[security bulletin] HPSBGN02904 rev.1 - HP SiteScope running SOAP, Remote Code Execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03861260 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03861260 Version: 1 HPSBGN02904 rev....

Wireshark multiple security vulnerabilities

Multiple vulnerabilities in different protocol dissectors...

Rgpg 0.2.2 Ruby Gem Remote Command Injection

Title: Rgpg 0.2.2 Ruby Gem Remote Command Injection Date: 7/31/2013 Advisory Author: Larry W. Cashdollar, @larry0 CVE: CVE-2013-4203 Download: https://rubygems.org/gems/rgpg Description: "A simple Ruby wrapper around gpg command for file encryption. rgpg is a simple API for interacting with the g...

Update: Full Disclosure - WD My Net N600, N750, N900, N900C - Plain Text Disclosure of Admin Credentials

Vulnerable Systems: Western Digital My Net Series Wireless Routers: N600 Firmware 1.03.12 N600 Firmware 1.04.16 N750 Firmware 1.03.12 N750 Firmware 1.04.16 N900 Firmware 1.05.12 N900 Firmware 1.06.18 N900 Firmware 1.06.28 N900C Firmware 1.05.12 N900C Firmware 1.06.18 N900C Firmware 1.06.28 CVE...

[SECURITY] [DSA 2734-1] wireshark security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2734-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff August 05, 2013 http://www.debian.org/security/faq -...

HP / 3COM / H3C switches security vulnerabilities

Code execution, information leakage...

Huawei B153 3G/UMTS router WPS weakness

Huawei B153 3G/UMTS router WPS weakness ======================================= ADVISORY INFORMATION Title: Huawei B153 3G/UMTS router WPS weakness Discovery date: 21/05/2013 Release date: 05/08/2013 Advisory URL: http://blog.emaze.net/2013/08/huawei-b153-3gumts-router-wps-weakness.html Credits:...

WD My Net security vulnerabilities

Unauthorized access, information leakages...

FTP OnConnect v1.4.11 iOS - Multiple Web Vulnerabilities

Title: ====== FTP OnConnect v1.4.11 iOS - Multiple Web Vulnerabilities Date: ===== 2013-08-04 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1041 VL-ID: ===== 1041 Common Vulnerability Scoring System: ==================================== 8.6 Introduction: =============...

Mozilla Firefox / Thunderbird / Seamonkey multiple security vulnerabilities

Memory corruptions, buffer overflows, crossite data access, crossite scripting, information spoofing, privilege escalation, protection bypass, code execution, information leakage...

Security vulnerabilities in different Ruby Gems

VUlnerabilities in different libraries...

SEC Consult SA-20130805-0 :: Vodafone EasyBox Default WPS PIN Algorithm Weakness

SEC Consult Vulnerability Lab Security Advisory 20130805-0 ======================================================================= title: Vodafone EasyBox Default WPS PIN Algorithm Weakness product: EasyBox 802 & EasyBox 803 vulnerable version: EasyBox 802 - all versions EasyBox 803 - Production...

HP Data Protector Arbitrary Remote Command Execution

""" HP Data Protector Arbitrary Remote Command Execution This script allows to execute a command with an arbitrary number of arguments. The trick calls 'perl.exe' interpreter installed with HP Data Protector inside the directory installpath/bin/. The main goal of the script is to bypass the...

Oracle / Sun / MySQL / PeopleSoft applications multiple security vulnerabilities

Quarterly CPU fixes 89 dufferent vulnerabilities...

[SECURITY] [DSA 2732-1] chromium-browser security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2732-1 [email protected] http://www.debian.org/security/ Michael Gilbert July 31, 2013 http://www.debian.org/security/faq -...

Chromium / Google Chrome multiple security vulnerabilities

Protection bypass, privilege escalation, DoS, use-after-free, information leakage, memory corruptions...

HP LaserJet Pro printers remote admin password extraction

Some of the networked HP LaserJet printers have hidden URLs hardcoded in the firmware. The URLs are not authenticated and can be used to extract admin password in plaintext v among other information like WiFi settings including WPS PIN. Models affected: HP LaserJet Pro P1102w, HP LaserJet Pro...

HPSBPI02887 rev.2 - Certain HP LaserJet Pro Printers, Remote Information Disclosure

NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2013-07-31 Last Updated: 2013-07-31 Potential Security Impact: Remote information disclosure Source: Hewlett-Packard Company, HP Software Security Response Team VULNERABILITY SUMMARY A...

HP printers information leakage

It's possible to obtain user accounts and WiFi PIN without authentication...

PuTTY SSH handshake heap overflow

PuTTY SSH handshake heap overflow CVE-2013-4852 Description: PuTTY versions 0.62 and earlier - as well as all software that integrates these versions of PuTTY - are vulnerable to an integer overflow leading to heap overflow during the SSH handshake before authentication, caused by improper bounds...

SurgeFtp Server BufferOverflow Vulnerability

------------------------------------------------------------------------------- | SurgeFtp Server BufferOverflow Vulnerability| -------------------------------------------------------------------------------- Summary ================ SurgeFTP Server has a buffer overflow vulnerability which effec...

Samsung TV DoS

Crash on oversized GET request...

Barracuda CudaTel multiple security vulnerabilities

Multiple web interface vulnerabilities...

Microsoft Windows multiple security vulnerabilities

Multiple vulnerabilities in .Net and Silverlight, multiple kernel components vulnerabilities, GDI+ TrueType parsing memory corruption, DirectShow memory corruption, VMW parsing memory corruption, multiple Internet Explorer memory corruption, Windows Defender privilege escalation...

Xymon Systems and Network Monitor - remote file deletion vulnerability

Advisory ID: HTB23163 Product: Magnolia CMS Vendor: Magnolia International Ltd Vulnerable Versions: 4.5.7, 4.5.8, 4.5.9, 5.0 and 5.0.1 Community Edition Tested Version: 5.0 Community Edition Vendor Notification: July 3, 2013 Vendor Patch: July 18, 2013 Public Disclosure: July 24, 2013 Vulnerabili...

[security bulletin] HPSBGN02906 rev.1 - HP Application Lifecycle Management Quality Center (ALM), Remote Cross Site Scripting (XSS)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03864640 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03864640 Version: 1 HPSBGN02906 rev....

Juniper Secure Access crossite scripting

Crossite scripting in SSLVPN...

Private Photos v1.0 iOS - Persistent Path Web Vulnerability

Title: ====== Private Photos v1.0 iOS - Persistent Path Web Vulnerability Date: ===== 2013-07-25 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1034 VL-ID: ===== 1034 Common Vulnerability Scoring System: ==================================== 3.5 Introduction:...

Barracuda CudaTel 2.6.02.040 - SQL Injection Vulnerability

Title: ====== Barracuda CudaTel 2.6.02.040 - SQL Injection Vulnerability Date: ===== 2013-07-20 References: =========== http://vulnerability-lab.com/getcontent.php?id=775 BARRACUDA NETWORK SECURITY ID: BNSEC-723 VL-ID: ===== 775 Common Vulnerability Scoring System:...

Full Disclosure - WD My Net N600, N750, N900, N900C - Plain Text Disclosure of Admin Credentials

Vulnerable Products - WD My Net N600 HD Dual Band Router Wireless N WiFi Router Accelerate HD WD My Net N750 HD Dual Band Router Wireless N WiFi Router Accelerate HD Linux 2.6.3 Kernel Firmware Ver. 1.03.xx 1.04.xx Firmware unaffected Ver 1.01.xx WD My Net N900 HD Dual Band Router Wireless N WiFi...

Barracuda LB, SVF, WAF & WEF - Multiple Vulnerabilities

Title: ====== Barracuda LB, SVF, WAF & WEF - Multiple Vulnerabilities Date: ===== 2013-07-18 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=727 Note: The issue was part of the official Barracuda Networks Bug Bounty Program. VL-ID: ===== 727 Common Vulnerability Scoring...

Dell Kace security vulnerabilities

Crossite scripting and SQL injection in web administration...

Easy Blog by JM LLC - Multiple Vulnerabilities

Dear all, I have discovered some vulnerabilities in Easy Blog, developed by JM LLC. Cheers, Sp3ctrecore ADVISORY =========================================== Easy Blog JM LLC - Multiple Vulnerabilities =========================================== Software................: Easy Blog Software...

DoS and XSS vulnerabilities in Googlemaps plugin for Joomla

Hello 3APA3A! Earlier I wrote about multiple vulnerabilities in Googlemaps plugin for Joomla http://securityvulns.ru/docs29645.html. After my informing, the developer fixed these vulnerabilities in versions 2.19 and 3.1 of the plugin - by removing proxy functionality. And in version 3.2 of the...

DirectShow Arbitrary Memory Overwrite Vulnerability ms13-056

Introduction: The Microsoft DirectShow application programming interface API is a media-streaming architecture for Microsoft Windows. Using DirectShow, your applications can perform high-quality video and audio playback or capture. Overview: DirectShow in Microsoft Windows XP SP2 and SP3, Windows...

CA20130725-01: Security Notice for CA Service Desk Manager

-----BEGIN PGP SIGNED MESSAGE----- CA20130725-01: Security Notice for CA Service Desk Manager Issued: July 25, 2013 CA Technologies Support is alerting customers to a potential risk with CA Service Desk Manager. A vulnerability exists that can allow a remote attacker to conduct cross-site scripti...

FreeBSD Security Advisory FreeBSD-SA-13:08.nfsserver

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-13:08.nfsserver Security Advisory The FreeBSD Project Topic: Incorrect privilege validation in the NFS server Category: core Module: nfsserver Announced: 2013-07-...

ISC bind DoS

assert on client request processing...

Barracuda Networks products multiple security vulnerabilities

Web filter administration crossite scripting...

Foscam cameras security vulnerabilities

Directory traversal, CSRF...

[CVE-2013-2137] Apache OFBiz XSS vulnerability in the "View Log" screen of the Webtools application

CVE-2013-2137 - Apache OFBiz XSS vulnerability in the "View Log" screen of the Webtools application Vendor: The Apache Software Foundation Versions Affected: Apache OFBiz 10.04.01 to 10.04.05 Apache OFBiz 11.04.01 to 11.04.02 Apache OFBiz 12.04.01 Description: XSS vulnerability in the "View Log"...

FreeBSD Security Advisory FreeBSD-SA-13:07.bind

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-13:07.bind Security Advisory The FreeBSD Project Topic: BIND remote denial of service Category: contrib Module: bind Announced: 2013-07-26 Credits: Maxim Shudrak...

Symantec Web Gateway multiple security vulnerabilities

Crossite scripting, crossite request forgery, SQL injection, code execution, privilege escalation...

[security bulletin] HPSBGN02905 rev.1 - HP LoadRunner, Remote Code Execution and Denial of Service (DoS)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03862772 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03862772 Version: 1 HPSBGN02905 rev....

Photo Server 2.0 iOS - Multiple Critical Vulnerabilities

Title: ====== Photo Server 2.0 iOS - Multiple Critical Vulnerabilities Date: ===== 2013-07-23 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1029 VL-ID: ===== 1029 Common Vulnerability Scoring System: ==================================== 8.6 Introduction: =============...

FreeBSD NFS privilege escalation

It's possible to access files with credentials of any user if anonymous NFS acccess is allowed...

Apache OpenOffice security vulnerabilities

Few memory corruptions...

[ MDVSA-2013:199 ] squid

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:199 http://www.mandriva.com/en/support/security/ Package : squid Date : July 25, 2013 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: Multiple vulnerabilities has been discovered an...

[USN-1911-1] Little CMS vulnerability

========================================================================== Ubuntu Security Notice USN-1911-1 July 29, 2013 lcms2 vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu...

Cross-Site Scripting (XSS) in Duplicator WordPress Plugin

Advisory ID: HTB23162 Product: Duplicator WordPress Plugin Vendor: LifeInTheGrid Vulnerable Versions: 0.4.4 and probably prior Tested Version: 0.4.4 Vendor Notification: June 19, 2013 Vendor Patch: July 21, 2013 Public Disclosure: July 24, 2013 Vulnerability Type: Cross-Site Scripting CWE-79 CVE...