Open-Xchange Security Advisory 2013-08-16

Product: Open-Xchange AppSuite / HTMLCleaner Vendor: Open-Xchange GmbH / HTMLCleaner team Internal reference: 27708 Open-Xchange Bug ID, 86 HTMLcleaner ticket Vulnerability type: Race condition within a thread CWE-366 Vulnerable version: 7.2.2 Vulnerable component: backend Fixed version:...

HylaFAX buffer overflow

Heap buffer overflow...

APPLE-SA-2013-09-26-1 iOS 7.0.2

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2013-09-26-1 iOS 7.0.2 iOS 7.0.2 is now available and addresses the following: Passcode Lock Available for: iPhone 4 and later Impact: A person with physical access to the device may be able to make calls to any number Description: A NULL...

Linux Kernel Patches For Linux Kernel Security

Hi forks! I release an article for linux kernel security. - http://www.x90c.org/articles/linuxkernelpatches.txt x90c...

Talkie Bluetooth Video iFiles 2.0 iOS - Multiple Vulnerabilities

Title: ====== Talkie Bluetooth Video iFiles 2.0 iOS - Multiple Vulnerabilities Date: ===== 2013-08-30 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1062 VL-ID: ===== 1063 Common Vulnerability Scoring System: ==================================== 8.8 Introduction:...

USN-1976-1] Linux kernel vulnerabilities

========================================================================== Ubuntu Security Notice USN-1976-1 September 30, 2013 linux vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

[IBliss Security Advisory] Cross-site scripting ( XSS ) in PHP IDNA Convert

PHP IDNA Convert Cross-site scripting XSS Vendor product description PHP NetIDNA is a class to convert between the Punycode and Unicode formats. Punycode is a standard described in RFC 3492 and part of IDNA Internationalizing Domain Names in Applications RFC3490 . This class allows PHP scripts to...

Mozilla Firefox / Thunderbird / Seamonkey multiple security vulnerabilities

Memory corruptions, integer overdlows, privilege escalations, code executions, information leakage...

[USN-1980-1] Vino vulnerability

========================================================================== Ubuntu Security Notice USN-1980-1 September 30, 2013 vino vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

Open-Xchange Security Advisory 2013-09-10

Product: Open-Xchange AppSuite Vendor: Open-Xchange GmbH Internal reference: 28260 Bug ID Vulnerability type: CWE-16: Configuration, CWE-287: Improper Authentication, CWE-200: Information Exposure Vulnerable version: 7.0.0 to 7.2.2 Vulnerable component: backend default configuration Fixed version...

[SECURITY] [DSA 27671-1] proftpd-dfsg security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2767-1 [email protected] http://www.debian.org/security/ Nico Golde September 29, 2013 http://www.debian.org/security/faq -...

[USN-1979-1] txt2man

========================================================================== Ubuntu Security Notice USN-1979-1 September 30, 2013 txt2man vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

eTransfer Lite v1.0 iOS - Persistent Filename Vulnerability

Title: ====== eTransfer Lite v1.0 iOS - Persistent Filename Vulnerability Date: ===== 2013-08-31 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1064 VL-ID: ===== 1064 Common Vulnerability Scoring System: ==================================== 3.8 Introduction:...

XAMPP 1.8.1 Local Write Access Vulnerability

============================================= INTERNET SECURITY AUDITORS ALERT 2013-007 - Original release date: March 14th, 2013 - Last revised: March 19th, 2013 - Discovered by: Manuel Garcia Cardenas - Severity: 6,8/10 CVSS Base Score - CVE-ID: CVE-2013-2586...

ESA-2013-060: EMC VPLEX Information Disclosure Vulnerability

ESA-2013-060.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-060: EMC VPLEX Information Disclosure Vulnerability EMC Identifier: ESA-2013-060 CVE Identifier: CVE-2013-3278 Severity Rating: CVSS v2 Base Score: 6.8 AV:L/AC:L/Au:S/C:C/I:C/A:C Affected products: • EMC VPLEX Local/Metro/Geo...

proftpd DoS

DoS via modsftp and modsftppam modules...

Multiple vulnerabilities in RokMicroNews for WordPress

Hello 3APA3A! I want to warn you about multiple vulnerabilities in plugin RokMicroNews for WordPress. In August 2012 I wrote about multiple vulnerabilities in RokBox for WordPress http://securityvulns.ru/docs28871.html. These vulnerabilities are similar, since the same developers put the same...

[CVE-2013-5725] - Byword for iOS Data Destruction Vulnerability

Affected Vendor: http://metaclassy.com/ - Affected Software: Byword for iOS - Affected Version: 2.x prior to 2.1 - Issue Type: Lack of validation/user confirmation leading to destruction of data - Release Date: 29 Sept 2013 - Discovered by: Guillaume Ross - CVE Identifier: CVE-2013-5725 - Issue...

Open-Xchange Security Advisory 2013-09-30

Product: Open-Xchange AppSuite Vendor: Open-Xchange GmbH Internal reference: 28642 Bug ID Vulnerability type: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page Vulnerable version: prior to 7.2.2 Vulnerable component: backend Fixed version: 7.0.2-rev16, 7.2.2-rev20 Report...

EMC VPLEX Information leakage

Cleartetext passwords in configuration files...

AFU, AFD and XSS vulnerabilities in Uploadify

Hello 3APA3A! These are Arbitrary File Uploading, Arbitrary File Deletion and Cross-Site Scripting vulnerabilities in Uploadify. Particularly in the version used in aCMS it looks like these developers use modified version of Uploadify, but other developers also can use such version...

Vino VNC server DoS

Resources exhauston via connections...

[USN-1981-1] HPLIP vulnerabilities

========================================================================== Ubuntu Security Notice USN-1981-1 September 30, 2013 hplip vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

hplip symbolic lcinks vulnerability

Unsafe temporary files handling...

Open-Xchange Security Advisory 2013-07-31

Product: Open-Xchange AppSuite Vendor: Open-Xchange GmbH Internal reference: 27473 Bug ID Vulnerability type: Phishing / Data injection Vulnerable version: 7.2.2 and earlier Vulnerable component: backend Fixed version: 7.2.2-rev9, 7.2.1-rev10, 7.2.0-rev11, 7.0.2-rev14 Solution status: Fixed by...

APPLE-SA-2013-09-18-2 iOS 7

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2013-09-18-2 iOS 7 iOS 7 is now available and addresses the following: Certificate Trust Policy Available for: iPhone 4 and later, iPod touch 5th generation and later, iPad 2 and later Impact: Root certificates have been updated Description:...

PolicyKit protection bypass

pkcheck race conditions...

txt2man symbolic links vulnerability

Unsafe temporary files creation...

[ MDVSA-2013:229 ] bzr

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:229 http://www.mandriva.com/en/support/security/ Package : bzr Date : September 10, 2013 Affected: Business Server 1.0 Problem Description: Updated bzr packages fix security vulnerabilities: A denial of...

[ MDVSA-2013:227 ] python-setuptools

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:227 http://www.mandriva.com/en/support/security/ Package : python-setuptools Date : September 9, 2013 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: A vulnerability has been...

FreeBSD Security Advisory FreeBSD-SA-13:13.nullfs

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-13:13.nullfs Security Advisory The FreeBSD Project Topic: Cross-mount links between nullfs5 mounts Category: core Module: nullfs Announced: 2013-09-10 Credits:...

Sophos Web Protection Appliance code execution

Few command injections...

Microsoft Office multiple security vulnerabilities

Memory corruption on Outlook S/MIME parsing. Information leakage, multiple memory corruptions...

FreeBSD Security Advisory FreeBSD-SA-13:11.sendfile

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-13:11.sendfile Security Advisory The FreeBSD Project Topic: Kernel memory disclosure in sendfile2 Category: core Module: sendfile Announced: 2013-09-10 Credits: E...

Microsoft Internet Explorer multiple security vulnerabilities

Multiple memory corruptions...

[slackware-security] subversion (SSA:2013-251-01)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 slackware-security subversion SSA:2013-251-01 New subversion packages are available for Slackware 14.0 and -current to fix a security issue. Here are the details from the Slackware 14.0 ChangeLog: +--------------------------+...

D-Link DIR-505 routers multiple security vulnerabilities

Code execution, directory taversal, weak encryption, privilege escalation, authentication bypass...

Multiple vulnerabilities on D-Link Dir-505 devices

Multiple vulnerabilities on D-Link Dir-505 devices ================================================== ADVISORY INFORMATION Title: Multiple vulnerabilities on D-Link Dir-505 devices Discovery date: 05/04/2013 Release date: 09/09/2013 Credits: Alessandro Di Pinto alessandro.dipinto artificialstudio...

[security bulletin] HPSBPV02918 rev.1 - HP ProCurve Manager (PCM), HP PCM+ and HP Identity Driven Manager (IDM), SQL Injection, Remote Code Execution, Session Reuse

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03897409 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03897409 Version: 1 HPSBPV02918 rev....

HP ProCurve Manager, HP Identity Driven Manager multiple security vulnerabilities

Code execution, session reusage, SQL injection...

Microsoft Frontpage information leakage

XML information disclosure...

FreeBSD Security Advisory FreeBSD-SA-13:12.ifioctl

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-13:12.ifioctl Security Advisory The FreeBSD Project Topic: Insufficient credential checks in network ioctl2 Category: core Module: sysnetinet6 sysnetatm Announced...

Microsoft Windows multiple security vulnerabilities

OLE code execution, Windows Theme files code execution, kernel mode drivers privilege escalation, SCM privilege escalation, Acrive Directory DoS...

[CORE-2013-0809] Sophos Web Protection Appliance Multiple Vulnerabilities

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Sophos Web Protection Appliance Multiple Vulnerabilities 1. Advisory Information Title: Sophos Web Protection Appliance Multiple Vulnerabilities Advisory ID: CORE-2013-0809 Advisory URL:...

FreeBSD multiple security vulnerabilities

ifioctls privilege escalation, nullfs privilege escalation, sendfile information leakage...

Subversion symbolic links vulnerabilitiy

Privilege escalation via symbolic links...

python libraries security vulnerabilities

SSL certificates parsing DoS, protection bypass...

CVE-2013-5216 CapaSystems Performance Guard Path Traversal Vulnerability

Application Performance Guard Vendor CapaSystems Link http://www.capasystems.com/it-performance-monitorin Discovered by Kerem Kocaer kerem.kocaeratgmaildotcom Problem ------- Path traversal vulnerability in the "download logs" section allows remote attackers to read arbitrary files by interceptin...

Vulnerabilities in Avaya IP Office Customer Call Reporter

Hello 3APA3A! I want to warn you about vulnerabilities in Avaya IP Office Customer Call Reporter. These are Remote HTML Include and Remote XSS Include Cross-Site Scripting vulnerabilities. After I found multiple vulnerabilities in Avaya IP Office Customer Call Reporter in December, I informed ZDI...

ReviewBoard Vulnerabilities

ReviewBoard www.reviewboard.org aims to 'take the pain out of code review'. Integration with source control makes it imperative to maintain proper protections on this server. I have worked with the developers to resolve multiple XSS conditions and harden web server configurations. The XSS...