47153 matches found
CVE-2014-3446 - Unauthenticated Blind SQL Injection in BSS Continuity CMS
Vulnerability title: Unauthenticated Blind SQL Injection in BSS Continuity CMS CVE: CVE-2014-3446 Vendor: BSS Product: Continuity CMS Affected version: 4.2.22640.0 Fixed version: N/A Reported by: Jerzy Kramarz Details: he following URL and parameters have been confirmed to suffer from Blind SQL...
Multiple vulnerabilities in Sharetronix
Advisory ID: HTB23214 Product: Sharetronix Vendor: Blogtronix, LLC Vulnerable Versions: 3.3 and probably prior Tested Version: 3.3 Advisory Publication: May 7, 2014 without technical details Vendor Notification: May 7, 2014 Vendor Patch: May 27, 2014 Public Disclosure: May 28, 2014 Vulnerability...
WebTitan multiple security vulnerabilities
SQL injection, code execution, durectory traversal...
D-Link DSL-500T / DAP 1150 / DAP-1320 multiple security vulnerabilities
Web administration interface crossite request forgery, authentication bypass, directory traversal...
Multiple CSRF and XSS vulnerabilities in D-Link DAP 1150
Hello 3APA3A! In 2011 and beginning of 2012 I wrote about multiple vulnerabilities http://securityvulns.ru/docs27440.html, http://securityvulns.ru/docs27677.html, http://securityvulns.ru/docs27676.html in D-Link DAP 1150 several dozens. That time I wrote about vulnerabilities in admin panel in...
SEC Consult SA-20140606-0 :: Multiple critical vulnerabilities in WebTitan
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory 20140606-0 ======================================================================= title: Multiple critical vulnerabilities product: WebTitan vulnerable version: 4.01 Build 68 fixed version: 4.04 impact:...
[SECURITY] [DSA 2942-1] typo3-src security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2942-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff Jun 01, 2014 http://www.debian.org/security/faq -...
DCMTK privileges escalation
No description provided...
proxmox user enumeration vulnerability
No description provided...
[ MDVSA-2014:111 ] otrs
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:111 http://www.mandriva.com/en/support/security/ Package : otrs Date : June 10, 2014 Affected: Business Server 1.0 Problem Description: Updated otrs package fixes security vulnerabilities: A logged in attack...
Bilyoner apps insecure data transmission
Under some conditions data is sent unencrypted...
[KIS-2014-06] Dotclear <= 2.6.2 (Media Manager) Unrestricted File Upload Vulnerability
------------------------------------------------------------------------ Dotclear = 2.6.2 Media Manager Unrestricted File Upload Vulnerability ------------------------------------------------------------------------ - Software Link: http://dotclear.org/ - Affected Versions: Version 2.6.2 and...
DNN (DotNetNuke®) responsivesidebar Module Arbitrary File Download Vulnerability
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Title : DNN DotNetNuke® responsivesidebar Module Arbitrary File Download Vulnerability Author : alieye vendor : http://www.mediaant.com/ , http://store.dnnsoftware.com/ Contact : [email protected] Risk : High Class: Remote Google Dork:...
[RT-SA-2014-004] Remote Command Execution in webEdition CMS Installer Script
Advisory: Remote Command Execution in webEdition CMS Installer Script RedTeam Pentesting discovered a remote command execution vulnerability in the installer script of the webEdition CMS during a penetration test. If the installer script is not manually removed after installation, attackers canno...
NeginGroup CMS Multiple Vulnerability
Sql Injection And Xss Vulnerability In NeginGroup Cms @@@ @@@@@@@@@@@ @@@@@ @@@@@@@@@@ @@@ @@@@@@@ @@@ @@@@@@@@@@@ @@@ @@ @@@ @@ @@@ @@@@@@@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@@@@@@@@@ @@@ @ @@@@@@@@@@ @@@ @@@@@@ @@@ @@@@@@@@@@@ @@@ @@ @@@ @@ @@@ @@@@@@ @@...
[REVIVE-SA-2014-001] Revive Adserver 3.0.5 fixes CSRF vulnerability
======================================================================== Revive Adserver Security Advisory REVIVE-SA-2014-001 ------------------------------------------------------------------------ Advisory ID: REVIVE-SA-2014-001 CVE ID: CVE-2013-5954 Date: 2014-05-15 Security risk: Moderate...
[oss-security] CVE request: Proxmox VE < 3.2 user enumeration vulnerability
Hi list, We recently found a vulnerability affecting Proxmox VE 3.2 that allows an unauthenticated user to perform user enumeration. Vendor was contacted and the vulnerability fixed in Proxmox VE 3.2, released on 2014-03-10. References: Proxmox related commits:...
[ MDVSA-2014:114 ] squid
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:114 http://www.mandriva.com/en/support/security/ Package : squid Date : June 10, 2014 Affected: Business Server 1.0 Problem Description: Updated squid packages fix security vulnerability: Due to incorrect...
[Onapsis Security Advisories] Multiple Hard-coded Usernames in SAP Components
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Onapsis Security Advisories:Multiple Hard-coded Usernames CWE-798 have been found and patched in a variety of SAP components. Summaries of the advisories with links to full versions follow: 1. ONAPSIS-2014-011-SAP Project System Structures and...
CVE-2014-3740 - SpiceWorks Cross-site scripting
Exploit Title: Multiple Stored XSS vulnerabilities in SpiceWorks Ticketing system CVE: CVE-2014-3740 Vendor: SpiceWorks Product: SpiceWorks IT ticketing system Affected versions: any version below 7.2.00195 Fixed version: 7.2.00195 1. About the application: ======================= SpiceWorks is a...
Two Cross-Site Scripting (XSS) Vulnerabilities in Seo Panel
Advisory ID: HTB23200 Product: Seo Panel Vendor: www.seopanel.in Vulnerable Versions: 3.4.0 and probably prior Tested Version: 3.4.0 Advisory Publication: January 29, 2014 without technical details Vendor Notification: January 29, 2014 Vendor Patch: May 15, 2014 Public Disclosure: May 16, 2014...
[SECURITY] [DSA 2956-1] icinga security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2956-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff June 11, 2014 http://www.debian.org/security/faq -...
ppc64-diag symbolic links vulnerability
Symbolic links vulnerability on temporary files creation...
SAP multiple security vulnerabilities
Multiple hardcoded credentials, unauthorized configuration access...
CVE-2014-3445 - Unauthenticated Backup and Password Disclosure in HandsomeWeb SOS Webpages
Vulnerability title: Unauthenticated Backup and Password Disclosure in HandsomeWeb SOS Webpages CVE: CVE-2014-3445 Vendor: HandsomeWeb Product: SOS Webpages Affected version: 1.1.11 and earlier Fixed version: 1.1.12 Reported by: Freakyclown Details: The default setup allows an unauthenticated use...
CSRF, AoF and XSS vulnerabilities in D-Link DAP 1150
Hello 3APA3A! In 2011 and beginning of 2012 I wrote about multiple vulnerabilities http://securityvulns.ru/docs27440.html, http://securityvulns.ru/docs27677.html, http://securityvulns.ru/docs27676.html in D-Link DAP 1150 several dozens. That time I wrote about vulnerabilities in admin panel in...
CVE-2014-2232 - "Absolute Path Traversal" (CWE-36) vulnerability in "infoware MapSuite"
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2014-2232 =================== "Absolute Path Traversal" CWE-36 vulnerability in "infoware MapSuite" Vendor =================== infoware GmbH Product =================== MapSuite Affected versions =================== This vulnerability affects...
AllReader v1.0 iOS - Multiple Web Vulnerabilities
Document Title: =============== AllReader v1.0 iOS - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1269 Release Date: ============= 2014-05-26 Vulnerability Laboratory ID VL-ID: ==================================== 1269...
CVE-2014-0907 - SetUID/SetGID Programs Allow Privilege Escalation Via Insecure RPATH In IBM DB2
Vulnerability title: SetUID/SetGID Programs Allow Privilege Escalation Via Insecure RPATH In IBM DB2 CVE: CVE-2014-0907 Vendor: IBM Product: DB2 Affected version: V9.1, V9.5, V9.7, V10.1 and V10.5 Fixed version: V9.7 FP9a, V10.1 FP3a, V10.1 FP4 and V10.5 FP3a Reported by: Tim Brown Details: It ha...
LSE Leading Security Experts GmbH - LSE-2014-05-22 - F*EX - Multiple Issues
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 === LSE Leading Security Experts GmbH - Security Advisory 2014-05-22 === FEX Frams' Fast File EXchange - Multiple Issues - - --------------------------------------------------------------------- Affected Versions ================= FEX Frams' Fast File...
PHP/fileinfo/file DoS
Resources exhaustion and infinite loop in CDF files parsing...
CVE-2014-0228: Apache Hive Authorization vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 CVE-2014-0228: Apache Hive Authorization vulnerability Severity: Moderate Vendor: The Apache Software Foundation Versions affected: Apache Hive 0.13.0 Users affected: Users who have enabled SQL standards based authorization mode. Description: In SQL...
s3dvt multiple security vulnerabilities
Multiple privilege escalations...
CVE-2014-3447 - Remote Denial Of Service in BSS Continuity CMS
Vulnerability title: Remote Denial Of Service in BSS Continuity CMS CVE: CVE-2014-3447 Vendor: BSS Product: Continuity CMS Affected version: 4.2.22640.0 Fixed version: N/A Reported by: Jerzy Kramarz Details: By repeatedly calling node enumeration script, a remote unauthenticated attacker can...
Files Desk Pro v1.4 iOS - File Include Web Vulnerability
Document Title: =============== Files Desk Pro v1.4 iOS - File Include Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1266 Release Date: ============= 2014-05-16 Vulnerability Laboratory ID VL-ID: ====================================...
Construtiva CIS Manager CMS POST SQLi
TL;DR; ====== . PRODUCT : Construtiva CIS Manager . TYPE : SQLi http://site/autenticar/lembrarlogin.asp POST email . CVE : CVE-2014-3749 Software Description ==================== . The CIS Manager platform is a complete and powerful tool to manage sites and corporative portals on the Internet. Th...
NG WifiTransfer Pro 1.1 - File Include Vulnerability
Document Title: =============== NG WifiTransfer Pro 1.1 - File Include Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1260 Release Date: ============= 2014-04-28 Vulnerability Laboratory ID VL-ID: ==================================== 1260...
CVE-2014-3448 - Remote Code Execution Via Unauthenticated File Upload in BSS Continuity CMS
Vulnerability title: Remote Code Execution Via Unauthenticated File Upload in BSS Continuity CMS CVE: CVE-2014-3448 Vendor: BSS Product: Continuity CMS Affected version: 4.2.22640.0 Fixed version: N/A Reported by: Jerzy Kramarz Details: The ASPX executable which is responsible for handling file...
[ MDVSA-2014:116 ] file
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:116 http://www.mandriva.com/en/support/security/ Package : file Date : June 10, 2014 Affected: Business Server 1.0 Problem Description: Updated file packages fix security vulnerabilities: A flaw was found in...
[SECURITY] [DSA 2929-1] ruby-actionpack-3.2 security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2929-1 [email protected] http://www.debian.org/security/ Florian Weimer May 16, 2014 http://www.debian.org/security/faq -...
CVE-2013-6876 s3dvt Root shell
CVE-2013-6876 s3dvt Root shell About s3dvt: s3dvt is part of the 3d network display server which can be used as 3d desktop environment. Vulnerability: A vulnerability in s3dvt for versions prior to 0.2.2 allows to obtain a root shell. Details, patches, discussion and strategy to exploit at:...
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
[SECURITY] CVE-2013-2251: Apache Continuum affected by Remote Command Execution
CVE-2013-2251: Apache Continuum affected by Remote Command Execution Severity: Important Vendor: The Apache Software Foundation Versions Affected: - Continuum 1.3.1 to Continuum 1.4.1 Description: Apache Continuum is affected by a vulnerability in the version of the Struts library being used, whi...
CSRF and Remote Code Execution in EGroupware
Advisory ID: HTB23212 Product: EGroupware Vendor: http://www.egroupware.org/ Vulnerable Versions: 1.8.006 community edition and probably prior Tested Version: 1.8.006 community edition Advisory Publication: April 23, 2014 without technical details Vendor Notification: April 23, 2014 Vendor Patch:...
miniupnpc buffer overflow
Signed to unsigned conversion leads to buffer overflow...
[oss-security] Re: CVE request: possible miniupnpc buffer overflow
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 It was pointed out in https://bugzilla.redhat.com/showbug.cgi?id=1085618 that miniupnpc version 1.9 fixes a possible buffer overflow: https://github.com/miniupnp/miniupnp/commit/3a87aa2f10bd7f1408e1849bdb59c41dd63a9fe9 On a related note ... in version...
AST-2014-006: Asterisk Manager User Unauthorized Shell Access
Asterisk Project Security Advisory - AST-2014-006 Product Asterisk Summary Asterisk Manager User Unauthorized Shell Access Nature of Advisory Permission Escalation Susceptibility Remote Authenticated Sessions Severity Minor Exploits Known No Reported On April 9, 2014 Reported By Corey Farrell...
HP Service Virtualization code execution
Code execution via AutoPass License Server...
[security bulletin] HPSBMU03045 rev.1 - HP Service Virtualization Running AutoPass License Server, Remote Code Execution
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04333125 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04333125 Version: 1 HPSBMU03045 rev....