Unicorn Router WB-3300NR CSRF (Factory Reset/DNS Change)

Exploit Title: Unicorn Router WB-3300NR CSRF Factory Reset/DNS Change Exploit Author: absane Blog: http://blog.noobroot.com Discovery date: October 29th 2013 Vendor Homepage: http://www.eunicorn.co.kr/kimsboard7/product.php?inc=wb-3300nr Tested on: Unicorn WB-3300NR v1.0 Firmware Version:...

XADV-2013003 Linux Kernel eCryptfs write_tag_3_packet Heap Buffer Overflow Vulnerability

+--------------------------------------------------------------------------------------------+ | XADV-2013003 Linux Kernel eCryptfs writetag3packet Heap Buffer Overflow Vulnerability | +--------------------------------------------------------------------------------------------+ Vulnerable...

HP Application LifeCycle Management security vulnerabilities

Different code execution vulnerabilities...

HP SiteScope code execution

Code execution via issueSiebelCmd SOAP...

Stem Innovation IZON IP cameras backdoor

Hardcoded credentials...

[security bulletin] HPSBMU02935 rev.1 - HP LoadRunner Virtual User Generator, Remote Code Execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03969437 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03969437 Version: 1 HPSBMU02935 rev....

Varnish HTTP cache DoS

assert on empty request...

Linux kernel buffer overflow

Heap buffer overflow on eCryptfs request procesing...

Tryton directory traversal

Directory traversal on filename processing in server response parsing...

[ MDVSA-2013:261 ] dropbear

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:261 http://www.mandriva.com/en/support/security/ Package : dropbear Date : October 28, 2013 Affected: Business Server 1.0 Problem Description: Updated dropbear package fixes security vulnerability: Possible...

[ MDVSA-2013:258 ] icu

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:258 http://www.mandriva.com/en/support/security/ Package : icu Date : October 28, 2013 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: Updated icu packages fix security...

Google ICU security vulnerabilities

Race conditions, code execution...

ESA-2013-074: EMC Unisphere for VMAX Information Disclosure Vulnerability

ESA-2013-074.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-074: EMC Unisphere for VMAX Information Disclosure Vulnerability EMC Identifier: ESA-2013-074 CVE Identifier: CVE-2013-3287 Severity Rating: CVSS v2 Base Score: 6.6 AV:L/AC:M/Au:S/C:C/I:C/A:C Affected products • EMC Unisphere...

Dropbear SSH server timing attacks

Different timings for existent and nonexistent users...

[security bulletin] HPSBMU02933 rev.1 - HP SiteScope, issueSiebelCmd SOAP Request, Remote Code Execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03969435 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03969435 Version: 1 HPSBMU02933 rev....

pycrypto PRNG vulnerabilities

Predictable PRNG state after fork...

[SECURITY] [DSA 2789-1] strongswan security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2789-1 [email protected] http://www.debian.org/security/ Yves-Alexis Perez November 01, 2013 http://www.debian.org/security/faq -...

HP LoadRunner code execution

Virtual User Generator multiple vulnerabilities...

[PSA-2013-1022-1] Microsoft Silverlight Invalid Typecast / Memory Disclosure

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 +------------------------------------------------------------------------------+ | Packet Storm Advisory 2013-1022-1 | | http://packetstormsecurity.com/ | +------------------------------------------------------------------------------+ | Title:...

[security bulletin] HPSBMU02931 rev.2 - HP Service Manager, Injection of Arbitrary Code, Remote Privilege Elevation, Remote Disclosure of Privileged Information and Cross Site Scripting (XSS)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03960916 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03960916 Version: 2 HPSBMU02931 rev....

[ MDVSA-2013:262 ] python-pycrypto

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:262 http://www.mandriva.com/en/support/security/ Package : python-pycrypto Date : October 28, 2013 Affected: Business Server 1.0 Problem Description: Updated python-pycrypto package fixes security...

strongswan security vulnereabilities

DoS, authentication bypass...

[CVE-2013-4484] DoS vulnerability in Varnish HTTP cache

Summary ======= Varnish Cache with certain configurations is vulnerable to a denial of service attack. Three lines of VCL code solves the problem. This issue was discovered by Ilia Sharov, Yandex. This has been assigned CVE-2013-4484. Details ======= If Varnish receives a certain illegal request,...

[security bulletin] HPSBMU02932 rev.1 - HP Application LifeCycle Management, ALM client component, Remote Execution of Arbitrary Code

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03969433 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03969433 Version: 1 HPSBMU02932 rev....

[security bulletin] HPSBMU02934 rev.1 - HP Application LifeCycle Management, GossipService SOAP Request, Remote Code Execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03969436 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03969436 Version: 1 HPSBMU02934 rev....

[SECURITY] [DSA 2791-1] tryton-client security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2791-1 [email protected] http://www.debian.org/security/ Florian Weimer November 04, 2013 http://www.debian.org/security/faq -...

Mozilla Firefox / Thunderbird / Seamonkey multiple security vulnerabilities

Multiple memory corruptions, address spoofing, protection bypass...

glibc 2.5 <= reloc types to crash bug

+---------------------------------------------------------+ | XADV-2013002 glibc 2.5 = reloc types to crash bug | +---------------------------------------------------------+ Vulnerable versions: - glibc 2.5 = Not vulnerable versions: - glibc 2.6 = Testbed: linux distro Type: Local Impact: crash...

[CVE-2013-2751, CVE-2013-2752] NETGEAR ReadyNAS Remote Root

NETGEAR ReadyNAS with firmware 4.2.x before 4.2.24 and 4.1.x before 4.1.12 is prone to command injection from an unauthenticated HTTP GET request. This vulnerability can lead to complete root access as outlined on the Tripwire blog:...

[USN-2008-1] Suds vulnerability

========================================================================== Ubuntu Security Notice USN-2008-1 October 24, 2013 suds vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubun...

Symantec Workspace Streaming 7.5.0.493 SWS Streamlet Engine Invoker Servlets Remote Code Execution

Symantec Workspace Streaming 7.5.0.493 SWS Streamlet Engine Invoker Servlets Remote Code Execution tested against: Microsoft Windows Server 2008 R2 sp1 download url: http://www.symantec.com/it/it/products-solutions/trialware/ file tested: SymantecWorkspaceStreaming7.5.0.493.zip vulnerability: the...

[ MDVSA-2013:257 ] nss

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:257 http://www.mandriva.com/en/support/security/ Package : nss Date : October 23, 2013 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: A vulnerability has been discovered and...

[SECURITY] [DSA 2782-1] polarssl security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2782-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff October 20, 2013 http://www.debian.org/security/faq -...

Linux kernel mulriple security vulnerabilities

Privilege escalations, information leakages, DoS conditions...

PolarSSL multiple security vulnerabilities

DoS, buffer overflows, timing attacks...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

[USN-2002-1] Keystone vulnerabilities

========================================================================== Ubuntu Security Notice USN-2002-1 October 23, 2013 keystone vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: ...

[CVE-2013-5702] Watchguard Server Center v11.7.4 Multiple Non-Persistent Cross-Site Scripting Vulnerabilities

Watchguard Server Center v11.7.4 Multiple Non-Persistent Cross-Site Scripting Vulnerabilities RCE Security Advisory http://www.rcesecurity.com 1. ADVISORY INFORMATION ----------------------- Product: Watchguard Server Center Vendor URL: www.watchguard.com Type: Cross-Site Scripting CWE-79 Date...

ESA-2013-067: RSA® Authentication Agent for Web for Internet Information Services (IIS) Security Controls Bypass Vulnerability

ESA-2013-067.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-067: RSA® Authentication Agent for Web for Internet Information Services IIS Security Controls Bypass Vulnerability EMC Identifier: ESA-2013-067 CVE Identifier: CVE-2013-3280 Severity Rating: CVSS v2 Base Score: 9.0...

Watchguard Server Center XSS

Multiple crossite scripting vulnerabilities...

Apport weak permissions

Weak permissions on created sump files...

Cisco Identity Services Engine multiple security vulnerabilities

Authentication bypass, code execution...

RSA Authentication Agent authentication bypass

Protection bypass on agent crash...

Suds symbolic links vulnerability

Symbolic links vulnerability on temporary fiels creation...

[USN-2003-1] Glance vulnerability

========================================================================== Ubuntu Security Notice USN-2003-1 October 23, 2013 glance vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

Mozilla nss uninitialized memory dereference

Uninitialized memory dereference on decryption...

[CVE-2013-4295] Apache Shindig information disclosure vulnerability

CVE-2013-4295: XXE vulnerability In Apache Shindig 2.5.0 PHP Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Shindig PHP 2.5.0 Description: The gadget renderer in the PHP version of Apache Shindig is subject to an XML External Entity XXE Injection attack. The...

NetGear ReadyNAS code execution

Web interface commands injection...

CA SiteMinder crossite scripting

No description provided...

CA20131024-01: Security Notice for CA SiteMinder

-----BEGIN PGP SIGNED MESSAGE----- CA20131024-01: Security Notice for CA SiteMinder Issued: October 24, 2013 CA Technologies Support is alerting customers to a potential vulnerability in CA SiteMinder that can be mitigated by utilizing existing product functionality. The vulnerability,...