[USN-2179-1] Linux kernel vulnerabilities

========================================================================== Ubuntu Security Notice USN-2179-1 April 26, 2014 linux vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

[USN-2173-1] Linux kernel vulnerabilities

========================================================================== Ubuntu Security Notice USN-2173-1 April 26, 2014 linux vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

[SECURITY] CVE-2013-2187: Apache Archiva Cross-Site Scripting vulnerability

CVE-2013-2187: Apache Archiva Cross-Site Scripting vulnerability Severity: Important Vendor: The Apache Software Foundation Versions Affected: - Archiva 1.3 to Continuum 1.3.6 - The unsupported versions Archiva 1.2 to 1.2.2 are also affected. Description: A request that included a specially craft...

CVE-2014-1217 - Unauthenticated access to sensitive information and functionality in Livetecs Timelive

Vulnerability title: Unauthenticated access to sensitive information and functionality in Livetecs Timelive CVE: CVE-2014-1217 Vendor: Livetecs Product: Timelive Affected version: 6.2.71 Fixed version: 6.2.8 Reported by: Richard Hatch Details: It was possible to access a URL that allowed...

Vulnerabilities in plugins with CU3ER for WordPress, Joomla, SilverStripe and Plone

Hello 3APA3A! Recently I disclosed vulnerabilities in CU3ER http://seclists.org/fulldisclosure/2014/Apr/244. This is popular flash file and in Google's index there are up to million web sites with it inurl:cu3er.swf filetype:swf - now Google shows 994000 results. There are any plugins for differe...

Multiple vulnerabilities in Js-Multi-Hotel for WordPress

Hello 3APA3A! There are multiple vulnerabilities in Js-Multi-Hotel plugin for WordPress. Earlier I wrote about two other vulnerabilities. These are Abuse of Functionality, Denial of Service, Cross-Site Scripting and Full path disclosure vulnerabilities in Js-Multi-Hotel plugin for WordPress. Ther...

Multiple Vulnerabilities in OpenDocMan

Advisory ID: HTB23202 Product: OpenDocMan Vendor: Free Document Management Software Vulnerable Versions: 1.2.7 and probably prior Tested Version: 1.2.7 Advisory Publication: February 12, 2014 without technical details Vendor Notification: February 12, 2014 Vendor Patch: February 24, 2014 Public...

Vulnerabilities in Js-Multi-Hotel for WordPress

Hello 3APA3A! These are vulnerabilities in Js-Multi-Hotel plugin for WordPress. ------------------------- Affected products: ------------------------- Vulnerable are Js-Multi-Hotel 2.2.1 and previous versions. ------------------------- Affected vendors: ------------------------- Joomlaskin...

[USN-2171-1] rsync vulnerability

========================================================================== Ubuntu Security Notice USN-2171-1 April 23, 2014 rsync vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubunt...

[SECURITY] [DSA 2887-1] ruby-actionmailer-3.2 security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2887-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff March 27, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2914-1] drupal6 security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2914-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso April 25, 2014 http://www.debian.org/security/faq -...

file utility / libmagic / PHP DoS

Infinite recursion on some file types detection, buffer overread, CPU exhaustion...

CVE-2014-2383 - Arbitrary file read in dompdf

Vulnerability title: Arbitrary file read in dompdf CVE: CVE-2014-2383 Vendor: dompdf Product: dompdf Affected version: v0.6.0 Fixed version: v0.6.1 partial fix Reported by: Alejo Murillo Moyas Details: An arbitrary file read vulnerability is present on dompdf.php file that allows remote or local...

[USN-2182-1] QEMU vulnerabilities

========================================================================== Ubuntu Security Notice USN-2182-1 April 28, 2014 qemu, qemu-kvm vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its...

[slackware-security] php (SSA:2014-111-02)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 slackware-security php SSA:2014-111-02 New php packages are available for Slackware 14.0, 14.1, and -current to fix a security issue. Here are the details from the Slackware 14.1 ChangeLog: +--------------------------+...

libmms buffer overflow

Buffer overflow in getanswer on MMS over HTTP processing...

[SECURITY] Stored Cross Site Scripting in Ektron CMS 8.7

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Stored Cross Site Scripting in Ektron CMS 8.7 CVE reference: CVE-2014-2729 Affected platforms: Ektron Web Content Management System Version: 8.7.0 Date: 2013-December-19 Security risk: Medium CVSS - AV:N/AC:L/Au:S/C:P/I:P/A:N Researcher: Joseph Zeng...

FreeBSD bfs deadlock

It's possible to cause deadlock on valid operations order...

PDF Album v1.7 iOS - File Include Web Vulnerability

Document Title: =============== PDF Album v1.7 iOS - File Include Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1255 Release Date: ============= 2014-04-11 Vulnerability Laboratory ID VL-ID: ==================================== 1255...

[security bulletin] HPSBPI03014 rev.1 - HP LaserJet Pro MFP Printers, HP Color LaserJet Pro MFP Printers, Remote Disclosure of Information

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04262495 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04262495 Version: 1 HPSBPI03014 rev....

[security bulletin] HPSBHF03006 rev.1 - HP Integrated Lights-Out 2 (iLO 2) Denial of Service

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04244787 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04244787 Version: 1 HPSBHF03006 rev....

HP iLO DoS

Device crashes on request with Hearbleed exploitation demonstration...

APPLE-SA-2014-04-22-4 AirPort Base Station Firmware Update 7.7.3

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-04-22-4 AirPort Base Station Firmware Update 7.7.3 AirPort Base Station Firmware Update 7.7.3 is now available and addresses the following: Available for: AirPort Extreme and AirPort Time Capsule base stations with 802.11ac Impact: An...

[USN-2168-1] Python Imaging Library vulnerabilities

========================================================================== Ubuntu Security Notice USN-2168-1 April 15, 2014 python-imaging vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its...

CVE-2014-2042 - Unrestricted file upload in Livetecs Timelive

Vulnerability title: Unrestricted file upload in Livetecs Timelive CVE: CVE-2014-2042 Vendor: Livetecs Product: Timelive Affected version: 6.2.71 Fixed version: 6.5.1 Reported by: Richard Hatch Details: It was discovered that it was possible for low-level TimeLive application users to upload file...

[SECURITY] [DSA 2913-1] drupal7 security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2913-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso April 25, 2014 http://www.debian.org/security/faq -...

SAP Router timing attacks information leakage

It's possible to find a valid password via statistical attacks...

AppFish Offline Coder v2.2 iOS - Persistent Software Vulnerability

Document Title: =============== AppFish Offline Coder v2.2 iOS - Persistent Software Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1252 Release Date: ============= 2014-04-08 Vulnerability Laboratory ID VL-ID:...

XSS and CS vulnerabilities in DSMS

Hello 3APA3A! There are Cross-Site Scripting and Content Spoofing vulnerabilities in DSMS. This is commercial CMS. It's used particularly at government site dsmsu.gov.ua - web site of Ministry of Youth and Sport of Ukraine. There are also other vulnerabilities in the system, about which I've...

Depot WiFi v1.0.0 iOS - Multiple Web Vulnerabilities

Document Title: =============== Depot WiFi v1.0.0 iOS - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1259 Release Date: ============= 2014-04-23 Vulnerability Laboratory ID VL-ID: ==================================== 1259...

Sitecom routers predictable WAP key

Default WAP key can be computed from device MAC address...

APPLE-SA-2014-04-22-3 Apple TV 6.1.1

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-04-22-3 Apple TV 6.1.1 Apple TV 6.1.1 is now available and addresses the following: Apple TV Available for: Apple TV 2nd generation and later Impact: An attacker in a privileged network position can obtain web site credentials Descriptio...

APPLE-SA-2014-04-22-2 iOS 7.1.1

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-04-22-2 iOS 7.1.1 iOS 7.1.1 is now available and addresses the following: CFNetwork HTTPProtocol Available for: iPhone 4 and later, iPod touch 5th generation and later, iPad 2 and later Impact: An attacker in a privileged network positio...

[USN-2166-1] Net-SNMP vulnerabilities

========================================================================== Ubuntu Security Notice USN-2166-1 April 14, 2014 net-snmp vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

Net-SNMP multiple security vulnerabilities

Multiple DoS conditions...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Cross-Site Scripting (XSS) in Open Classifieds

Advisory ID: HTB23204 Product: Open Classifieds Vendor: Open Classifieds Team Vulnerable Versions: 2-2.1.2 and probably prior Tested Version: 2-2.1.2 Advisory Publication: February 19, 2014 without technical details Vendor Notification: February 19, 2014 Vendor Patch: February 20, 2014 Public...

Adobe Reader for Android exposes insecure Javascript interfaces

------------------------------------------------------------------------ Adobe Reader for Android exposes insecure Javascript interfaces ------------------------------------------------------------------------ Yorick Koster, April 2014...

[CVE-2014-2715] Cross-site scripting (XSS) vulnerability in Videowhisper

Vulnerability title: Cross-site scripting XSS vulnerability in Videowhisper CVE: CVE-2014-2715 Vendor: VideoWhisper Product: Videowhisper module for Drupal 7 Affected version: 7 Fixed version: Reported by: Mahmoud Ghorbanzadeh Details: Hello, I found Cross-site scripting XSS vulnerability in the...

Cross-Site Scripting (XSS) in CMSimple

Advisory ID: HTB23205 Product: CMSimple Vendor: Preben Bjorn Biermann Madsen Vulnerable Versions: 3.54 and probably prior Tested Version: 3.54 Advisory Publication: February 26, 2014 without technical details Vendor Notification: February 26, 2014 Vendor Patch: February 26, 2014 Public Disclosure...

CUPS crossite scripting

Crossite scripting in Web interface...

Apple iOS multiple security vulnerabilities

Unsafe cookie handling, protection ypass, information leakage, multiple WebKit vulnerabilities...

Adobe Flash Player multiple security vulnerabilities

Use-after-free, buffer overflow, restrictions bypass, crossite scripting...

Sitepark Information Enterprise Server unauthorized access

Unauthorized access during update...

[security bulletin] HPSBGN03034 rev.1 - HP OneView, Remote Elevation of Privileges

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04273152 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04273152 Version: 1 HPSBGN03034 rev....

[ANN] Struts 2.3.16.2 GA release available - security fix

The Apache Struts group is pleased to announce that Struts 2.3.16.2 is available as a "General Availability" release.The GA designation is our highest quality grade. Apache Struts 2 is an elegant, extensible framework for creating enterprise-ready Java web applications. The framework is designed ...

[USN-2186-1] Date and Time Indicator vulnerability

========================================================================== Ubuntu Security Notice USN-2186-1 April 30, 2014 indicator-datetime vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its...

[USN-2190-1] JBIG-KIT vulnerability

========================================================================== Ubuntu Security Notice USN-2190-1 May 01, 2014 jbigkit vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubunt...

Privilege escalation via Super

setuid return value is not checked...

LSE Leading Security Experts GmbH - LSE-2014-04-10 - Sitepark IES - Unauthenticated Access

=== LSE Leading Security Experts GmbH - Security Advisory 2014-04-10 === Sitepark Information Enterprise Server IES - Unauthenticated Access --------------------------------------------------------------------- Affected Versions ================= Information Enterprise Server IES Version 2.9 unti...