[SECURITY] [DSA 3340-1] zendframework security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3340-1 [email protected] https://www.debian.org/security/ Alessandro Ghedini August 19, 2015 https://www.debian.org/security/faq -...

[USN-2720-1] Django vulnerability

========================================================================== Ubuntu Security Notice USN-2720-1 August 18, 2015 python-django vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

[oCERT-2015-009] VLC arbitrary pointer dereference

2015-009 VLC arbitrary pointer dereference Description: The VLC media player is an open source media player and streaming media server. The stable VLC version suffers from an arbitrary pointer dereference vulnerability. The vulnerability affects the 3GP file format parser, insufficient restrictio...

AN IT CMS - SQL Injection Vulnerability

========================================================== + Title :- WAN IT CMS - SQL Injection Vulnerability + Date :- 23 - July - 2015 + Vendor Homepage :- http://www.wanitltd.com/ + Version :- All Versions + Tested on :- Nginx/1.4.5, PHP/5.2.17, Linux - Windows + Category :- webapps + Google...

Insufficient certificate validation in EMC Secure Remote Services Virtual Edition

------------------------------------------------------------------------ Insufficient certificate validation in EMC Secure Remote Services Virtual Edition ------------------------------------------------------------------------ Han Sahin, November 2014...

[SECURITY] [DSA 3332-1] wordpress security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3332-1 [email protected] https://www.debian.org/security/ Thijs Kinkhorst August 11, 2015 https://www.debian.org/security/faq -...

WiFi Pineapple protection bypass

Predictable CSRF tokens...

Apache ActiveMQ DoS

Undocumented shutdown command...

HP Central View applications information leakage

No description provided...

PHPfileNavigator v2.3.3 CSRF Add Arbitrary Users

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-PHPFILENAVIGATOR0812a.txt Vendor: ================================ pfn.sourceforge.net Product: =================================== PHPfileNavigator v2.3.3 pfn Is...

HP Operations Manager i code execution

No description provided...

OpenStack Swift security vulnerabilities

Few restriction bypass vulnerabilities...

ESA-2015-130: EMC Documentum WebTop and WebTop Clients Cross-Site Request Forgery Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2015-130: EMC Documentum WebTop and WebTop Clients Cross-Site Request Forgery Vulnerability EMC Identifier: ESA-2015-130 CVE Identifier: CVE-2015-4530 Severity Rating: CVSS v2 Base Score: 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Affected products: • EMC...

[USN-2711-1] Net-SNMP vulnerabilities

========================================================================== Ubuntu Security Notice USN-2711-1 August 17, 2015 net-snmp vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

Net-SNMP memory corruption

Memory corruption on server response parsing...

EMC Documentum Content Server: arbitrary code execution (incomplete fix in CVE-2015-4532)

Product: EMC Documentum Content Server Vendor: EMC Version: ANY CVE: N/A Risk: High Status: public/not fixed For detailed description see http://seclists.org/bugtraq/2015/Jul/51 New behavior introduced in CVE-2015-4532: API ?,c,execute domethod WITH METHOD='dmbptransition', ARGUMENTS=' repo repo...

EMC Secure Remote Services Virtual Edition multiple security vulnerabilities

Code execution, SQL injection, buffer overflow...

Thomson Reuters FATCA - Arbitrary File Upload

Title: Thomson Reuters FATCA - Arbitrary File Upload Author: Jakub Paaczyski Date: 10. June 2015 CVE: CVE-2015-5951 Affected software: ================== All versions of Thomson Reuters FATCA below v5.2 Exploit was tested on: ====================== Thomson Reuters FATCA v5.1.0.30 Description:...

bizidea Design CMS 2015Q3 - SQL Injection Vulnerability

Document Title: =============== bizidea Design CMS 2015Q3 - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1571 Release Date: ============= 2015-08-12 Vulnerability Laboratory ID VL-ID: ==================================== 15...

[SYSS-2015-032] Broken Authentication and Session Management (CWE-930) in Page2Flip Premium App 2.5

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2015-032 Product: Page2Flip Vendor: w!ssenswerft GmbH Affected Versions: Premium App 2.5, probably also in Business App and Basic App, and in lower versions Tested Versions: Premium App 2.5 Vulnerability Type: Broken Authentication...

McAfee Application Control multiple security vulnerabilities

Restrictions bypass, unsafe libraries usage, privilege escalation...

Linksys WAG120N crossite scripting

Crossite scripting in web interface...

Cumulus Linux's Switch Configuration Tools Backend privilege escalation

Privilege escalation via command injection...

Dell SonicWall NetExtender Unquoted Autorun Privilege Escalation

Dell SonicWall NetExtender Unquoted Autorun Privilege Escalation Vendor Website : http://www.sonicwall.com INDEX --------------------------------------- 1. CVE 2. Background 3. Description 4. Affected Products 5. Solution 6. Credit 7. Disclosure Timeline 1. CVE...

Vulnerability in VirtueMart for Joomla

Hello 3APA3A! This is Brute Force vulnerability in VirtueMart for Joomla. Which is at order details page. ------------------------- Affected products: ------------------------- Vulnerable are VirtueMart 3.0.9 for Joomla and previous versions. ---------- Details: ---------- Brute Force WASC-11:...

SAP Afaria 7 multiple security vulnerabilities

Buffer overflow, information leakage, DoS...

UBNT Bug Bounty #3 - Persistent Filename Vulnerability

Document Title: =============== UBNT Bug Bounty 3 - Persistent Filename Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1467 Video: http://www.vulnerability-lab.com/getcontent.php?id=1468 Release Date: ============= 2015-08-11 Vulnerability...

OpenStack Keystone restrictions bypass

Certificates validation bypass...

Hawkeye-G v3.0.1 Persistent XSS & Information Leakage

Credits: John Page hyp3rlinx + Domains: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-HAWKEYEG0725.txt Vendor: ================================ www.hexiscyber.com Product: ================================ Hawkeye-G v3.0.1.4912 Hawkeye G is an active defense...

Weak authentication in EMC Secure Remote Services Virtual Edition Web Portal

------------------------------------------------------------------------ Weak authentication in EMC Secure Remote Services Virtual Edition Web Portal ------------------------------------------------------------------------ Han Sahin, November 2014...

[SYSS-2015-027] Cross-Site Scripting (CWE-79) in Page2Flip Premium App 2.5

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2015-027 Product: Page2Flip Vendor: w!ssenswerft GmbH Affected Versions: Premium App 2.5, probably also in Business App and Basic App, and in lower versions Tested Versions: Premium App 2.5 Vulnerability Type: Cross-Site Scripting...

ESA-2015-131: EMC Documentum Content Server Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2015-131: EMC Documentum Content Server Multiple Vulnerabilities EMC Identifier: ESA-2015-131 CVE Identifier: CVE-2015-4531, CVE-2015-4532, CVE-2015-4533, CVE-2015-4534, CVE-2015-4535, CVE-2015-4536 Severity Rating: CVSS v2 Base Score: See below f...

[SECURITY] [DSA 3335-1] request-tracker4 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3335-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 13, 2015 https://www.debian.org/security/faq...

ESA-2015-081: RSA BSAFE® Micro Edition Suite, Crypto-C Micro Edition, Crypto-J, SSL-J and SSL-C Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2015-081: RSA BSAFE® Micro Edition Suite, Crypto-C Micro Edition, Crypto-J, SSL-J and SSL-C Multiple Vulnerabilities EMC Identifier: ESA-2015-081 CVE Identifier: CVE-2015-0533, CVE-2015-0534, CVE-2015-0535, CVE-2015-0536, CVE-2015-0537 Severity...

[SECURITY] [DSA 3330-1] activemq security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3330-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff August 07, 2015 https://www.debian.org/security/faq -...

Apache Subversion security vulnerabilities

Authentication bypass, unauthorized files access...

3KITS CMS - SQL Injection Vulnerability

========================================================= + Title :- 3KITS CMS - SQL Injection Vulnerability + Date :- 23 - July - 2015 + Vendor Homepage :- http://www.3kits.com/ + Version :- All Versions + Tested on :- Nginx/1.4.5, PHP/5.2.17, Linux - Windows + Category :- webapps + Google Dorks...

sysadmin privilege in EMC Documentum Content Server

Product: EMC Documentum Content Server Vendor: EMC Version: ANY CVE: N/A Risk: High Status: public/not fixed In 2011 Yuri Simone discovered a security flaw in EMC Documentum Content Server, which allows users with sysadmin privileges to elevate their privileges to superuser see CVE-2011-4144. On...

[USN-2721-1] Subversion vulnerabilities

========================================================================== Ubuntu Security Notice USN-2721-1 August 20, 2015 subversion vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives:...

Fortiguard FortiSandbox XSS

Crossite scripting in web interface...

[security bulletin] HPSBGN03393 rev.1 - HP Operations Manager i, Remote Code Execution

Note: the current version of the following document is available here: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04762687 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04762687 Version: 1 HPSBGN03393 rev.1 - HP Operations Manager i, Remote Code...

PDF Shaper v3.5 - (MSF) Remote Buffer Overflow Vulnerability

Document Title: =============== PDF Shaper v3.5 - MSF Remote Buffer Overflow Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1579 Video: https://youtu.be/-HTEIisSiH8 Release Date: ============= 2015-08-16 Vulnerability Laboratory ID VL-ID:...

Microsoft HTA (HTML Application) - Remote Code Execution Vulnerability (MS14-064)

Document Title: =============== Microsoft HTA HTML Application - Remote Code Execution Vulnerability MS14-064 References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1576 Video: http://youtu.be/Vkswz7vt23M...

CSRF and XSS vulnerabilities in D-Link DCS-2103

Hello 3APA3A! There are Cross-Site Request Forgery and Cross-Site Scripting vulnerabilities in D-Link DCS-2103 IP camera. ------------------------- Affected products: ------------------------- Vulnerable is the next model: D-Link DCS-2103, Firmware 1.0.0. Version 1.20 and previous versions also...

[SECURITY] [DSA 3337-1] gdk-pixbuf security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3337-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff August 18, 2015 https://www.debian.org/security/faq -...

gdk-pixbuf buffer overflow

Heap buffer overflow on BMP parsing...

HP-UX privilege escalation

Privilege escalation via execve...

Apple QuickTime multiple security vulnerabilities

Multiple memory corruptions...

Elastic Logstash insufficient certificate check

man-in-the-middle attack is possible...