47153 matches found
[oss-security] Re: CVE request: PHP configure script and Lynis tool /tmp/ issues reported on full disclosure
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 39 if "$OS" = "AIX" ; then 40 TMPFILE=/tmp/lynis.$$ We can make a CVE assignment corresponding to your disclosure of this lynis.$$ issue on oss-security. Use CVE-2014-3982. A CVE for this most likely won't or shouldn't have a...
[oss-security] CVE request: PHP heap-based buffer overflow in DNS TXT record parsing
Good morning, Stefan Esser pointed out that the following commit fixes a heap-based buffer overflow in DNS TXT record parsing: https://github.com/php/php-src/commit/b34d7849ed90ced9345f8ea1c59bc8d101c18468 A malicious server or man-in-the-middle attacker could possibly use this flaw to execute...
[oss-security] CVE request: OpenAFS 1.6.8 TMAY fileserver crashes
New code introduced in OpenAFS 1.6.8 does not properly zero fields in the host structure in the OpenAFS fileserver, leading to some variables in the host structure being left initialized from recycled heap memory. While no mechanism for exploitation is currently known, the affected file server...
[oss-security] CVE request for commons-beanutils: 'class' property is exposed, potentially leading to RCE
Hi All I have raised this twice with [email protected], on 30 April and June 3. I have received no response either time, therefore I am raising it on oss-security. CVE-2014-0114 describes a well-known issue in Apache Struts 1: "It was found that the Struts 1 ActionForm object allowed access to...
PHP security vulnerabilities
Symbolic links vulnerabilities, dnsgetrecord buffer overflow...
squid DoS
DoS via Range: request if SSL-Bump is allowed...
DNN (DotNetNuke®) dnnUI_NewsArticlesSlider Module Arbitrary File Download Vulnerability
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Title : DNN DotNetNuke® dnnUINewsArticlesSlider Module Arbitrary File Download Vulnerability Author : alieye vendor : http://www.dnnui.com/ , http://store.dnnsoftware.com/ Contact : [email protected] Risk : High Class: Remote Google Dork:...
CodeIgniter <= 2.1.4 Session Decoding Vulnerability
Class Weak encryption Remote Yes Published 6th June 2014 Credit Robin Bailey of Dionach [email protected] Vulnerable CodeIgniter = 2.1.4 Session cookies created by the CodeIgniter PHP framework contain a number of variables in a serialized PHP array. To prevent users from tampering with this cook...
CoSoSys Endpoint Protector multiple security vulnerabilities
Backdoor accounts, SQL injections, information disclosure...
PowerDNS DoS
DoS via decriptors exhaustion...
CVE-2014-2843 - "Reflected Cross-Site Scripting (XSS)" (CWE-79) vulnerability in "infoware MapSuite"
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2014-2843 =================== "Reflected Cross-Site Scripting XSS" CWE-79 vulnerability in "infoware MapSuite" Vendor =================== infoware GmbH Product =================== MapSuite Affected versions =================== This vulnerability...
[RT-SA-2014-006] Directory Traversal in DevExpress ASP.NET File Manager
Advisory: Directory Traversal in DevExpress ASP.NET File Manager During a penetration test RedTeam Pentesting discovered a directory traversal vulnerability in DevExpress' ASP.NET File Manager and File Upload. Attackers are able to read arbitrary files by specifying a relative path. Details =====...
[RT-SA-2014-005] SQL Injection in webEdition CMS File Browser Installer Script
Advisory: SQL Injection in webEdition CMS File Browser RedTeam Pentesting discovered an SQL injection vulnerability in the file browser component of webEdition CMS during a penetration test. Unauthenticated attackers can get read-only access on the SQL database used by webEdition and read for...
LE, BF and IAA vulnerabilities in Catapulta I.W. Edition
Hello 3APA3A! These are Login Enumeration, Brute Force and Insufficient Anti-automation vulnerabilities in Catapulta I.W. Edition. This is commercial CMS. It's used at web site of one presidential contender in Ukraine the elections were last Sunday, where I found these vulnerabilities at...
[KIS-2014-07] Dotclear <= 2.6.2 (categories.php) SQL Injection Vulnerability
-------------------------------------------------------------- Dotclear = 2.6.2 categories.php SQL Injection Vulnerability -------------------------------------------------------------- - Software Link: http://dotclear.org/ - Affected Versions: Version 2.6.2 and probably prior versions. -...
DNN (DotNetNuke®) EasyDnnGallery Module Arbitrary File Download Vulnerability
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Title : DNN DotNetNuke® EasyDnnGallery Module Arbitrary File Download Vulnerability Author : alieye vendor : http://www.easydnnsolutions.com/ , http://store.dnnsoftware.com/ Contact : [email protected] Risk : High Class: Remote Google Dork...
CVE-2014-1226 s3dvt Root shell (still)
CVE-2014-1226 s3dvt Root shell still About s3dvt: s3dvt is part of the 3d network display server which can be used as 3d desktop environment. Vulnerability: The s3dvt developers forgot to review all the code. There is still a vulnerable function as in the previous CVE-2013-6825. At the date of Ju...
multiple Vulnerability in "WahmShoppes eStore"
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Title : multiple Vulnerability in "WahmShoppes eStore" Author : alieye vendor : http://www.wahmshoppes.com/ Contact : [email protected] Risk : High Class: Remote Google Dork: inurl:WsError.asp inurl:store/ We apologize but your request...
[KIS-2014-05] Dotclear <= 2.6.2 (XML-RPC Interface) Authentication Bypass Vulnerability
------------------------------------------------------------------------- Dotclear = 2.6.2 XML-RPC Interface Authentication Bypass Vulnerability ------------------------------------------------------------------------- - Software Link: http://dotclear.org/ - Affected Versions: Version 2.6.2 and...
Mybb Sendthread Page Denial of Service Vulnerability
Denial of Service Vulnerability In Mybb 1.6.13 and old version !/usr/bin/perl @@@ @@@@@@@@@@@ @@@@@ @@@@@@@@@@ @@@ @@@@@@@ @@@ @@@@@@@@@@@ @@@ @@ @@@ @@ @@@ @@@@@@@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@@@@@@@@@ @@@ @ @@@@@@@@@@ @@@ @@@@@@ @@@ @@@@@@@@@@@ @@@...
DNN (DotNetNuke®) CodeEditor Module Arbitrary File Download Vulnerability
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Title : DNN DotNetNuke® CodeEditor Module Arbitrary File Download Vulnerability Author : alieye vendor : http://www.mediaant.com/ , http://store.dnnsoftware.com/ Contact : [email protected] Risk : High Class: Remote Google Dork:...
[SECURITY] [DSA 2946-1] python-gnupg security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2946-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff June 04, 2014 http://www.debian.org/security/faq -...
FCKedtior 2.6.10 Reflected Cross-Site Scripting (XSS)
Class Cross-Site Scripting Remote Yes Published 2nd June 2014 Credit Robin Bailey of Dionach [email protected] Vulnerable FCKeditor = 2.6.10 FCKeditor is prone to a reflected cross-site scripting XSS vulnerability due to inadequately sanitised user input. An attacker may leverage this issue to ru...
[SECURITY] [DSA 2957-1] mediawiki security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2957-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst June 12, 2014 http://www.debian.org/security/faq -...
[oss-security] CVE request: PowerDNS in default configuration is vulnerable to DoS attack
It was found 1 that in default configuration PowerDNS is allowed to consume more file descriptors than is available for a default installation of many Linux distributions. Default configuration is: 2 threads / 2048 max-mthreads, which leads to a theoretical FD consumption of 4096. Default FD limi...
SEC Consult SA-20140521-0 :: Multiple critical vulnerabilities in CoSoSys Endpoint Protector 4
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory 20140521-0 ======================================================================= title: Multiple vulnerabilities product: CoSoSys Endpoint Protector 4 vulnerable version: all - except issue 1 fixed...
[SECURITY] [DSA 2948-1] python-bottle security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2948-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff June 04, 2014 http://www.debian.org/security/faq -...
ESA-2014-046: EMC Documentum Content Server Multiple Vulnerabilities
ESA-2014-046.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-046: EMC Documentum Content Server Multiple Vulnerabilities EMC Identifier: ESA-2014-046 CVE Identifier: CVE-2014-2506, CVE-2014-2507, CVE-2014-2508 Severity Rating: CVSS v2 Base Score: See below for individual scores Affecte...
[CVE-2014-2577] XSS on Transform Foundation Server 4.3.1 and 5.2 from Bottomline Technologies
I. VULNERABILITY ------------------------- Reflected XSS Attacks vulnerabilities in Transform Foundation server 4.3.1 and 5.2 from Bottomline Technologies II. BACKGROUND ------------------------- Bottomline offers powerful, next-generation electronic document solutions for formatting, personalizi...
[USN-2218-1] Xalan-Java vulnerability
========================================================================== Ubuntu Security Notice USN-2218-1 May 21, 2014 libxalan2-java vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: ...
DNN (DotNetNuke®) eventscalendar Module Arbitrary File Download Vulnerability
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Title : DNN DotNetNuke® eventscalendar Module Arbitrary File Download Vulnerability Author : alieye vendor : http://www.invenmanager.com/ , http://store.dnnsoftware.com/ Contact : [email protected] Risk : High Class: Remote Google Dork:...
[Onapsis Security Advisory 2014-020] SAP SLD Information Tampering
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Onapsis Security Advisory 2014-020: SAP SLD Information Tampering 1. Impact on Business ===================== By exploiting this vulnerability, a remote unauthenticated attacker might be able to modify technical information about the SAP systems...
python-PGP code execution
Shell injections...
CVE-2014-2233 - "Server-Side Request Forgery" (CWE-918) vulnerability in "infoware MapSuite"
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2014-2233 =================== "Server-Side Request Forgery" CWE-918 vulnerability in "infoware MapSuite" Vendor =================== infoware GmbH Product =================== MapSuite Affected versions =================== This vulnerability affects...
[SECURITY] [DSA 2934-1] python-django security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2934-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso May 19, 2014 http://www.debian.org/security/faq -...
CVE-2013-6825 DCMTK Root Privilege escalation
CVE-2013-6825 DCMTK Root Privilege escalation About DCMTK: DCMTK is a collection of libraries and applications implementing large parts the DICOM standard. It includes software for examining, constructing and converting DICOM image files, handling offline media, sending and receiving images over ...
CS and XSS vulnerabilities in DZS Video Gallery for WordPress
Hello 3APA3A! There are Content Spoofing and Cross-Site Scripting vulnerabilities in plugin DZS Video Gallery for WordPress. After I announced multiple vulnerabilities in DZS Video Gallery at 08.05.2014 and informed developers, they ignored it, so the second advisory is going directly to full...
DNN (DotNetNuke®) ASPSlideshow Module Arbitrary File Download Vulnerability
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Title : DNN DotNetNuke® ASPSlideshow Module Arbitrary File Download Vulnerability Author : alieye vendor : http://www.mediaant.com/ , http://store.dnnsoftware.com/ Contact : [email protected] Risk : High Class: Remote Google Dork:...
Wordpress Booking System (Booking Calendar) plugin SQL Injection
Exploit Title: Wordpress Booking System Booking Calendar plugin SQL Injection Release Date: 2014-05-21 Author: maodun Contact: Twitter: @conmancm Software Link: http://wordpress.org/support/plugin/booking-system Affected version: 1.3 Google Dork: inurl:/wp-content/plugins/booking-system/...
Bilyoner mobile apps prone to various SSL/TLS attacks
===================================================================== Sceptive Security Advisory Synopsis: Bilyoner mobile apps prone to various SSL/TLS attacks Product: Various mobile applications Advisory URL: http://sceptive.com/p/bilyoner-mobile-apps-prone-to-various-ssltls-attacks Advisory...
Yarubo #1: Arbitrary SQL Execution in Participants Database for Wordpress
Yarubo 1: Arbitrary SQL Execution in Participants Database for Wordpress ========================================================= Program: Participants Database = 1.5.4.8 Severity: Unauthenticated attacker can fully compromise the Wordpress installation Permalink:...
ESA-2014-024: EMC Documentum Digital Asset Manager Blind DQL Injection Vulnerability
ESA-2014-024.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-024: EMC Documentum Digital Asset Manager Blind DQL Injection Vulnerability EMC Identifier: ESA-2014-024 CVE Identifier: CVE-2014-2503 Severity Rating: CVSS v2 Base Score: 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P Affected products: • E...
[oss-security] CVE request: multiple /tmp races in ppc64-diag
Just quoting from our bug report: As noted in the SUSE bug report, numerous /tmp race conditions exist in ppc64-diag, in particular: rtaserrd/diagsupport.c:233: char command="/usr/bin/find /proc/device-tree -name status -print /tmp/getdtfiles"; rtaserrd/diagsupport.c:241: fp1 =...
iScan Online Mobile 2.0.1 iOS - Command Inject Vulnerability
Document Title: =============== iScan Online Mobile 2.0.1 iOS - Command Inject Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1271 Release Date: ============= 2014-06-02 Vulnerability Laboratory ID VL-ID: ==================================...
Privacy Pro v1.2 HZ iOS - File Include Web Vulnerability
Document Title: =============== Privacy Pro v1.2 HZ iOS - File Include Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1267 Release Date: ============= 2014-05-23 Vulnerability Laboratory ID VL-ID: ====================================...
IBM DB2 privilege escalation
Insecure dynamic libraries loading...
Bluetooth Photo-File Share v2.1 iOS - Multiple Web Vulnerabilities
Document Title: =============== Bluetooth Photo-File Share v2.1 iOS - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1270 Release Date: ============= 2014-05-30 Vulnerability Laboratory ID VL-ID:...
TigerCom My Assistant v1.1 iOS - File Include Vulnerability
Document Title: =============== TigerCom My Assistant v1.1 iOS - File Include Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1268 Release Date: ============= 2014-05-23 Vulnerability Laboratory ID VL-ID: ===================================...
Details for CVE-2014-0220
------------------------------------------------------------------------------------------ Technical Service Bulletin 2014-28 TSB Title: Security Vulnerability: Sensitive Configuration Values Exposed in Cloudera Manager Certain configuration values that are stored in Cloudera Manager are consider...