47153 matches found
IBM Maximo: Cross-site Scripting Vulnerability Addressed in Asset and Service Management (CVE-2014-0914 and -0915)
Two classes of persistent XSS issues we reported in IBM Maximo a month or two back are now fixed: http://www.pentestpartners.com/blog/further-ibm-maximo-asset-management-vulnerabilities-reported/ Individual bulletins linked from the above, but tl;dr is I would suggest patching, as this could...
ESA-2014-073: EMC Documentum Multiple Cross-Site Request Forgery Vulnerabilities
ESA-2014-073.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-073: EMC Documentum Multiple Cross-Site Request Forgery Vulnerabilities EMC Identifier: ESA-2014-073 CVE Identifier: CVE-2014-2518 Severity Rating: CVSS v2 Base Score: 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P Affected products: • EMC...
Kolibri WebServer buffer overflow
Buffer overlow on oversized POST request...
MIT krb5 kadmind buffer overflow
Buffer overflow via LDAP...
MEHR Automation System Arbitrary File Download Vulnerability(persian portal)
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Title : MEHR Automation System Arbitrary File Download Vulnerabilitypersian portal Author : alieye vendor : http://shakhesrayane.ir/ Contact : [email protected] Risk : High Class: Remote Google Dork: intext:"[email protected]"...
[USN-2320-1] Oxide vulnerabilities
========================================================================== Ubuntu Security Notice USN-2320-1 August 20, 2014 oxide-qt vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...
Panda Security privilege escalation
Privilege escalation via PavTPK.sys driver...
[USN-2311-1] pyCADF vulnerability
========================================================================== Ubuntu Security Notice USN-2311-1 August 11, 2014 python-pycadf vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives...
[USN-2316-1] Subversion vulnerabilities
========================================================================== Ubuntu Security Notice USN-2316-1 August 14, 2014 subversion vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives:...
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
ESA-2014-059: EMC Documentum Multiple Cross-Site Scripting Vulnerabilities
ESA-2014-059.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-059: EMC Documentum Multiple Cross-Site Scripting Vulnerabilities EMC Identifier: ESA-2014-059 CVE Identifier: CVE-2014-2511 Severity Rating: CVSS v2 Base Score: 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P Affected products: • EMC WebTop...
XSS and CSRF vulnerabilities in Zyxel P660RT2 EE
Hello 3APA3A! These are Cross-Site Scripting and Cross-Site Request Forgery vulnerabilities in Zyxel P660RT2 EE ADSL Router. ------------------------- Affected products: ------------------------- Vulnerable is the next model: Zyxel P660RT2 EE. ZyNOS Firmware Version: V3.40 AXN.1. This model with...
ESA-2014-067: EMC Documentum D2 Privilege Escalation Vulnerability
ESA-2014-067.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-067: EMC Documentum D2 Privilege Escalation Vulnerability EMC Identifier: ESA-2014-067 CVE Identifier: CVE-2014-2515 Severity: CVSSv2 Base Score: 8.5 AV:N/AC:M/Au:S/C:C/I:C/A:C Affected products: • EMC Documentum D2 3.1 and...
pyCADF information leakage
Authentication tokens leakage...
Python Imaging Library DoS
DoS on icns decoding...
[SECURITY] [DSA 2997-1] reportbug security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2997-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso August 05, 2014 http://www.debian.org/security/faq -...
MITKRB5-SA-2014-001 Buffer overrun in kadmind with LDAP backend
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 MITKRB5-SA-2014-001 MIT krb5 Security Advisory 2014-001 Original release: 2014-08-07 Last update: 2014-08-07 Topic: Buffer overrun in kadmind with LDAP backend CVSSv2 Vector: AV:N/AC:M/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C CVSSv2 Base Score: 8.5 Access...
CVE-2014-4973 - Privilege Escalation in ESET Windows Products
Vulnerability title: Privilege Escalation in ESET Windows Products CVE: CVE-2014-4973 Vendor: ESET Product: ESET Windows Products Affected version: v5.0 - 7.0 Firewall Module Build 1183 20140214 and earlier Fixed version: v6 - v7 Firewall Module Build 1212 20140609 Reported by: Kyriakos Economou...
[USN-2315-1] serf vulnerability
========================================================================== Ubuntu Security Notice USN-2315-1 August 14, 2014 serf vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubunt...
ArcGIS for Server Vulnerability Disclosure
Product: ArcGIS for Server Vendor: ESRI Vulnerable Version: 10.1.1 Tested Version: 10.1.1 Vendor Notification: June 19, 2014 Public Disclosure: August 15, 2014 Vulnerability Type: Cross-Site Scripting CWE-79 CVE Reference: CVE-2014-5121 Risk Level: Medium CVSSv2 Base Score: 4.3...
ntopng XSS
XSS in web interface...
Deutsche Telekom CERT Advisory [DTC-A-20140820-001] check_mk vulnerabilities
Deutsche Telekom CERT Advisory DTC-A-20140820-001 Summary: Several vulnerabilities were found in checkmk prior versions 1.2.4p4 and 1.2.5i4. The vulnerabilities are: 1 - Reflected Cross-Site Scripting XSS 2 - write access to config files .mk files 3 - arbitrary code execution Recommendations:...
[CVE-2014-0232] Apache OFBiz Cross-site scripting (XSS) vulnerability
CVE-2014-0232: Apache OFBiz Cross-site scripting XSS vulnerability Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache OFBiz 11.04.01 to 11.04.04 Apache OFBiz 12.04.01 to 11.04.03 The unsupported Apache OFBiz 09.04.x, 10.04.x versions may be also affected...
TomatoCart v1.x (latest-stable) Multiple Vulnerabilities
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2014-3978 - Remote SQL Injection Vulnerability CVE-2014-3830 - Reflected Cross Site Scripting - ------------------------------------------------------------------------------ Title: TomatoCart v1.x latest-stable Remote SQL Injection Vulnerability...
[CVE-2014-5335] CSRF in Innovaphone PBX
Title: Innovaphone PBX Admin-GUI CSRF Impact: High CVSS2 Score: 7.8 AV:N/AC:M/Au:S/C:P/I:C/A:C/E:F/RL:U/RC:C Announced: August 21, 2014 Reporter: Rainer Giedat NSIDE ATTACK LOGIC GmbH, www.nsideattacklogic.de Products: Innovaphone PBX Administration GUI Affected Versions: all known versions teste...
Grand MA 300 Fingerprint Reader insufficient encryption
PIN code is not encrypted during transfer...
ESA-2014-079: EMC Documentum Content Server Multiple Vulnerabilities
ESA-2014-079.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-079: EMC Documentum Content Server Multiple Vulnerabilities EMC Identifier: ESA-2014-079 CVE Identifier: See below for individual CVEs Severity Rating: CVSS v2 Base Score: See below for individual CVSS score for each CVE...
Apache Subversion multiple security vulnerabilities
DoS, information leakage, certificate validation bypass...
[SECURITY] [DSA 3011-1] mediawiki security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3011-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso August 23, 2014 http://www.debian.org/security/faq -...
ntopng 1.2.0 XSS injection using monitored network traffic
ntopng 1.2.0 XSS injection using monitored network traffic ntopng is the next generation version of the original ntop, a network traffic probe and monitor that shows the network usage, similar to what the popular top Unix command does. The web-based frontend of the software is vulnerable to...
APPLE-SA-2014-08-13-1 Safari 6.1.6 and Safari 7.0.6
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-08-13-1 Safari 6.1.6 and Safari 7.0.6 Safari 6.1.6 and Safari 7.0.6 are now available and address the following: WebKit Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5, OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.4 Impact...
[USN-2322-1] OpenStack Glance vulnerability
========================================================================== Ubuntu Security Notice USN-2322-1 August 21, 2014 glance vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...
[USN-2323-1] OpenStack Horizon vulnerabilities
========================================================================== Ubuntu Security Notice USN-2323-1 August 21, 2014 horizon vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...
[USN-2325-1] OpenStack Nova vulnerability
========================================================================== Ubuntu Security Notice USN-2325-1 August 21, 2014 nova vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubunt...
[oCERT-2014-006] Ganeti insecure archive permission
2014-006 Ganeti insecure archive permission Description: Ganeti, an open source virtualisation manager, suffers from an insecure file permission vulnerability that leads to sensitive information disclosure. The Ganeti upgrade command 'gnt-cluster upgrade' creates an archive of the current...
[USN-2321-1] OpenStack Neutron vulnerabilities
========================================================================== Ubuntu Security Notice USN-2321-1 August 21, 2014 neutron vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...
[USN-2311-2] OpenStack Ceilometer vulnerability
========================================================================== Ubuntu Security Notice USN-2311-2 August 21, 2014 ceilometer vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...
Apache OpenOffice security vulnerabilities
Code execution, information leakage...
IPv6 DoS
Forget ICMPv6 PTB can break communication between two hosts...
CVE-2014-3575:OpenOffice Targeted Data Exposure Using Crafted OLE Objects
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2014-3575 OpenOffice Targeted Data Exposure Using Crafted OLE Objects Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache OpenOffice 4.1.0 and older on Windows. OpenOffice.org versions are also affected. Descriptio...
DoS attacks (ICMPv6-based) resulting from IPv6 EH drops
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Folks, Ten days ago or so we published this I-D: http://www.ietf.org/internet-drafts/draft-gont-v6ops-ipv6-ehs-in-real-world-00.txt Section 5.2 of the I-D discusses a possible attack vector based on a combination of "forged" ICMPv6 PTB messages and IP...
[USN-2324-1] OpenStack Keystone vulnerabilities
========================================================================== Ubuntu Security Notice USN-2324-1 August 21, 2014 keystone vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...
Ganeti weak permissions
Weak archives permissions...
OpenStack multiple security vulnerabilities
Ceilometer information leakage, Neutron information leakage and DoS, Glance DoS, Horizon crossite scripting, Keystone restrictions bypass and privilege escalation, Nova timing attacks...
CVE-2014-3524: Apache OpenOffice Calc Command Injection Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2014-3524 OpenOffice Calc Command Injection Vulnerability Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache OpenOffice 4.1.0 and older on Windows. OpenOffice.org versions may also be affected. Description: The...
Outlook.com for Android insufficient certificate validation
Server certificate is not checked...
Apache HttpClient certificate checking bypass
Validation bypass via malcrafted constructions like O="foo,CN=www.apache.org”...
[USN-2318-1] Linux kernel vulnerabilities
========================================================================== Ubuntu Security Notice USN-2318-1 August 18, 2014 linux vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...
Outlook.com for Android fails to validate server certificates
------------------------------------------------------------------------ Outlook.com for Android fails to validate server certificates ------------------------------------------------------------------------ Yorick Koster, April 2014...