Manager web application. Vulnerability Type: Login Bruteforce Original Release: June 20, 2014 Discovered by: Security Team - A2SECURE Artлm Tsvetkov [email protected] Sisco Barrera [email protected] Andrea Bodei...
Kerio Control <= 8.3.1 Boolean-based blind SQL Injection
Document Title: ====================== Kerio Control = 8.3.1 Boolean-based blind SQL Injection Primary Informations: ====================== Product Name: Kerio Control Software Description: Kerio Control brings together multiple capabilities including a network firewall and router, intrusion...
SEC Consult SA-20141015-0 :: Potential Cross-Site Scripting in ADF Faces
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory 20141015-0 ======================================================================= title: Potential Cross-Site Scripting product: ADF Faces vulnerable version: 12.1.2.0 fixed version: versions with CPU...
[oCERT-2014-005] LPAR2RRD input sanitization errors
2014-005 LPAR2RRD input sanitization errors Description: LPAR2RRD is a performance monitoring and capacity planning software for IBM Power Systems. LPAR2RRD generates historical, future trends and nearly "real-time" CPU utilization graphs of LPAR's and shared CPU usage. Insufficient input...
Web Encryption Extension security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Revision: 1.0 Last Updated: 25 July 2014 First Published: 25 July 2014 Summary: A security issue was found in the Web Encryption Extension. Authenticated users are able to modify the content of https request fields to insert code into the pipeline...
HP Release Control уязвимости безопасности
Privilege escalation, information leakage...
SEC Consult SA-20140710-0 :: Multiple critical vulnerabilities in Shopizer webshop
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory 20140710-0 ======================================================================= title: Multiple critical vulnerabilities in Shopizer webshop product: Shopizer vulnerable version: 1.1.5 and below fixed...
Kerio Control SQL injection
SQL injection in Web interface...
[SECURITY] [DSA 2983-1] drupal7 security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2983-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff July 20, 2014 http://www.debian.org/security/faq -...
HP Universal CMDB security vulnerabilities
Information leakage, code execution...
Mozilla Firefox and Microsoft Internet Explorer information leakage
Memory content leakage is possible on crafted image parsing...
Kunena Forum Extension for Joomla Multiple Reflected Cross-Site Scripting Vulnerabilities
Kunena forum extension for Joomla multiple reflected cross-site scripting vulnerabilities Class: Input Validation Error CVE N/A Remote Yes Local No Published 02/07/2014 Credit Raymond Rizk of Dionach [email protected] Vendor Kunena Vulnerable Kunena v3.0.5 Solution Status: Fixed by Vendor Kunena...
Ansible security vulnerabilities
Code execution, privilege escalation...
Easy file sharing web server - persist XSS in forum msgs
I saw a posting a month or 2 ago for a BOF in an FTP server belonging to EFS Software here: http://www.securityfocus.com/bid/19243 At first there was no additional details provided and I hunted up and down before finding it after some fuzzing stack smash in password. While on the hunt, I found on...
OS Command Injection Infoblox Network Automation
Product: Network Automation, licensed as: • NetMRI • Switch Port Manager • Automation Change Manager • Security Device Controller Vendor: Infoblox Vulnerable Versions: 6.4.X.X-6.8.4.X Tested Version: 6.8.2.11 Vendor Notification: May 12th, 2014 Vendor Patch Availability to Customers: May 16th, 20...
Cross-site Scripting in EventLog Analyzer 9.0 build #9000
We discovered a vulnerability in the EventLog Analyzer web application. Vulnerability Type: Cross-site Scripting Original Release: June 20, 2014 Discovered by: Security Team - A2SECURE Artлm Tsvetkov [email protected] Sisco Barrera [email protected] Andrea Bodei [email protected]...
EMC RSA Identity Management and Governance authentication bypass
Authentication bypass if NovellIM is used...
SQL Injection in Dolphin
Advisory ID: HTB23216 Product: Dolphin Vendor: BoonEx Vulnerable Versions: 7.1.4 and probably prior Tested Version: 7.1.4 Advisory Publication: May 21, 2014 without technical details Vendor Notification: May 21, 2014 Vendor Patch: June 17, 2014 Public Disclosure: June 18, 2014 Vulnerability Type:...
[ MDVSA-2014:162 ] catfish
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:162 http://www.mandriva.com/en/support/security/ Package : catfish Date : September 2, 2014 Affected: Business Server 1.0 Problem Description: Updated catfish package fixes security vulnerability: Untrusted...
CVE-2014-5391 DOM-based Cross-Site Scripting (XSS) in "JobScheduler"
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2014-5391 =================== "DOM-based Cross-Site Scripting XSS" CWE-79 vulnerability in "JobScheduler" product Vendor =================== Software- & Organisations-Service GmbH Product =================== "JobScheduler is a workload automation...
ownCloud Unencrypted Private Key Exposure
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Senderek Web Security - Security Advisory ownCloud Unencrypted Private Key Exposure ========================================= https://senderek.ie/archive/2014/owncloudunencryptedprivatekeyexposure.php Revision: 1.00 Last Updated: 3 Aug 2014 Summary: I...
Reflected Cross-Site Scripting (XSS) Vulnerability in Storesprite
Advisory ID: HTB23215 Product: Storesprite Vendor: Lamp Design Limited Vulnerable Versions: 7 and probably prior Tested Version: 7 Advisory Publication: May 14, 2014 without technical details Vendor Notification: May 14, 2014 Vendor Patch: June 19, 2014 Public Disclosure: June 25, 2014...