47153 matches found
CVE-2014-4973 - Privilege Escalation in ESET Windows Products
Vulnerability title: Privilege Escalation in ESET Windows Products CVE: CVE-2014-4973 Vendor: ESET Product: ESET Windows Products Affected version: v5.0 - 7.0 Firewall Module Build 1183 20140214 and earlier Fixed version: v6 - v7 Firewall Module Build 1212 20140609 Reported by: Kyriakos Economou...
IBM Maximo: Cross-site Scripting Vulnerability Addressed in Asset and Service Management (CVE-2014-0914 and -0915)
Two classes of persistent XSS issues we reported in IBM Maximo a month or two back are now fixed: http://www.pentestpartners.com/blog/further-ibm-maximo-asset-management-vulnerabilities-reported/ Individual bulletins linked from the above, but tl;dr is I would suggest patching, as this could...
[USN-2320-1] Oxide vulnerabilities
========================================================================== Ubuntu Security Notice USN-2320-1 August 20, 2014 oxide-qt vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...
CVE-2014-5035 - Opendaylight Vulnerable to Local and Remote File Inclusion in the Netconf (TCP) Service
Title =================== Opendaylight Vulnerable to Local and Remote File Inclusion in the Netconf TCP Service Summary =================== Opendaylight www.opendaylight.com is vulnerable to Local and Remote File Inclusion in the Netconf TCP Service via an External Entity Injection XXE...
XXE Injection in HP Release Control
Hello! I'll give you additional information concerning advisory HP Release Control Authenticated XXE Exploit http://1337day.com/exploit/description/22267. Three different vulnerabilities were used in this exploit for successful attack. For my attack it's needed to use only one vulnerability exact...
EMC RSA Archer multiple security vulnerabilities
CSRF, Pribilege escalation, unauthorized access...
[CVE-2014-0232] Apache OFBiz Cross-site scripting (XSS) vulnerability
CVE-2014-0232: Apache OFBiz Cross-site scripting XSS vulnerability Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache OFBiz 11.04.01 to 11.04.04 Apache OFBiz 12.04.01 to 11.04.03 The unsupported Apache OFBiz 09.04.x, 10.04.x versions may be also affected...
CVE-2014-5307 - Privilege Escalation in Panda Security Products
Vulnerability title: Privilege Escalation in Panda Security CVE: CVE-2014-5307 Vendor: Panda Security Product: Multiple Affected version: Panda 2014 Products Fixed version: Hotfix hft131306s24r1 Reported by: Kyriakos Economou Details: Latest, and possibly earlier builds, of the PavTPK.sys kernel...
Panda Security privilege escalation
Privilege escalation via PavTPK.sys driver...
Zyxel P660RT2 multiple security vulnerabilities
Crossite scripting, CSRF, password bruteforce...
MITKRB5-SA-2014-001 Buffer overrun in kadmind with LDAP backend
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 MITKRB5-SA-2014-001 MIT krb5 Security Advisory 2014-001 Original release: 2014-08-07 Last update: 2014-08-07 Topic: Buffer overrun in kadmind with LDAP backend CVSSv2 Vector: AV:N/AC:M/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C CVSSv2 Base Score: 8.5 Access...
[CVE-2014-5335] CSRF in Innovaphone PBX
Title: Innovaphone PBX Admin-GUI CSRF Impact: High CVSS2 Score: 7.8 AV:N/AC:M/Au:S/C:P/I:C/A:C/E:F/RL:U/RC:C Announced: August 21, 2014 Reporter: Rainer Giedat NSIDE ATTACK LOGIC GmbH, www.nsideattacklogic.de Products: Innovaphone PBX Administration GUI Affected Versions: all known versions teste...
ESA-2014-073: EMC Documentum Multiple Cross-Site Request Forgery Vulnerabilities
ESA-2014-073.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-073: EMC Documentum Multiple Cross-Site Request Forgery Vulnerabilities EMC Identifier: ESA-2014-073 CVE Identifier: CVE-2014-2518 Severity Rating: CVSS v2 Base Score: 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P Affected products: • EMC...
LSE Leading Security Experts GmbH - LSE-2014-07-13 - Granding Grand MA 300 - Weak Pin Verification
=== LSE Leading Security Experts GmbH - Security Advisory 2014-07-13 === Grand MA 300 Fingerprint Reader - Weak Pin Verification ------------------------------------------------------------------------ Affected Versions ================= Grand MA 300/ID with firmware 6.60 Issue Overview...
BlackBerry Z10 authentication bypass
Authentication bypass via SMB...
[USN-2316-1] Subversion vulnerabilities
========================================================================== Ubuntu Security Notice USN-2316-1 August 14, 2014 subversion vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives:...
Apache Subversion multiple security vulnerabilities
DoS, information leakage, certificate validation bypass...
HP Release Control XXE vulnerability
Few SSI possibilities...
[USN-2315-1] serf vulnerability
========================================================================== Ubuntu Security Notice USN-2315-1 August 14, 2014 serf vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubunt...
XSS, FPD and RCE vulnerabilities in DZS Video Gallery for WordPress
Hello 3APA3A! These are Cross-Site Scripting, Full path disclosure and OS Commanding vulnerabilities in plugin DZS Video Gallery for WordPress. Earlier I've disclosed Content Spoofing and Cross-Site Scripting vulnerabilities in this plugin http://securityvulns.ru/docs30871.html...
BF and XSS vulnerabilities in Zyxel P660RT2 EE
Hello 3APA3A! These are Brute Force and Cross-Site Scripting vulnerabilities in Zyxel P660RT2 EE ADSL Router. ------------------------- Affected products: ------------------------- Vulnerable is the next model: Zyxel P660RT2 EE. ZyNOS Firmware Version: V3.40 AXN.1. This model with other firmware...
[SECURITY] [DSA 3009-1] python-imaging security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3009-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff August 21, 2014 http://www.debian.org/security/faq -...
Python Imaging Library DoS
DoS on icns decoding...
BlackBerry Z 10 - Storage and Access File-Exchange Authentication By-Pass [MZ-13-04]
--------------------------------------------------------------------- modzero Security Advisory: BlackBerry Z 10 - Storage and Access File-Exchange Authentication By-Pass MZ-13-04 ---------------------------------------------------------------------...
[SECURITY] [DSA 3010-1] python-django security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3010-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso August 22, 2014 http://www.debian.org/security/faq -...
[ MDVSA-2014:156 ] ocsinventory
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:156 http://www.mandriva.com/en/support/security/ Package : ocsinventory Date : August 7, 2014 Affected: Business Server 1.0 Problem Description: Updated ocsinventory packages fix security vulnerability:...
Pro Chat Rooms v8.2.0 - Multiple Vulnerabilities
Exploit Title: Pro Chat Rooms v8.2.0 - Multiple Vulnerabilities Google Dork: intitle:"Powered by Pro Chat Rooms" Date: 5 August 2014 Exploit Author: Mike Manzotti @ Dionach Ltd Vendor Homepage: http://prochatrooms.com Software Link: http://prochatrooms.com/software.php Version: v8.2.0 Tested on:...
[SECURITY] [DSA 2999-1] drupal7 security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2999-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso August 09, 2014 http://www.debian.org/security/faq -...
[SECURITY] [DSA 3001-1] wordpress security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3001-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso August 09, 2014 http://www.debian.org/security/faq -...
SEC Consult SA-20140805-0 :: Multiple vulnerabilities in Readsoft Invoice Processing and Process Director
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory 20140805-0 ======================================================================= title: Multiple vulnerabilities product: Readsoft Invoice Processing / Process Director vulnerable version: Invoice...
Node Browserify RCE vuln (<= 4.2.0)
Hello, Discovered an RCE vuln in Browserify =4.2.0. Maintainer patched upstream just 4 hours after responsible disclosure yesterday, now fixed as of 4.2.1. Summary and POC found here: http://iops.io/blog/browserify-rce-vulnerability/ Cal...
Ganeti weak permissions
Weak archives permissions...
IPv6 DoS
Forget ICMPv6 PTB can break communication between two hosts...
[oCERT-2014-006] Ganeti insecure archive permission
2014-006 Ganeti insecure archive permission Description: Ganeti, an open source virtualisation manager, suffers from an insecure file permission vulnerability that leads to sensitive information disclosure. The Ganeti upgrade command 'gnt-cluster upgrade' creates an archive of the current...
Apache OpenOffice security vulnerabilities
Code execution, information leakage...
[USN-2322-1] OpenStack Glance vulnerability
========================================================================== Ubuntu Security Notice USN-2322-1 August 21, 2014 glance vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...
OpenStack multiple security vulnerabilities
Ceilometer information leakage, Neutron information leakage and DoS, Glance DoS, Horizon crossite scripting, Keystone restrictions bypass and privilege escalation, Nova timing attacks...
[USN-2323-1] OpenStack Horizon vulnerabilities
========================================================================== Ubuntu Security Notice USN-2323-1 August 21, 2014 horizon vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...
CVE-2014-3524: Apache OpenOffice Calc Command Injection Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2014-3524 OpenOffice Calc Command Injection Vulnerability Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache OpenOffice 4.1.0 and older on Windows. OpenOffice.org versions may also be affected. Description: The...
[USN-2325-1] OpenStack Nova vulnerability
========================================================================== Ubuntu Security Notice USN-2325-1 August 21, 2014 nova vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubunt...
[USN-2311-2] OpenStack Ceilometer vulnerability
========================================================================== Ubuntu Security Notice USN-2311-2 August 21, 2014 ceilometer vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...
DoS attacks (ICMPv6-based) resulting from IPv6 EH drops
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Folks, Ten days ago or so we published this I-D: http://www.ietf.org/internet-drafts/draft-gont-v6ops-ipv6-ehs-in-real-world-00.txt Section 5.2 of the I-D discusses a possible attack vector based on a combination of "forged" ICMPv6 PTB messages and IP...
[USN-2321-1] OpenStack Neutron vulnerabilities
========================================================================== Ubuntu Security Notice USN-2321-1 August 21, 2014 neutron vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...
CVE-2014-3575:OpenOffice Targeted Data Exposure Using Crafted OLE Objects
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2014-3575 OpenOffice Targeted Data Exposure Using Crafted OLE Objects Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache OpenOffice 4.1.0 and older on Windows. OpenOffice.org versions are also affected. Descriptio...
[USN-2324-1] OpenStack Keystone vulnerabilities
========================================================================== Ubuntu Security Notice USN-2324-1 August 21, 2014 keystone vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...
Outlook.com for Android insufficient certificate validation
Server certificate is not checked...
CVE-2014-3577: Apache HttpComponents client: Hostname verification susceptible to MITM attack
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Security Advisory - Apache Software Foundation Apache HttpComponents / hc.apache.org Hostname verification susceptible to MITM attack CVE-2014-3577 / CVSS 1.4 Apache HttpComponents prior to revision 4.3.5/4.0.2 may be susceptible to a 'Man in the Midd...
[USN-2318-1] Linux kernel vulnerabilities
========================================================================== Ubuntu Security Notice USN-2318-1 August 18, 2014 linux vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...
Outlook.com for Android fails to validate server certificates
------------------------------------------------------------------------ Outlook.com for Android fails to validate server certificates ------------------------------------------------------------------------ Yorick Koster, April 2014...