Lime Survey 2-05+ Multiple Vulnerabilities

Lime Survey Multiple Vulnerabilities ======================================================================= ADVISORY INFORMATION Title: Lime Survey Multiple Vulnerabilities Discovery date: 02/07/2014 Release date: 03/07/2014 Vendor Homepage: www.limesurvey.org Version: Lime Survey 2.05+ Build...

[oCERT-2014-004] Ansible input sanitization errors

2014-004 Ansible input sanitization errors Description: The Ansible project is an open source configuration management platform. The Ansible platform suffers from input sanitization errors that allow arbitrary code execution as well as information leak, in case an attacker is able to control...

IP.Board 3.4 cross-site scripting in Referer header

+-------------------------------------------------------------------- + + IP.Board 3.4 cross-site scripting in Referer header + +-------------------------------------------------------------------- + vendor site........: http://www.invisionpower.com + Affected Software .: IP.Board 3.4 + Class...

Schrack MICROCONTROL multiple security vulnerabilities

Multiple bugs in web interface...

SEC Consult SA-20140710-2 :: Multiple critical vulnerabilites in Schrack MICROCONTROL emergency light system

SEC Consult Vulnerability Lab Security Advisory 20140710-2 ======================================================================= title: Multiple critical vulnerabilites product: Schrack MICROCONTROL emergency light system vulnerable version: before 1.7.0 937 fixed version: 1.7.0 937 impact:...

[SE-2014-01] Breaking Oracle Database through Java exploits (details)

Hello All, Oracle Oct 2014 CPU addresses 22 security issues affecting Java VM implementation embedded in Oracle Database software. We have published details of the fixed issues and a description of some privilege elevation techniques abusing a complete Java security sandbox bypass condition for...

WAGO-I/O-SYSTEM WebVisu information leakage

User passwords can be retrieved...

Symantec Endpoint Protection Manager bruteforce

Login attempts are not limited...

CVE-2014-3149 - Reflected Cross-Site Scripting (XSS) in "Invision Power IP.Board"

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2014-3149 =================== "Reflected Cross-Site Scripting XSS" CWE-79 vulnerability in "Invision Power IP.Board" product Vendor =================== Invision Power Services Inc. Product =================== IP.Board "IP.Board is the leading...

Backdoor access to Techboard/Syac devices

ADVISORY INFORMATION Title: Backdoor access to Techboard/Syac devices Discovery date: 02/04/2014 Release date: 07/07/2014 Advisory URL: http://blog.emaze.net/2014/07/backdoor-techboardsyac.html Credits: Roberto Paleari @rpaleari, Luca Giancane [email protected] VULNERABILITY INFORMATION...

Multiple Cross-Site Scripting (XSS) in WP Google Maps WordPress Plugin

Advisory ID: HTB23236 Product: WP Google Maps WordPress plugin Vendor: WP Google Maps Vulnerable Versions: 6.0.26 and probably prior Tested Version: 6.0.26 Advisory Publication: September 24, 2014 without technical details Vendor Notification: September 24, 2014 Vendor Patch: September 29, 2014...

[SECURITY] CVE-2014-3503 Apache Syncope

cve-2014-3503.txt.asc -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2014-3503: Insecure Random implementations used to generate passwords in Apache Syncope Severity: Major Vendor: The Apache Software Foundation Versions Affected: This vulnerability affects all versions of Apache Syncope 1.1.x...

two browser mem disclosure bugs (CVE-2014-1580 and CVE-something-or-other)

First of all, CVE-2014-1580 MSFA 2014-78 is a bug that caused Firefox prior to version 33 released today to leak bits of uninitialized memory when rendering certain types of truncated images onto canvas. Mozilla's advisory is here: https://www.mozilla.org/security/announce/2014/mfsa2014-78.html B...

[security bulletin] HPSBMU03064 rev.1 - HP Universal CMDB, Remote Information Disclosure, Execution of Code

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04357076 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04357076 Version: 1 HPSBMU03064 rev....

[KIS-2014-08] OpenCart <= 1.5.6.4 (cart.php) PHP Object Injection Vulnerability

----------------------------------------------------------------- OpenCart = 1.5.6.4 cart.php PHP Object Injection Vulnerability ----------------------------------------------------------------- - Software Link: http://www.opencart.com/ - Affected Versions: Version 1.5.6.4 and prior versions. -...

[security bulletin] HPSBMU03059 rev.1 - HP SiteScope, Remote Authentication Bypass

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04355129 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04355129 Version: 1 HPSBMU03059 rev....

Reflected Cross-Site Scripting (XSS) in MaxButtons WordPress Plugin

Advisory ID: HTB23237 Product: MaxButtons WordPress plugin Vendor: Max Foundry Vulnerable Versions: 1.26.0 and probably prior Tested Version: 1.26.0 Advisory Publication: September 24, 2014 without technical details Vendor Notification: September 24, 2014 Vendor Patch: October 2, 2014 Public...

Kunena Forum Extension for Joomla Multiple SQL Injection Vulnerabilities

Kunena forum extension for Joomla multiple SQL injection vulnerabilities Class: Input Validation Error CVE: N/A Remote: Yes Local: No Published: 02/07/2014 Credit: Raymond Rizk of Dionach [email protected] Vendor: Kunena Vulnerable: Kunena v3.0.5 Solution Status: Fixed by Vendor Kunena Forum is...

Weak Local Database Credentials in Infoblox Network Automation

Product: Network Automation • NetMRI • Switch Port Manager • Automation Change Manager • Security Device Controller Vendor: InfoBlox Vulnerable Versions: 6.4.X.X-6.8.4.X Tested Version: 6.8.2.11 Vendor Notification: May 12th, 2014 Public Disclosure: July 9th, 2014 Vulnerability Type: OS Command...

IBM Algorithmics RICOS multiple security vulnerabilities

Information leakage, crossite scripting, CSRF, privilege escalation, unauthorized accesss...

[oCERT-2014-004] Ansible input sanitization errors

2014-004 Ansible input sanitization errors Description: The Ansible project is an open source configuration management platform. The Ansible platform suffers from input sanitization errors that allow arbitrary code execution as well as information leak, in case an attacker is able to control...

[security bulletin] HPSBMU03061 rev.1 - HP Release Control, Disclosure of Privileged Information and Elevation of Privilege

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04352674 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04352674 Version: 1 HPSBMU03061 rev....

[SECURITY] [DSA 2982-1] ruby-activerecord-3.2 security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2982-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff July 19, 2014 http://www.debian.org/security/faq -...

CVE-2014-3863 - Stored XSS in JChatSocial

CVE-2014-3863 =================== "Stored Cross-Site Scripting XSS" CWE-79 vulnerability in "JChatSocial" Joomla extension. Vendor =================== Joomla! Extensions Store Product =================== JChatSocial: the Joomla live chat "JChatSocial is a powerful chat system for Joomla with a lo...

LiveZilla 5.3.0.7 Security Issue

I had reported few xss issues on LiveZilla 5.3.0.7 . They fixed it properly and informed me. Now latest build is 5.3.0.8 / 2014-09-25. http://changelog.livezilla.net/ Can you help me regarding CVE. I can send you the vulnerability details...

LPAR2RRD code execution

No description provided...

SEC Consult SA-20140716-0 :: Multiple SSRF vulnerabilities in Alfresco Community Edition

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory 20140716-0 ======================================================================= title: Multiple SSRF vulnerabilities product: Alfresco Community Edition vulnerable version: =4.2.f fixed version: 5.0.a...

SEC Consult SA-20140710-0 :: Multiple critical vulnerabilities in Shopizer webshop

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory 20140710-0 ======================================================================= title: Multiple critical vulnerabilities in Shopizer webshop product: Shopizer vulnerable version: 1.1.5 and below fixed...

Easy file sharing web server - persist XSS in forum msgs

I saw a posting a month or 2 ago for a BOF in an FTP server belonging to EFS Software here: http://www.securityfocus.com/bid/19243 At first there was no additional details provided and I hunted up and down before finding it after some fuzzing stack smash in password. While on the hunt, I found on...

Mozilla Firefox and Microsoft Internet Explorer information leakage

Memory content leakage is possible on crafted image parsing...

HP Universal CMDB security vulnerabilities

Information leakage, code execution...

HP Release Control уязвимости безопасности

Privilege escalation, information leakage...

Ansible security vulnerabilities

Code execution, privilege escalation...

Kerio Control SQL injection

SQL injection in Web interface...

[SECURITY] [DSA 2983-1] drupal7 security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2983-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff July 20, 2014 http://www.debian.org/security/faq -...

OS Command Injection Infoblox Network Automation

Product: Network Automation, licensed as: • NetMRI • Switch Port Manager • Automation Change Manager • Security Device Controller Vendor: Infoblox Vulnerable Versions: 6.4.X.X-6.8.4.X Tested Version: 6.8.2.11 Vendor Notification: May 12th, 2014 Vendor Patch Availability to Customers: May 16th, 20...

Kerio Control <= 8.3.1 Boolean-based blind SQL Injection

Document Title: ====================== Kerio Control = 8.3.1 Boolean-based blind SQL Injection Primary Informations: ====================== Product Name: Kerio Control Software Description: Kerio Control brings together multiple capabilities including a network firewall and router, intrusion...

SEC Consult SA-20141015-0 :: Potential Cross-Site Scripting in ADF Faces

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory 20141015-0 ======================================================================= title: Potential Cross-Site Scripting product: ADF Faces vulnerable version: 12.1.2.0 fixed version: versions with CPU...

Web Encryption Extension security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Revision: 1.0 Last Updated: 25 July 2014 First Published: 25 July 2014 Summary: A security issue was found in the Web Encryption Extension. Authenticated users are able to modify the content of https request fields to insert code into the pipeline...

Cross-site Scripting in EventLog Analyzer 9.0 build #9000

We discovered a vulnerability in the EventLog Analyzer web application. Vulnerability Type: Cross-site Scripting Original Release: June 20, 2014 Discovered by: Security Team - A2SECURE Artлm Tsvetkov [email protected] Sisco Barrera [email protected] Andrea Bodei [email protected]...

[oCERT-2014-005] LPAR2RRD input sanitization errors

2014-005 LPAR2RRD input sanitization errors Description: LPAR2RRD is a performance monitoring and capacity planning software for IBM Power Systems. LPAR2RRD generates historical, future trends and nearly "real-time" CPU utilization graphs of LPAR's and shared CPU usage. Insufficient input...

Kunena Forum Extension for Joomla Multiple Reflected Cross-Site Scripting Vulnerabilities

Kunena forum extension for Joomla multiple reflected cross-site scripting vulnerabilities Class: Input Validation Error CVE N/A Remote Yes Local No Published 02/07/2014 Credit Raymond Rizk of Dionach [email protected] Vendor Kunena Vulnerable Kunena v3.0.5 Solution Status: Fixed by Vendor Kunena...

Web Login Bruteforce in Symantec Endpoint Protection Manager 12.1.4023.4080

We discovered a vulnerability in the Symantec Endpoint Protection Manager web application. Vulnerability Type: Login Bruteforce Original Release: June 20, 2014 Discovered by: Security Team - A2SECURE Artлm Tsvetkov [email protected] Sisco Barrera [email protected] Andrea Bodei...

serf / Apache httpcomponents HttpClient / Jakarta Commons HttpClient SSL validation bypass

Invalid parsing of certificates with NUL character in CN...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

[USN-2383-1] wpa_supplicant vulnerability

========================================================================== Ubuntu Security Notice USN-2383-1 October 14, 2014 wpa, wpasupplicant vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its...

ownCloud Unencrypted Private Key Exposure

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Senderek Web Security - Security Advisory ownCloud Unencrypted Private Key Exposure ========================================= https://senderek.ie/archive/2014/owncloudunencryptedprivatekeyexposure.php Revision: 1.00 Last Updated: 3 Aug 2014 Summary: I...

[ MDVSA-2014:162 ] catfish

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:162 http://www.mandriva.com/en/support/security/ Package : catfish Date : September 2, 2014 Affected: Business Server 1.0 Problem Description: Updated catfish package fixes security vulnerability: Untrusted...

CVE-2014-5391 DOM-based Cross-Site Scripting (XSS) in "JobScheduler"

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2014-5391 =================== "DOM-based Cross-Site Scripting XSS" CWE-79 vulnerability in "JobScheduler" product Vendor =================== Software- & Organisations-Service GmbH Product =================== "JobScheduler is a workload automation...

SQL Injection in Dolphin

Advisory ID: HTB23216 Product: Dolphin Vendor: BoonEx Vulnerable Versions: 7.1.4 and probably prior Tested Version: 7.1.4 Advisory Publication: May 21, 2014 without technical details Vendor Notification: May 21, 2014 Vendor Patch: June 17, 2014 Public Disclosure: June 18, 2014 Vulnerability Type:...