47153 matches found
Voice Logger astTECS - bypass login & arbitrary file download
Author: Michal Blaszczak Website: http://blaszczakm.blogspot.com Project: hack voip - http://blaszczakm.blogspot.com/search/label/hack20voip Date: 16.07.2013 Voice Logger - VoIP software for Call Center 1 bypass login login: admin' or 1='1 password: admin line: 168 file: managerlogin.server.php 2...
CORE-2013-0517 - Xpient Cash Drawer Operation Vulnerability
Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Xpient Cash Drawer Operation Vulnerability 1. Advisory Information Title: Xpient Cash Drawer Operation Vulnerability Advisory ID: CORE-2013-0517 Advisory URL:...
XSS Vulnerabilities in OpenCms
Advisory ID: HTB23160 Product: OpenCms Vendor: Alkacon Software Vulnerable Versions: 8.5.1 and probably prior Tested Version: 8.5.1 Vendor Notification: June 12, 2013 Vendor Patch: July 10, 2013 Public Disclosure: July 17, 2013 Vulnerability Type: Cross-Site Scripting CWE-79 CVE Reference:...
HP Database and Middleware Automation information leakage
No description provided...
SEC Consult SA-20130719-0 :: Multiple vulnerabilities in Sybase EAServer
SEC Consult Vulnerability Lab Security Advisory 20130719-0 ======================================================================= title: Multiple vulnerabilities product: Sybase EAServer vulnerable version: =6.3.1 fixed version: vendor did not supply version information CVE number: - impact:...
Title: ====== ePhoto Transfer v1.2.1 iOS - Multiple Web Vulnerabilities Date: ===== 2013-07-17 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1017 VL-ID: ===== 1017 Common Vulnerability Scoring System: ==================================== 6.6 Introduction: ============...
[CVE-2013-0523] IBM WebSphere Commerce: Encrypted URL Parameter Vulnerable to Padding Oracle Attacks
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 VSR Security Advisory http://www.vsecurity.com/ =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Advisory Name: Encrypted URL Parameter Vulnerable to Padding Oracle Attacks Release Date: 2013-06-19 Application: IBM...
Sybase EAServer multiple security vulnerabilities
Directory traversal, XML injection, shell characters injection...
Open-Xchange Security Advisory 2013-06-03
Open-Xchange Security Advisory multiple vulnerabilities Multiple security issues for Open-Xchange Server 6 and OX AppSuite have been discovered and fixed. The vendor has chosen a responsible full disclosure method to publish security issue details. Users of the software have already been provided...
Barracuda CudaTel 2.6.02.04 - Multiple Client Side Cross Site Vulnerabilities (Bug Bounty #17)
Title: ====== Barracuda CudaTel 2.6.02.04 - Multiple Client Side Cross Site Vulnerabilities Bug Bounty 17 Date: ===== 2013-07-17 References: =========== http://vulnerability-lab.com/getcontent.php?id=779 BARRACUDA NETWORK SECURITY ID: BNSEC-815 VL-ID: ===== 779 Common Vulnerability Scoring System...
[SECURITY] [DSA 2724-1] chromium-browser security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2724-1 [email protected] http://www.debian.org/security/ Michael Gilbert July 17, 2013 http://www.debian.org/security/faq -...
[security bulletin] HPSBHF02878 rev.1 - HP Smart Zero Client, Unauthorized Access
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03757330 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03757330 Version: 1 HPSBHF02878 rev....
WiFly 1.0 Pro iOS - Multiple Web Vulnerabilities
Title: ====== WiFly 1.0 Pro iOS - Multiple Web Vulnerabilities Date: ===== 2013-07-15 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1011 VL-ID: ===== 1011 Common Vulnerability Scoring System: ==================================== 6.3 Introduction: ============= It is t...
Symantec Workspace Virtualization privilege escalation
Unsafe function's hook...
Multiple vulnerabilities in Googlemaps plugin for Joomla
Hello 3APA3A! These are Denial of Service, XML Injection, Cross-Site Scripting and Full path disclosure vulnerabilities in Googlemaps plugin for Joomla. ------------------------- Affected products: ------------------------- Vulnerable are Googlemaps plugin for Joomla versions 2.x and 3.x and...
CVE-2013-3734 - JBoss AS Administration Console - Password Returned in Later Response
Product: Embedded Jopr - JBoss AS Administration Console Vendor: Red Hat Middleware, LLC Version: 1.2 Tested Version: 1.2 Vendor Notified Date: May 29, 2013 Release Date: June 03, 2013 Risk: Moderate Authentication: Required Remote: Yes Description: Passwords submitted to the application are...
Symantec Workspace Virtualization 6.4.1895.0 Local Kernel Mode Privilege Escalation Exploit
Symantec Workspace Virtualization 6.4.1895.0 Local Kernel Mode Privilege Escalation Exploit Date: 2013-7-17 Author : MJ0011 Version: Symantec Workspace Virtualization 6.4.1895.0 Tested on: Windows XP SP3 DETAILS: In fslx.sys 's hook function of "NtQueryValueKey" , it directly write to the buffer ...
Cisco Intrusion Prevention System multiple security vulnerabilities
Multiple DoS conditions...
IBM WebSphere information leakage
Access token inside URL...
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
[CVE-2013-2612] Huawei E587 3G Mobile Hotspot Command Injection
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2013-2612 Huawei E587 3G Mobile Hotspot Command Injection Summary: Huawei E587 3G Mobile Hotspot, version 11.203.27, is prone to a command injection vulnerability in the Web UI. Successful exploitation allows unauthenticated attackers to execute...
Huawei E587 access point security vulnerabilities
Crossite scripting, code execution...
FTP Sprite v1.2.1 iOS - Persistent Web Vulnerability
Title: ====== FTP Sprite v1.2.1 iOS - Persistent Web Vulnerability Date: ===== 2013-07-12 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1007 VL-ID: ===== 1007 Common Vulnerability Scoring System: ==================================== 3.7 Introduction: ============= FTP...
Samsung Galaxy SMS manipulation
It's possible to manipulate SMS via built-in backup utility...
[CVE-2013-4763|CVE-2013-4764] Vulnerability in built-in system app of Samsung Galaxy S3/S4
Hi list, I would like to inform you that the details of the vulnerability in built-in system app of Samsung Galaxy S3/S4 assigned as CVE-2013-4763 and CVE-2013-4764 are now disclosed to public. In Samsung Galaxy S3/S4, a pre-loaded app, i.e., sCloudBackupProvider.apk, is used to provide backup...
ESA-2013-041: EMC VNX and Celerra Control Station Elevation of Privilege Vulnerability
ESA-2013-041.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-041: EMC VNX and Celerra Control Station Elevation of Privilege Vulnerability EMC Identifier: ESA-2013-041 CVE Identifier: CVE-2013-3270 Severity Rating: CVSS v2 Base Score: 6.8 AV:L/AC:L/Au:S/C:C/I:C/A:C Affected products: •...
EMC VNX / Celerra privilege escalation
Weak permissions for script files...
Olive File Manager v1.0.1 iOS - Multiple Vulnerabilities
Title: ====== Olive File Manager v1.0.1 iOS - Multiple Vulnerabilities Date: ===== 2013-07-13 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1009 VL-ID: ===== 1009 Common Vulnerability Scoring System: ==================================== 5.6 Introduction: =============...
Trend Micro DirectPass multiple security vulnerabilities
DoS conditions...
Barracuda CudaTel 2.6.02.040 - Client Side Cross Site Scripting Vulnerability
Title: ====== Barracuda CudaTel 2.6.02.040 - Client Side Cross Site Scripting Vulnerability Date: ===== 2013-07-15 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=776 BARRACUDA NETWORK SECURITY ID: BNSEC-807 VL-ID: ===== 776 Common Vulnerability Scoring System:...
[CVE-2013-2745, CVE-2013-2738, CVE-2013-2739] MiniDLNA v1.0.25 Multiple Vulnerabilities
MiniDLNA prior to v1.1.0 http://sourceforge.net/projects/minidlna/ is prone to a variety of issues which could be used to take control of a host running this software. CVE-2013-2738 and CVE-2013-2745 are SQL injection issues. CVE-2013-2739 has been assigned for a heap-based buffer overflow which...
MiniDLNA multiple security vulnerabilities
Buffer overflows, SQL injections...
Huawei E587 3G Mobile Hotspot Web UI Cross Site Scripting vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Huawei E587 3G Mobile Hotspot Web UI Cross Site Scripting vulnerability Summary: Huawei E587 3G Mobile Hotspot, version 11.203.27, is prone to a XSS vulnerability in the Web UI. A specialy crafted SMS can bypass the function used to sanitize incoming...
Trend Micro DirectPass 1.5.0.1060 - Multiple Vulnerabilities
Title: ====== Trend Micro DirectPass 1.5.0.1060 - Multiple Vulnerabilities Date: ===== 2013-05-21 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=894 Article: http://www.vulnerability-lab.com/dev/?p=580 Trend Micro Reference:...
Dell Kace 1000 SMA v5.4.70402 - Persistent Vulnerabilities
Title: ====== Dell Kace 1000 SMA v5.4.70402 - Persistent Vulnerabilities Date: ===== 2013-07-16 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=833 VL-ID: ===== 833 Common Vulnerability Scoring System: ==================================== 3.5 Introduction: =============...
Re: Multiple vulnerabilities in McAfee ePO 4.6.6
McAfee has released a Knowledgebase Article KB to address the issues reported by a NATO pen test. https://kc.mcafee.com/corporate/index?page=content&id=KB78824 Both SQL Injection vulnerabilities were identified on May 10th, 2013 and patched as specified in SB10043. McAfee's internal testing leads...
PHP memory corruption
Memory corruption in XML parsing, jdtojewish function DoS...
Squid-3.3.5 DoS PoC
Squid Crash PoC Copyright C Kingcope 2013 tested against squid-3.3.5 this seems to be the patch for the vulnerability: http://www.squid-cache.org/Versions/v3/3.3/squid-3.3.8.patch The squid-cache service will respawn, looks like a kind of assert exception: 2013/07/15 20:48:36 kid1| Closing HTTP...
McAfee ePolicy Orchestrator security vulnerability
Few vulnerabilities are used in-the-wild to compromise corporate networks...
Re: [ MDVSA-2013:195 ] php
Hey guys, Related to this I?ve found a proof of concept test script: php -r 'xmlparseintostructxml parsercreatens, strrepeat"blah", 1000, $b;' Gabe twitter: @gmaggiotti On Mon, Jul 15, 2013 at 3:41 AM, [email protected] wrote: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux...
[security bulletin] HPSBPV02891 rev.1 - HP ProCurve Switches, Remote Unauthorized Information Disclosure
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03819065 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03819065 Version: 1 HPSBPV02891 rev....
Mobile USB Drive HD 1.2 - Arbitrary File Upload Vulnerability
Title: ====== Mobile USB Drive HD 1.2 - Arbitrary File Upload Vulnerability Date: ===== 2013-06-27 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=989 VL-ID: ===== 989 Common Vulnerability Scoring System: ==================================== 6.8 Introduction:...
Wifi Photo Transfer 2.1 & 1.1 PRO - Multiple Vulnerabilities
Title: ====== Wifi Photo Transfer 2.1 & 1.1 PRO - Multiple Vulnerabilities Date: ===== 2013-04-21 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=932 VL-ID: ===== 932 Common Vulnerability Scoring System: ==================================== 6.1 Introduction: ===========...
EMC RSA Authentication Manager security vulnerabilities
Information leakage, SQL injection...
[security bulletin] HPSBHF02888 rev.1 - HP ProCurve, H3C, 3COM Routers and Switches, Remote Information Disclosure and Code Execution
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03808969 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03808969 Version: 1 HPSBHF02888 rev....
Multiple vulnerabilities in McAfee ePO 4.6.6
Classification: NON SENSITIVE INFORMATION RELEASABLE TO THE PUBLIC Multiple vulnerabilities in McAfee ePO 4.6.6 Affected Product: McAfee ePO 4.6.6 Build 176 & potentially earlier versions Timeline: 08 June 2013 - Vulnerability found 12 June 2013 - Vendor informed 12 June 2013 - Vendor...
SEC Consult SA-20130605-0 :: Multiple vulnerabilities in CTERA Portal
SEC Consult Vulnerability Lab Security Advisory 20130605-0 ======================================================================= title: Multiple vulnerabilities in CTERA Portal product: CTERA Portal vulnerable version: 3.1 fixed version: 3.2 impact: Critical homepage: http://www.ctera.com found...
Re: Cisco/Linksys E1200 N300 Reflected XSS
Mitre has assigned the following CVE for this issue: CVE-2013-2679 On Mon, Apr 29, 2013 at 12:27 AM, Carl Benedict [email protected] wrote: Summary -------------------- Software : Cisco/Linksys Router OS Hardware : E1200 N300 others currently untested Version : 2.0.04 others currently...
Linux kernel security vulnerabilities
iSCSI memory corruption, multiple information leaks, DoS, Broadcom B43 driver privilege escalation...
[ MDVSA-2013:194 ] kernel
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:194 http://www.mandriva.com/en/support/security/ Package : kernel Date : July 11, 2013 Affected: Business Server 1.0 Problem Description: Multiple vulnerabilities has been found and corrected in the Linux...