47153 matches found
[CVE-2013-4694] WinAmp v5.63 gen_jumpex.dll and ml_local.dll Multiple Buffer Overflows
Inshell Security Advisory http://www.inshell.net 1. ADVISORY INFORMATION ----------------------- Product: WinAmp Vendor URL: www.winamp.com Type: Stack-based Buffer Overflow CWE-121 Date found: 2013-06-05 Date published: 2013-07-01 CVSSv2 Score: Bug 1: 7,5 AV:N/AC:L/Au:N/C:P/I:P/A:P Bug 2: 3,7...
AVAST Internet Security Suite - Persistent Vulnerabilities
Title: ====== AVAST Internet Security Suite - Persistent Vulnerabilities Date: ===== 2013-06-27 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=969 VL-ID: ===== 969 Common Vulnerability Scoring System: ==================================== 3.4 Introduction: =============...
WinAmp security vulnerabilities
Buffer overflow, uninitialized pointer dereference...
perl-Dancer headers injection
headers injection in cookie handling methods...
ElasticSearch double free
ElasticSearch rsyslog plugin doble free...
LSE Leading Security Experts GmbH - LSE-2013-07-03 - rsyslog ElasticSearch Plugin
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 === LSE Leading Security Experts GmbH - Security Advisory 2013-07-03 === rsyslog ElasticSearch Plugin - Double Free Memory Corruption - ------------------------------------------------------------ Affected Version ================ rsyslog 7.4.0 stable...
Content Spoofing vulnerabilities in TinyMCE and WordPress
Hello 3APA3A! This are Content Spoofing vulnerabilities in TinyMCE and WordPress. Which I've disclosed on Wednesday. In 2011 I already wrote about Content Spoofing in Moxieplayer, when I wrote concerning multiple vulnerabilities in TinyMCE http://securityvulns.ru/docs27349.html, which is a...
[SECURITY] [DSA 2718-1] wordpress security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2718-1 [email protected] http://www.debian.org/security/ Yves-Alexis Perez July 01, 2013 http://www.debian.org/security/faq -...
WordPress feed plugin Sql Injection
The WordPress feed plugin suffers from a Sql Injection vulnerability. Iranian Exploit DataBase http://exploit.iedb.ir Exploit Title : WordPress feed plugin Sql Injection Author : Iranian Exploit DataBase Discovered By : IeDb Email : [email protected] Home : http://exploit.iedb.ir Software Link ...
[ MDVSA-2013:184 ] perl-Dancer
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:184 http://www.mandriva.com/en/support/security/ Package : perl-Dancer Date : June 27, 2013 Affected: Business Server 1.0 Problem Description: Updated perl-Dancer package fixes CVE-2012-5572 A security flaw...
libvirt DoS
Resources exhaustion...
AVAST Universal Core Installer - Multiple Vulnerabilities
Title: ====== AVAST Universal Core Installer - Multiple Vulnerabilities Date: ===== 2013-06-28 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=966 VL-ID: ===== 965 Common Vulnerability Scoring System: ==================================== 4.2 Introduction: =============...
perl Module::Signature privilege escalation
Relative path is used to execute external application...
AVAST Antivirus v8.0.1489 - Multiple Core Vulnerabilities
Title: ====== AVAST Antivirus v8.0.1489 - Multiple Core Vulnerabilities Date: ===== 2013-06-30 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=963 VL-ID: ===== 963 Common Vulnerability Scoring System: ==================================== 4.1 Introduction: =============...
[ MDVSA-2013:192 ] php-radius
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:192 http://www.mandriva.com/en/support/security/ Package : php-radius Date : July 2, 2013 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: A security vulnerability was discovered and...
[waraxe-2013-SA#104] - Multiple Vulnerabilities in Spider Event Calendar Wordpress Plugin
waraxe-2013-SA104 - Multiple Vulnerabilities in Spider Event Calendar Wordpress Plugin =================================================================================== Author: Janek Vind "waraxe" Date: 22. May 2013 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-104.html Descriptio...
Multiple vulnerabilities in multiple themes for WordPress with VideoJS
Hello 3APA3A! These are Cross-Site Scripting and Full path disclosure vulnerabilities in multiple themes for WordPress with VideoJS. Earlier I've wrote about vulnerabilities in VideoJS http://seclists.org/fulldisclosure/2013/May/21. This is popular video and audio player, which is used at hundred...
[USN-1896-1] Module::Signature perl module vulnerability
========================================================================== Ubuntu Security Notice USN-1896-1 July 03, 2013 libmodule-signature-perl vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its...
[ MDVSA-2013:190 ] autotrace
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:190 http://www.mandriva.com/en/support/security/ Package : autotrace Date : July 2, 2013 Affected: Business Server 1.0 Problem Description: Updated autotrace package fixes security vulnerability: Stack-based...
Cross-Site Scripting vulnerabilities in WordPress
Hello 3APA3A! These are Cross-Site Scripting vulnerabilities in WordPress. Which I've disclosed last week. At WordPress 3.5.2 release, WP developers mentioned about three holes as "security hardenings" to decrease their importance and to make it looks like there were less fixed holes. One of thes...
XSS and FPD vulnerabilities in Search and Share for WordPress
Hello 3APA3A! I want to inform you about vulnerabilities in Search and Share plugin for WordPress. These are Cross-Site Scripting and Full path disclosure vulnerabilities. These XSS holes are in ZeroClipboard.swf, which is used in the plugin. In February I've wrote about Cross-Site Scripting...
FPD, XSS and CS vulnerabilities in Slash WP theme for WordPress
Hello 3APA3A! I want to warn you about multiple vulnerabilities in Slash WP theme for WordPress. This is commercial theme for WP. These are Full path disclosure, Cross-Site Scripting and Content Spoofing vulnerabilities. ------------------------- Affected products: -------------------------...
[waraxe-2013-SA#105] - Multiple Vulnerabilities in Spider Catalog Wordpress Plugin
waraxe-2013-SA105 - Multiple Vulnerabilities in Spider Catalog Wordpress Plugin =================================================================================== Author: Janek Vind "waraxe" Date: 22. May 2013 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-105.html Description of...
WordPress Denial of Service exploit
Hello 3APA3A! Here is my version of vnd's PoC https://vndh.net/note:wordpress-351-denial-service. This exploit is for Denial of Service vulnerability in WordPress 3.4 - 3.5.1. My version solves some issues in original PoC. Concerning this Denial of Service in WordPress. As I wrote last week in my...
XSS and FPD vulnerabilities in Search 'N Save for WordPress
Hello 3APA3A! I want to inform you about vulnerabilities in Search 'N Save plugin for WordPress. These are Cross-Site Scripting and Full path disclosure vulnerabilities. These XSS holes are in ZeroClipboard.swf, which is used in the plugin. In February I wrote about Cross-Site Scripting...
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
[CVE-2013-4695] WinAmp v5.63 gen_ff.dll links.xml Value Parsing Invalid Pointer Dereference
Inshell Security Advisory http://www.inshell.net 1. ADVISORY INFORMATION ----------------------- Product: WinAmp Vendor URL: www.winamp.com Type: Pointer Issues CWE-465 Date found: 2013-06-05 Date published: 2013-07-01 CVSSv2 Score: 4,4 AV:L/AC:M/Au:N/C:P/I:P/A:P CVE: CVE-2013-4695 2. CREDITS...
WordPress category-grid-view-galler plugin Cross-Site Scripting Vulnerabilities
The WordPress category-grid-view-galler plugin suffers from a Cross-Site Scripting vulnerability. Iranian Exploit DataBase http://exploit.iedb.ir Exploit Title : WordPress category-grid-view-galler plugin Cross-Site Scripting Vulnerabilities Author : Iranian Exploit DataBase Discovered By : IeDb...
Wordpress wp-private-messages Plugin Sql Injection vulnerability
The Wordpress wp-private-messages Plugin suffers from a Sql Injection vulnerability. Iranian Exploit DataBase Www.exploit.IrIsT.Ir Exploit Title : Wordpress wp-private-messages Plugin Sql Injection vulnerability Author : Iranian Exploit DataBase Discovered By : IeDb Home : http://exploit.IrIsT.Ir...
FPD and Security bypass vulnerabilities in AntiVirus for WordPress
Hello 3APA3A! These are Full path disclosure and Security bypass vulnerabilities in AntiVirus for WordPress. This is security plugin for detecting exploits and backdoors in WordPress. Which failed to identify my Backdoored Web Application BWA - a reference test of backdoor scanners released in...
Linksys EA - 2700, 3500, 4200, 4500 w/ Lighttpd 1.4.28 Unauthenticated Remote Administration Access
Vulnerable products : Linksys EA2700, EA3500, E4200, EA4500 using lighttpd 1.4.28 and Utopia on Linux 2.6.22 Firmware Version: 1.0.14 EA2700 Firmware Version: 1.0.30 EA3500 Firmware Version: 2.0.36 E4200 Firmware Version: 2.0.36 EA4500 Impact: - Major Timeline: - Still awaiting word back from...
FPD and Security bypass vulnerabilities in Exploit Scanner for WordPress
Hello 3APA3A! These are Full path disclosure and Security bypass vulnerabilities in Exploit Scanner for WordPress. This is security plugin for detecting exploits and backdoors in WordPress. Which failed to identify my Backdoored Web Application BWA - a reference test of backdoor scanners released...
autotrace buffer overflow
Buffer overflow on BMP processing...
[ MDVSA-2013:191 ] fail2ban
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:191 http://www.mandriva.com/en/support/security/ Package : fail2ban Date : July 2, 2013 Affected: Business Server 1.0 Problem Description: Updated fail2ban packages fix CVE-2013-2178 Krzysztof...
Ruby certificate spoofing
It's possible to bypass certificate name check...
FreeBSD mmap+ptrace vulnerability
It's possible to modify mmap memory mapped files via ptrace...
[USN-1884-1] LibRaw vulnerability
========================================================================== Ubuntu Security Notice USN-1884-1 June 18, 2013 libraw vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubunt...
Apple and Wifi Hotspot Credentials Management Vulnerability
This vulnerability was published to the OWASP Mobile Security list as a research paper by Andreas Kurtz, Daniel Metz and Felix Freiling. See "Cracking iOS personal hotspots using a Scrabble crossword game word list,"...
FreeBSD Security Advisory FreeBSD-SA-13:06.mmap [REVISED]
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-13:06.mmap Security Advisory The FreeBSD Project Topic: Privilege escalation via mmap Category: core Module: kernel Announced: 2013-06-18 Credits: Konstantin...
[SECURITY] [DSA 2717-1] xml-security-c security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2717-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso June 28, 2013 http://www.debian.org/security/faq -...
puppet code exeuction
Code execution via YAML object deserialization...
Mozilla Firefox / Thunderbird / Seamonkey multiple security vulnerabilities
Multiple memory corruptions, code execution, information leakages, crossite scripting, protection bypass...
[USN-1885-1] libKDcraw vulnerability
========================================================================== Ubuntu Security Notice USN-1885-1 June 18, 2013 libkdcraw vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...
Barracuda CudaTel 2.6.02.04 - Multiple Web Vulnerabilities
Title: ====== Barracuda CudaTel 2.6.02.04 - Multiple Web Vulnerabilities Date: ===== 2013-06-25 References: =========== http://vulnerability-lab.com/getcontent.php?id=778 BARRACUDA NETWORK SECURITY ID: BNSEC-811 VL-ID: ===== 778 Common Vulnerability Scoring System:...
Barracuda CudaTel 2.6.02.04 - Persistent Web Vulnerability
Title: ====== Barracuda CudaTel 2.6.02.04 - Persistent Web Vulnerability Date: ===== 2013-06-21 References: =========== http://vulnerability-lab.com/getcontent.php?id=777 BARRACUDA NETWORK SECURITY ID: BNSEC-834 VL-ID: ===== 777 Common Vulnerability Scoring System:...
[USN-1889-1] HAProxy vulnerability
========================================================================== Ubuntu Security Notice USN-1889-1 June 20, 2013 haproxy vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubun...
nfs-utils rpc.gssd privilege escalation
Unsafe PTR DNS record resoulution is used in a security related operation...
HAProxy security vulnerabilities
Few memory corruptions...