Cross-Site Scripting (XSS) in GuppY

Advisory ID: HTB23176 Product: GuppY Vendor: GuppY Vulnerable Versions: 4.6.26 and probably prior Tested Version: 4.6.26 Advisory Publication: October 2, 2013 without technical details Vendor Notification: October 2, 2013 Vendor Patch: October 12, 2013 Public Disclosure: October 23, 2013...

glibc 2.5 <= reloc types to crash bug

+---------------------------------------------------------+ | XADV-2013002 glibc 2.5 = reloc types to crash bug | +---------------------------------------------------------+ Vulnerable versions: - glibc 2.5 = Not vulnerable versions: - glibc 2.6 = Testbed: linux distro Type: Local Impact: crash...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Symantec Workspace Streaming 7.5.0.493 SWS Streamlet Engine Invoker Servlets Remote Code Execution

Symantec Workspace Streaming 7.5.0.493 SWS Streamlet Engine Invoker Servlets Remote Code Execution tested against: Microsoft Windows Server 2008 R2 sp1 download url: http://www.symantec.com/it/it/products-solutions/trialware/ file tested: SymantecWorkspaceStreaming7.5.0.493.zip vulnerability: the...

[ MDVSA-2013:257 ] nss

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:257 http://www.mandriva.com/en/support/security/ Package : nss Date : October 23, 2013 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: A vulnerability has been discovered and...

[USN-2000-1] Nova vulnerabilities

========================================================================== Ubuntu Security Notice USN-2000-1 October 23, 2013 nova vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

[SECURITY] [DSA 2782-1] polarssl security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2782-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff October 20, 2013 http://www.debian.org/security/faq -...

[USN-2003-1] Glance vulnerability

========================================================================== Ubuntu Security Notice USN-2003-1 October 23, 2013 glance vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

[USN-1998-1] Linux kernel vulnerabilities

========================================================================== Ubuntu Security Notice USN-1998-1 October 22, 2013 linux vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

CA20131024-01: Security Notice for CA SiteMinder

-----BEGIN PGP SIGNED MESSAGE----- CA20131024-01: Security Notice for CA SiteMinder Issued: October 24, 2013 CA Technologies Support is alerting customers to a potential vulnerability in CA SiteMinder that can be mitigated by utilizing existing product functionality. The vulnerability,...

Suds symbolic links vulnerability

Symbolic links vulnerability on temporary fiels creation...

Wordpress Cart66 Plugin 1.5.1.14 Multiple Vulnerabilities

Exploit Title: Wordpress Cart66 Plugin 1.5.1.14 Multiple Vulnerabilities Exploit Author: absane Blog: http://blog.noobroot.com Discovery date: September 29th 2013 Vendor notified: September 29th 2013 Vendor fixed: October 12 2013 Vendor Homepage: http://cart66.com Software Link:...

Wordpress videowall Plugin Xss vulnerabilities

The Wordpress videowall Plugin suffers from a Cross-Site Scripting Vulnerability @@@ @@@@@@@@@@@ @@@@@ @@@@@@@@@@ @@@ @@@@@@@ @@@ @@@@@@@@@@@ @@@ @@ @@@ @@ @@@ @@@@@@@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@@@@@@@@@ @@@ @ @@@@@@@@@@ @@@ @@@@@@ @@@ @@@@@@@@@@@...

AFU and IL vulnerabilities in Uploadify

Hello 3APA3A! These are Arbitrary File Uploading and Information Leakage vulnerabilities in Uploadify. The same as in June with previous vulnerabilities in Uploadify, in September the developers just ignored my warnings, even I sent letter to multiple their e-mail addresses...

Zikula CMS v1.3.5 - Multiple Web Vulnerabilities

Document Title: =============== Zikula CMS v1.3.5 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1114 Release Date: ============= 2013-10-16 Vulnerability Laboratory ID VL-ID: ==================================== 1114 Comm...

[SOJOBO-ADV-13-02] - MODx 2.2.10 Reflected Cross Site Scripting

SOJOBO-ADV-13-02 - MODx 2.2.10 Reflected Cross Site Scripting I. Information ================== Name : MODx 2.2.10 Reflected Cross Site Scripting Software : MODx 2.2.10 and possibly below. Vendor Homepage : http://modx.com/ Vulnerability Type : Reflected Cross-Site Scripting Severity : Low 2/5...

WebTester 5.x Multiple Vulnerabilities

========================================================================================== WebTester 5.x Multiple Vulnerabilities ==========================================================================================...

ZAPms v1.42 CMS - Client Side Cross Site Scripting Web Vulnerability

Document Title: =============== ZAPms v1.42 CMS - CS Cross Site Scripting Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1112 Release Date: ============= 2013-10-15 Vulnerability Laboratory ID VL-ID: ===================================...

Security Advisory for Bugzilla 4.4.1, 4.2.7 and 4.0.11

Summary ======= Bugzilla is a Web-based bug-tracking system used by a large number of software projects. The following security issues have been discovered in Bugzilla: A CSRF vulnerability in processbug.cgi affecting Bugzilla 4.4 only can lead to a bug being edited without the user consent. A CS...

DornCMS Application v1.4 - Multiple Web Vulnerabilities

Document Title: =============== DornCMS Application v1.4 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1113 Release Date: ============= 2013-10-14 Vulnerability Laboratory ID VL-ID: ==================================== 11...

[ISecAuditors Security Advisories] HTTP Response Splitting Vulnerability in WebCollab <= v3.30

============================================= INTERNET SECURITY AUDITORS ALERT 2013-011 - Original release date: March 21st, 2013 - Last revised: March 21st, 2013 - Discovered by: Manuel Garcia Cardenas - Severity: 5/10 CVSS Base Score - CVE-ID: CVE-2013-2652...

[SECURITY] [DSA 2776-1] drupal6 security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2776-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff October 11, 2013 http://www.debian.org/security/faq -...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Multiple vulnerabilities in flv-player

Hello 3APA3A! These are Cross-Site Scripting and Content Spoofing vulnerabilities in flv-player. ------------------------- Affected products: ------------------------- Vulnerable are flv-player 3.5 and previous versions. ------------------------- Affected vendors: ------------------------- U-Stud...

[ISecAuditors Security Advisories] Multiple Vulnerabilities in Uebimiau <= 2.7.11

============================================= INTERNET SECURITY AUDITORS ALERT 2013-008 - Original release date: March 15th, 2013 - Last revised: March 20th, 2013 - Discovered by: Manuel Garcia Cardenas - Severity: 4,8/10 CVSS Base Score - CVE-ID: CVE-2013-2621, CVE-2013-2622, CVE-2013-2623...

Multiple vulnerabilities in mp3-player

Hello 3APA3A! These are Cross-Site Scripting and Content Spoofing vulnerabilities in mp3-player. ------------------------- Affected products: ------------------------- Vulnerable are mp3-player 2.5 and previous versions. ------------------------- Affected vendors: ------------------------- U-Stud...

Wordpress Cart66 Plugin 1.5.1.14 Multiple Vulnerabilities

Exploit Title: Wordpress Cart66 Plugin 1.5.1.14 Multiple Vulnerabilities Exploit Author: absane Blog: http://blog.noobroot.com Discovery date: September 29th 2013 Vendor notified: September 29th 2013 Vendor fixed: October 2 2013 Vendor Homepage: http://cart66.com Software Link:...

Cross-Site Scripting (XSS) in Feng Office

Advisory ID: HTB23174 Product: Feng Office Vendor: Secure Data SRL Vulnerable Versions: 2.3.2-rc and probably prior Tested Version: 2.3.2-rc Advisory Publication: September 18, 2013 without technical details Vendor Notification: September 18, 2013 Public Disclosure: October 9, 2013 Vulnerability...

Cisco ASA / FWSM multiple security vulnerabilities

Privilege escalation, authentication bypass, DoS...

[ISecAuditors Security Advisories] Multiple Reflected XSS vulnerabilities in BoltWire <= v3.5

============================================= INTERNET SECURITY AUDITORS ALERT 2013-010 - Original release date: March 20th, 2013 - Last revised: March 25th, 2013 - Discovered by: Manuel Garcia Cardenas - Severity: 4,8/10 CVSS Base Score - CVE-ID: CVE-2013-2651...

[SECURITY] [DSA 2770-1] torque security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2770-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso October 09, 2013 http://www.debian.org/security/faq -...

[ MDVSA-2013:248 ] xinetd

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:248 http://www.mandriva.com/en/support/security/ Package : xinetd Date : October 10, 2013 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: Updated xinetd package fixes security...

Cyrus SASL DoS

Crash on some values for password's salt...

HP Business Process Monitor security vulnerabilities

Information leak, code execution...

[USN-1988-1] Cyrus SASL vulnerability

========================================================================== Ubuntu Security Notice USN-1988-1 October 09, 2013 cyrus-sasl2 vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives:...

GnuPG security vulnerabilities

Protection bypass, DoS...

[security bulletin] HPSBMU02901 rev.1 - HP Business Process Monitor running on Windows, Remote Execution of Arbitrary Code and Disclosure of Information

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03844594 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03844594 Version: 1 HPSBMU02901 rev....

Network Audio System security vulnerabilities

Code execution, Denial of service...

[SECURITY] [DSA 2771-1] nas security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2771-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff October 09, 2013 http://www.debian.org/security/faq -...

systemd security vulnerabilities

Integer overflow, protection bypass, privilege escalation...

xinetd privilege escalation

tcpmux-server service is executed with root privileges...

[ MDVSA-2013:247 ] gnupg

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:247 http://www.mandriva.com/en/support/security/ Package : gnupg Date : October 10, 2013 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: Multiple vulnerabilities has been discovered...

[SECURITY] [DSA 2777-1] systemd security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2777-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff October 11, 2013 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2775-1] ejabberd security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2775-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst October 10, 2013 http://www.debian.org/security/faq -...

libmobiledevices symbolic links vulnerability

Symbolic links vulnerability on emporary files creation...

[USN-1927-1] libimobiledevice vulnerability

========================================================================== Ubuntu Security Notice USN-1927-1 August 14, 2013 libimobiledevice vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its...

Aloaha PDF Suite buffer overflow

Buffer overflow on PDF files parsing...

SEC Consult SA-20131004-0 :: SQL injection vulnerability in Zabbix

SEC Consult Vulnerability Lab Security Advisory 20131004-0 ======================================================================= title: SQL injection vulnerability product: Zabbix vulnerable version: =2.0.8 fixed version: 2.0.9rc1 CVE number: CVE-2013-5743 impact: critical homepage:...

Microsoft Sharepoint security vulnerabilities

Memory corruption on Excel files parsing, crossite scripting...

HP Intelligent Management Center multiple security vulnerabilities

Code execution, authentication bypass, SQL injection, unauthorized access...