jetlib.sec

Feeds

167790 items (5219 unread) in 27 feeds

• 1337day (was: Inj3ct0r, 1337db) (718 unread)
• OSVDB Vulnerabilities
• Exploit-DB (374 unread)
• SecurityFocus Vulnerabilities (1680 unread)
• Bugtraq (545 unread)
• Full Disclosure (907 unread)
• XSSed (3 unread)
• Packet Storm Security Headlines (531 unread)
• Packet Storm Security Advisories (323 unread)
• Packet Storm Security Exploits (115 unread)
• Packet Storm Security Recent Files (2 unread)
• Packet Storm Security Tools
• Packet Storm Security Misc. Files
• Sophos security news
• Sophos product advisories
• Penetration Testing (11 unread)
• SecuriTeam (10 unread)
• BackTrack Linux Forums
• Threatpost
• SecDocs
• carnal0wnage.attackresearch.com
• Carnal0wnage
• Kernel Fun
• Darknet
• The Exploitant
• Hack a Day
• Wirevolution

Unread items (250)

• May 15, 2013
• 12:15

  Re: Q: CVE Database with Programming Language and Failure Classification?

   » ‎ Full Disclosure

  Posted by Florian Weimer on May 15

  * Jeffrey Walton:
  
  Red Hat's Bugzilla has CWE tagging for many CVEs, in the "Whiteboard"
  field. Mapping the affected packages to programming languages is some
  work, though. You could map the CVEs to Debian packages through the
  Debian Security Tracker, and use the implemented-in tags provided by
  Debian.
  

  Tags:   

• 12:07

  Cisco Security Advisory: Cisco TelePresence Supervisor MSE 8050 Denial of Service Vulnerability

   » ‎ Bugtraq

  Posted by Cisco Systems Product Security Incident Response Team on May 15

  Cisco Security Advisory: Cisco TelePresence Supervisor MSE 8050 Denial of Service Vulnerability
  
  Advisory ID: cisco-sa-20130515-mse
  
  Revision 1.0
  
  For Public Release 2013 May 15 16:00 UTC (GMT)
  
  +---------------------------------------------------------------------
  
  Summary
  =======
  
  Cisco TelePresence Supervisor MSE 8050 contains a vulnerability that may allow an unauthenticated, remote attacker to
  cause high CPU utilization and a reload of the...
  

  Tags:   

• 12:04

  [Security-news] SA-CONTRIB-2013-047 - Google Authenticator login - Access Bypass

   » ‎ Full Disclosure

  Posted by security-news on May 15

  View online: http://drupal.org/node/1995706
  
  * Advisory ID: DRUPAL-SA-CONTRIB-2013-047
  * Project: Google Authenticator login [1] (third-party module)
  * Version: 6.x, 7.x
  * Date: 2013-May-15
  * Security risk: Moderately critical [2]
  * Exploitable from: Remote
  * Vulnerability: Access bypass
  
  -------- DESCRIPTION
  ---------------------------------------------------------
  
  This module will allow you to add Time-based One-time Password...
  

  Tags:   

• 11:52

  Multiple Vulnerabilities in Exponent CMS

   » ‎ Bugtraq

  Posted by advisory on May 15

  Advisory ID: HTB23154
  Product: Exponent CMS
  Vendor: Online Innovative Creations
  Vulnerable Version(s): 2.2.0 beta 3 and probably prior
  Tested Version: 2.2.0 beta 3
  Vendor Notification: April 24, 2013
  Vendor Patch: May 3, 2013
  Public Disclosure: May 15, 2013
  Vulnerability Type: SQL Injection [CWE-89], PHP File Inclusion [CWE-98]
  CVE References: CVE-2013-3294, CVE-2013-3295
  Risk Level: High
  CVSSv2 Base Scores: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P),...
  

  Tags:   

• 11:22

  SSH User Code Execution

   » ‎ Packet Storm Security Exploits
  This Metasploit module utilizes a stager to upload a base64 encoded binary which is then decoded, chmod'ed and executed from the command shell.

  Tags:   

• 11:09

  [web applications] - Wordpress Newsletter 3.2.6 Cross Site Scripting Vulnerability

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  [web applications] - Wordpress Newsletter 3.2.6 Cross Site Scripting Vulnerability

  Tags:   

• 11:09

  [local exploits] - Kloxo 6.1.12 Privilege Escalation Vulnerability

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  [local exploits] - Kloxo 6.1.12 Privilege Escalation Vulnerability

  Tags:   

• 10:59

  [web applications] - Forumfree, Forumcommunity and Blogfree Filter Bypass

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  [web applications] - Forumfree, Forumcommunity and Blogfree Filter Bypass

  Tags:   

• 10:59

  [dos / poc] - Serva 32 TFTP 2.1.0 - Buffer Overflow Denial of service

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  [dos / poc] - Serva 32 TFTP 2.1.0 - Buffer Overflow Denial of service

  Tags:   

• 10:58

  [dos / poc] - Quick Search Version 1.1.0.189 Buffer Overflow Vulnerability (SEH)

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  [dos / poc] - Quick Search Version 1.1.0.189 Buffer Overflow Vulnerability (SEH)

  Tags:   

• 10:51

  [web applications] - Wordpress wp-FileManager Arbitrary File Download Vulnerability

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  [web applications] - Wordpress wp-FileManager Arbitrary File Download Vulnerability

  Tags:   

• 9:07

  [ MDVSA-2013:165 ] firefox

   » ‎ Bugtraq

  Posted by security on May 15

  _______________________________________________________________________
  
  Mandriva Linux Security Advisory MDVSA-2013:165
  http://www.mandriva.com/en/support/security/
  _______________________________________________________________________
  
  Package : firefox
  Date : May 15, 2013
  Affected: Enterprise Server 5.0
  _______________________________________________________________________
  
  Problem Description:
  
  Multiple...
  

  Tags:   

• 9:06

  Cisco Security Advisory: Cisco TelePresence Supervisor MSE 8050 Denial of Service Vulnerability

   » ‎ Full Disclosure

  Posted by Cisco Systems Product Security Incident Response Team on May 15

  Cisco Security Advisory: Cisco TelePresence Supervisor MSE 8050 Denial of Service Vulnerability
  
  Advisory ID: cisco-sa-20130515-mse
  
  Revision 1.0
  
  For Public Release 2013 May 15 16:00 UTC (GMT)
  
  +---------------------------------------------------------------------
  
  Summary
  =======
  
  Cisco TelePresence Supervisor MSE 8050 contains a vulnerability that may allow an unauthenticated, remote attacker to
  cause high CPU utilization and a reload of the...
  

  Tags:   

• 8:49

  [security bulletin] HPSBUX02859 SSRT101144 rev.3 - HP-UX Running XNTP, Remote Denial of Service (DoS) and Execution of Arbitrary Code

   » ‎ Bugtraq

  Posted by security-alert on May 15

  Note: the current version of the following document is available here:
  https://h20564.www2.hp.com/portal/site/hpsc/public/kb/
  docDisplay?docId=emr_na-c03714526
  
  SUPPORT COMMUNICATION - SECURITY BULLETIN
  
  Document ID: c03714526
  Version: 3
  
  HPSBUX02859 SSRT101144 rev.3 - HP-UX Running XNTP, Remote Denial of Service
  (DoS) and Execution of Arbitrary Code
  
  NOTICE: The information in this Security Bulletin should be acted upon as
  soon as possible....
  

  Tags:   

• 8:32

  [SECURITY] [DSA 2668-1] linux-2.6 security update

   » ‎ Bugtraq

  Posted by dann frazier on May 15

  ----------------------------------------------------------------------
  Debian Security Advisory DSA-2668-1 security () debian org
  http://www.debian.org/security/ Dann Frazier
  May 14, 2013 http://www.debian.org/security/faq
  ----------------------------------------------------------------------
  
  Package : linux-2.6
  Vulnerability : privilege escalation/denial of...
  

  Tags:   

• 4:48

  Indusface Website Hacked and Infected?

   » ‎ Full Disclosure

  Posted by Rahul T on May 15

  Dear All,
  
  I was searching for some information on the internet and it seems that the
  Indusface website was infected with Russian Spam and Malware. There seems
  to be spam and malicious code in the homepage along with many more spam
  pages added into the webroot. Below are some screenshots of the same:
  
  *Indusface Homepage Infected with Russian Spam*
  *
  *
  *[image: Inline image 2]
  *
  *
  *
  *Google Search Results Showing Indusface Pages with Russian Spam...
  

  Tags:   

• 3:24

  [ MDVSA-2013:165 ] firefox

   » ‎ Full Disclosure

  Posted by security on May 15

  _______________________________________________________________________
  
  Mandriva Linux Security Advisory MDVSA-2013:165
  http://www.mandriva.com/en/support/security/
  _______________________________________________________________________
  
  Package : firefox
  Date : May 15, 2013
  Affected: Enterprise Server 5.0
  _______________________________________________________________________
  
  Problem Description:
  
  Multiple...
  

  Tags:   

• 2:10

  [SECURITY] [DSA 2668-1] linux-2.6 security update

   » ‎ Full Disclosure

  Posted by dann frazier on May 15

  ----------------------------------------------------------------------
  Debian Security Advisory DSA-2668-1 security () debian org
  http://www.debian.org/security/ Dann Frazier
  May 14, 2013 http://www.debian.org/security/faq
  ----------------------------------------------------------------------
  
  Package : linux-2.6
  Vulnerability : privilege escalation/denial of...
  

  Tags:   

• 0:00

  Vuln: Microsoft .NET Framework CVE-2013-1337 Authentication Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Microsoft .NET Framework CVE-2013-1337 Authentication Bypass Vulnerability

  Tags:   

• 0:00

  Vuln: Linux Kernel CVE-2012-6542 Local Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Linux Kernel CVE-2012-6542 Local Information Disclosure Vulnerability

  Tags:   

• 0:00

  Vuln: Oracle Java SE CVE-2013-2422 Remote Java Runtime Environment Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Oracle Java SE CVE-2013-2422 Remote Java Runtime Environment Vulnerability

  Tags:   

• 0:00

  Vuln: Adobe Acrobat and Reader APSB13-15 Multiple Security Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  Adobe Acrobat and Reader APSB13-15 Multiple Security Vulnerabilities

  Tags:   

• 0:00

  Vuln: Linux Kernel VFAT Filesystem Local Buffer Overflow Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Linux Kernel VFAT Filesystem Local Buffer Overflow Vulnerability

  Tags:   

• 0:00

  Vuln: Mozilla Firefox and Thunderbird CVE-2013-1678 Memory Corruption Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Mozilla Firefox and Thunderbird CVE-2013-1678 Memory Corruption Vulnerability

  Tags:   

• 0:00

  Vuln: Cisco WebEx Social CVE-2013-1244 Cross Site Scripting Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Cisco WebEx Social CVE-2013-1244 Cross Site Scripting Vulnerability

  Tags:   

• 0:00

  Vuln: Mozilla Firefox SeaMonkey and Thunderbird CVE-2012-1942 Local Privilege Escalation Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Mozilla Firefox SeaMonkey and Thunderbird CVE-2012-1942 Local Privilege Escalation Vulnerability

  Tags:   

• 0:00

  Vuln: Mozilla Firefox and Thunderbird CVE-2013-1670 Cross Site Scripting Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Mozilla Firefox and Thunderbird CVE-2013-1670 Cross Site Scripting Vulnerability

  Tags:   

• 0:00

  Vuln: OpenSSL ECC Private Key Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL ECC Private Key Information Disclosure Vulnerability

  Tags:   

• 0:00

  Vuln: Oracle Java SE CVE-2013-1540 Remote Java Runtime Environment Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Oracle Java SE CVE-2013-1540 Remote Java Runtime Environment Vulnerability

  Tags:   

• 0:00

  Vuln: CMSLogik Arbitrary File Upload and Multiple HTML Injection Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  CMSLogik Arbitrary File Upload and Multiple HTML Injection Vulnerabilities

  Tags:   

• 0:00

  Vuln: VideoJS Cross Site Scripting and Denial of Service Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  VideoJS Cross Site Scripting and Denial of Service Vulnerabilities

  Tags:   

• 0:00

  Vuln: Oracle Java SE CVE-2013-2420 Integer Overflow Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Oracle Java SE CVE-2013-2420 Integer Overflow Vulnerability

  Tags:   

• 0:00

  Vuln: Mozilla Firefox/Thunderbird CVE-2013-1674 Remote Code Execution Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Mozilla Firefox/Thunderbird CVE-2013-1674 Remote Code Execution Vulnerability

  Tags:   

• 0:00

  Vuln: Mozilla Firefox and Thunderbird CVE-2013-1680 Use After Free Memory Corruption Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Mozilla Firefox and Thunderbird CVE-2013-1680 Use After Free Memory Corruption Vulnerability

  Tags:   

• 0:00

  Vuln: Mozilla Firefox and Thunderbird CVE-2013-0801 Memory Corruption Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Mozilla Firefox and Thunderbird CVE-2013-0801 Memory Corruption Vulnerability

  Tags:   

• May 14, 2013
• 22:14

  German Publisher Accuses Microsoft Of URL Sniffing

   » ‎ Packet Storm Security Headlines
  German Publisher Accuses Microsoft Of URL Sniffing

  Tags:   

• 22:11

  Russia Busts CIA 'Spy' And His Gmail

   » ‎ Packet Storm Security Headlines
  Russia Busts CIA 'Spy' And His Gmail

  Tags:   

• 22:11

  IE 0-Day Highlights Microsoft May Patch Release

   » ‎ Packet Storm Security Headlines
  IE 0-Day Highlights Microsoft May Patch Release

  Tags:   

• 22:10

  EU To Warn China It May Levy Duties Against Huawei

   » ‎ Packet Storm Security Headlines
  EU To Warn China It May Levy Duties Against Huawei

  Tags:   

• 17:00

  [dos] - Serva 32 TFTP 2.1.0 - Buffer Overflow Denial of service

   » ‎ Exploit-DB
  Serva 32 TFTP 2.1.0 - Buffer Overflow Denial of service

  Tags:   

• 15:02

  [web applications] - Joomla Jnews 8.0.1 Cross Site Scripting Vulnerability

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  [web applications] - Joomla Jnews 8.0.1 Cross Site Scripting Vulnerability

  Tags:   

• 15:01

  [web applications] - WordPress Securimage 3.2.4 Cross Site Scripting Vulnerability

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  [web applications] - WordPress Securimage 3.2.4 Cross Site Scripting Vulnerability

  Tags:   

• 15:01

  [web applications] - WordPress Video JS Cross Site Scripting Vulnerability

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  [web applications] - WordPress Video JS Cross Site Scripting Vulnerability

  Tags:   

• 15:00

  [web applications] - WordPress Search And Share 0.9.3 Cross Site Scripting Vulnerability

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  [web applications] - WordPress Search And Share 0.9.3 Cross Site Scripting Vulnerability

  Tags:   

• 14:58

  [local exploits] - Avira Personal Privilege Escalation Vulnerability

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  [local exploits] - Avira Personal Privilege Escalation Vulnerability

  Tags:   

• 13:12

  Remote command Injection in Creme Fraiche 0.6 Ruby Gem

   » ‎ Full Disclosure

  Posted by Larry W. Cashdollar on May 14

  TITLE: Remote command Injection in Creme Fraiche 0.6 Ruby Gem
  
  DATE: 5/14/2013
  
  AUTHOR: Larry W. Cashdollar (@_larry0)
  
  DOWNLOAD: http://rubygems.org/gems/cremefraiche, http://www.uplawski.eu/technology/cremefraiche/
  
  DESCRIPTION: Converts Email to PDF files.
  
  VENDOR: Notifed on 5/13/2013, provided fix 5/14/2013
  
  FIX: Version in 0.6.1
  
  CVE: 2013-2090
  
  DETAILS: The following lines pass unsanitized user input directly to the command line.
  A...
  

  Tags:   

• 12:07

  www.netcraft.com - "Search Form" Cross-site Scripting vulnerability

   » ‎ Full Disclosure

  Posted by Stefan Schurtz on May 14

  Advisory: www.netcraft.com - Search Form Cross-site Scripting vulnerability
  Advisory ID: SSCHADV2013-008
  Author: Stefan Schurtz
  Affected Software: Successfully tested on www.netcraft.com
  Vendor URL: http://www.netcraft.com
  Vendor Status: fixed
  
  ==========================
  Vulnerability Description
  ==========================
  
  The 'q'-Parameter in the Search Form on...
  

  Tags:   

• 9:07

  Vulnerabilities in multiple plugins for WordPress with VideoJS

   » ‎ Full Disclosure

  Posted by MustLive on May 14

  Hello list!
  
  These are Cross-Site Scripting vulnerabilities in multiple plugins for
  WordPress with VideoJS. Earlier I've wrote about vulnerabilities in VideoJS
  (http://seclists.org/fulldisclosure/2013/May/21). This is popular video and
  audio player, which is used at hundreds thousands of web sites and in
  multiple web applications. Google dork for VideoJS shows 446000 results and
  for WP plugins with it shows 178000 (inurl:video-js.swf...
  

  Tags:   

• 7:56

  Bloomberg: Yes, Reporters Had Access To Client Data

   » ‎ Packet Storm Security Headlines
  Bloomberg: Yes, Reporters Had Access To Client Data

  Tags:   

• 7:55

  French Bean-Counters Sweet Talked Into Trojans

   » ‎ Packet Storm Security Headlines
  French Bean-Counters Sweet Talked Into Trojans

  Tags:   

• 7:55

  Google Android Malware Levels Rocket As Spam Threats Grow

   » ‎ Packet Storm Security Headlines
  Google Android Malware Levels Rocket As Spam Threats Grow

  Tags:   

• 7:55

  A Saudi Arabia Telecom's Surveillance Pitch

   » ‎ Packet Storm Security Headlines
  A Saudi Arabia Telecom's Surveillance Pitch

  Tags:   

• 4:09

  GreHack 2013 - Call For Papers - November 15, Grenoble, France

   » ‎ Full Disclosure

  Posted by F. Duchene on May 14

  ---------------------------
  *GreHack 2013* — 2nd Call For Papers
  November 15, Grenoble, France
  http://grehack.org — Twitter: @grehack
  ---------------------------
  *Topics*
  The 2nd International Symposium on Grey-Hat Hacking — aka GreHack 2013
  — will gather researchers and practitioners from academia, industry,
  and government to discuss new advances in computer and information
  security research.
  
  All topics related to vulnerability...
  

  Tags:   

• 4:00

  [HITB-Announce] HITB Magazine Issue 010

   » ‎ Full Disclosure

  Posted by Hafez Kamal on May 14

  Hi everyone,
  
  A small reminder that article submissions for HITB Magazine Issue 010
  are due tomorrow (15th May 2013). If you're interested in submitting
  please send your > 3000 word article to editorial () hackinthebox org
  
  Topics of interest include, but are not limited to the following:
  
  Next generation attacks and exploits
  Apple / OS X security vulnerabilities
  SS7/Backbone telephony networks
  VoIP security
  Data...
  

  Tags:   

• 0:00

  Vuln: LibTIFF CVE-2013-1961 Stack Based Buffer Overflow Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  LibTIFF CVE-2013-1961 Stack Based Buffer Overflow Vulnerability

  Tags:   

• 0:00

  Vuln: WordPress Plupload Plugin 'id' Parameter Cross Site Scripting Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  WordPress Plupload Plugin 'id' Parameter Cross Site Scripting Vulnerability

  Tags:   

• 0:00

  Vuln: LibTIFF 't2_process_jpeg_strip()' Function Heap-based Buffer Overflow Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  LibTIFF 't2_process_jpeg_strip()' Function Heap-based Buffer Overflow Vulnerability

  Tags:   

• 0:00

  Vuln: GeSHi CVE-2012-3521 Multiple Local File Include Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  GeSHi CVE-2012-3521 Multiple Local File Include Vulnerabilities

  Tags:   

• 0:00

  Vuln: Dolibarr Multiple Cross Site Scripting Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  Dolibarr Multiple Cross Site Scripting Vulnerabilities

  Tags:   

• 0:00

  Vuln: Dolibarr 'htdocs/core/lib/barcode.lib.php' Remote Command Injection Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Dolibarr 'htdocs/core/lib/barcode.lib.php' Remote Command Injection Vulnerability

  Tags:   

• 0:00

  Vuln: Dolibarr 'pays' Parameter SQL Injection Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Dolibarr 'pays' Parameter SQL Injection Vulnerability

  Tags:   

• 0:00

  Vuln: IBM Lotus Domino CVE-2013-0489 Cross Site Request Forgery Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  IBM Lotus Domino CVE-2013-0489 Cross Site Request Forgery Vulnerability

  Tags:   

• 0:00

  Vuln: Gallery 'key' Values Cross-Site Scripting Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Gallery 'key' Values Cross-Site Scripting Vulnerability

  Tags:   

• 0:00

  Vuln: VBulletin 'nodeid' Parameter SQL Injection Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  VBulletin 'nodeid' Parameter SQL Injection Vulnerability

  Tags:   

• 0:00

  Vuln: Adobe ColdFusion CVE-2013-3336 Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Adobe ColdFusion CVE-2013-3336 Information Disclosure Vulnerability

  Tags:   

• 0:00

  Vuln: Linux Kernel KVM 'create_pit_timer()' Function Local Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Linux Kernel KVM 'create_pit_timer()' Function Local Denial of Service Vulnerability

  Tags:   

• 0:00

  Vuln: Linux Kernel 'x25_parse_facilities()' Remote Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Linux Kernel 'x25_parse_facilities()' Remote Denial of Service Vulnerability

  Tags:   

• 0:00

  Vuln: Microsoft Internet Explorer CVE-2013-1312 Use-After-Free Remote Code Execution Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Microsoft Internet Explorer CVE-2013-1312 Use-After-Free Remote Code Execution Vulnerability

  Tags:   

• 0:00

  Vuln: Microsoft Internet Explorer CVE-2013-1313 Use-After-Free Remote Code Execution Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Microsoft Internet Explorer CVE-2013-1313 Use-After-Free Remote Code Execution Vulnerability

  Tags:   

• 0:00

  Vuln: Microsoft Internet Explorer CVE-2013-1347 Use-After-Free Remote Code Execution Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Microsoft Internet Explorer CVE-2013-1347 Use-After-Free Remote Code Execution Vulnerability

  Tags:   

• 0:00

  Vuln: Microsoft Internet Explorer CVE-2013-2551 Use-After-Free Remote Code Execution Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Microsoft Internet Explorer CVE-2013-2551 Use-After-Free Remote Code Execution Vulnerability

  Tags:   

• May 13, 2013
• 21:11

  [web applications] - Gallery Server Pro File Upload Filter Bypass Vulnerability

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  [web applications] - Gallery Server Pro File Upload Filter Bypass Vulnerability

  Tags:   

• 21:10

  [local exploits] - Linux PERF_EVENTS Local Root Exploit

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  [local exploits] - Linux PERF_EVENTS Local Root Exploit

  Tags:   

• 21:10

  [web applications] - Invision Power Board 1.x / 2.x / 3.x Admin Account Takeover

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  [web applications] - Invision Power Board 1.x / 2.x / 3.x Admin Account Takeover

  Tags:   

• 21:04

  NBN Hoses Down Russian Cracker Report

   » ‎ Packet Storm Security Headlines
  NBN Hoses Down Russian Cracker Report

  Tags:   

• 21:04

  FBI Provided US Banks With Cyber Security Attack Insights

   » ‎ Packet Storm Security Headlines
  FBI Provided US Banks With Cyber Security Attack Insights

  Tags:   

• 21:02

  Government Obtains Wide AP Phone Records In Probe

   » ‎ Packet Storm Security Headlines
  Government Obtains Wide AP Phone Records In Probe

  Tags:   

• 21:02

  Hacking Exploit Pops Up For Bethesda's Skyrim And Fallout

   » ‎ Packet Storm Security Headlines
  Hacking Exploit Pops Up For Bethesda's Skyrim And Fallout

  Tags:   

• 21:00

  Q: CVE Database with Programming Language and Failure Classification?

   » ‎ Full Disclosure

  Posted by Jeffrey Walton on May 14

  Hi All,
  
  Does anyone know where to find an augmented CVE database with: (1)
  programming language and (2) failure classification?
  
  For example, CVE-2013-3301 is the Linux kernel, written in C, and the
  failure is lack of parameter validation. As another example,
  CVE-2013-3302 would also be the Linux kernel, written in C, with a
  failure of race condition.
  
  (I'm very interested in aggregated data on all programs/modules
  written in...
  

  Tags:   

• 20:29

  [web applications] - WHMCS 4.x SQL Injection Vulnerability

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  [web applications] - WHMCS 4.x SQL Injection Vulnerability

  Tags:   

• 19:19

  Security-Assessment.com Advisory: Gallery Server Pro File Upload Filter Bypass

   » ‎ Full Disclosure

  Posted by Drew Calcott on May 14

  ( , ) (,
  . `.' ) ('. ',
  ). , ('. ( ) (
  (_,) .`), ) _ _,
  / _____/ / _ \ ____ ____ _____
  \____ \==/ /_\ \ _/ ___\/ _ \ / \
  / \/ | \\ \__( <_> ) Y Y \
  /______ /\___|__ / \___ >____/|__|_| /
  \/ \/ .-. \/ \/:wq
  (x.0)
  '=.|w|.='
  _='`"``=.
  
  presents.....
  

  Tags:   

• 17:00

  Bugtraq: SimpleTransfer 2.2.1 - Command Injection Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  SimpleTransfer 2.2.1 - Command Injection Vulnerabilities

  Tags:   

• 17:00

  [webapps] - WHMCS 4.x (invoicefunctions.php, id param) - SQL Injection Vulnerability

   » ‎ Exploit-DB
  WHMCS 4.x (invoicefunctions.php, id param) - SQL Injection Vulnerability

  Tags:   

• 17:00

  [webapps] - IPB (Invision Power Board) all versions (1.x? / 2.x / 3.x) - Admin Account Takeover

   » ‎ Exploit-DB
  IPB (Invision Power Board) all versions (1.x? / 2.x / 3.x) - Admin Account Takeover

  Tags:   

• 17:00

  [remote] - SAP SOAP RFC SXPG_COMMAND_EXECUTE Remote Command Execution

   » ‎ Exploit-DB
  SAP SOAP RFC SXPG_COMMAND_EXECUTE Remote Command Execution

  Tags:   

• 17:00

  [remote] - SAP SOAP RFC SXPG_CALL_SYSTEM Remote Command Execution

   » ‎ Exploit-DB
  SAP SOAP RFC SXPG_CALL_SYSTEM Remote Command Execution

  Tags:   

• 17:00

  [local] - Linux PERF_EVENTS - Local Root Exploit

   » ‎ Exploit-DB
  Linux PERF_EVENTS - Local Root Exploit

  Tags:   

• 17:00

  [local] - Linux Kernel open-time Capability file_ns_capable() Privilege Escalation

   » ‎ Exploit-DB
  Linux Kernel open-time Capability file_ns_capable() Privilege Escalation

  Tags:   

• 17:00

  [webapps] - UMI.CMS 2.9 - CSRF Vulnerability

   » ‎ Exploit-DB
  UMI.CMS 2.9 - CSRF Vulnerability

  Tags:   

• 17:00

  [local] - ERS Viewer 2011 ERS File Handling Buffer Overflow

   » ‎ Exploit-DB
  ERS Viewer 2011 ERS File Handling Buffer Overflow

  Tags:   

• 17:00

  [webapps] - AlienVault OSSIM 4.1.2 - Multiple SQL Injection Vulnerabilities

   » ‎ Exploit-DB
  AlienVault OSSIM 4.1.2 - Multiple SQL Injection Vulnerabilities

  Tags:   

• 17:00

  [dos] - Quick Search Version 1.1.0.189 Buffer Overflow Vulnerability (SEH)

   » ‎ Exploit-DB
  Quick Search Version 1.1.0.189 Buffer Overflow Vulnerability (SEH)

  Tags:   

• 16:00

  Bugtraq: File Lite 3.3 & 3.5 PRO iOS - Multiple Web Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  File Lite 3.3 & 3.5 PRO iOS - Multiple Web Vulnerabilities

  Tags:   

• 13:00

  Bugtraq: [ MDVSA-2013:164 ] mesa

   » ‎ SecurityFocus Vulnerabilities
  [ MDVSA-2013:164 ] mesa

  Tags:   

• 12:22

  Mandriva Linux Security Advisory 2013-164

   » ‎ Packet Storm Security Advisories
  Mandriva Linux Security Advisory 2013-164 - It was discovered that Mesa incorrectly handled certain arrays. An attacker could use this issue to cause Mesa to crash, resulting in a denial of service, or possibly execute arbitrary code. Mesa has also been updated to version 8.0.5, fixing several bugs.

  Tags:   

• 12:00

  Bugtraq: [RT-SA-2013-001] Advisory: Exim with Dovecot: Typical Misconfiguration Leads to Remote Command Execution

   » ‎ SecurityFocus Vulnerabilities
  [RT-SA-2013-001] Advisory: Exim with Dovecot: Typical Misconfiguration Leads to Remote Command Execution

  Tags:   

• 10:11

  IPB (Invision Power Board) all versions (1.x? / 2.x / 3.x) Admin account Takeover leading to code execution

   » ‎ Full Disclosure

  Posted by John JEAN on May 13

  IPB (Invision Power Board) all versions (1.x? / 2.x / 3.x) Admin account Takeover leading to code execution
  
  Written on : 2013/05/02
  Released on : 2013/05/13
  Author: John JEAN (@johnjean on twitter)
  Affected application: Invision Power Board <= 3.4.4
  Type of vulnerability: Logical Vulnerability / Bad Sanitization
  Required informations : Administrator's email
  Evaluated Risk : Critical
  Solution Status : A patch has been released which fixes...
  

  Tags:   

• 9:58

  File Lite 3.3 & 3.5 PRO iOS - Multiple Web Vulnerabilities

   » ‎ Bugtraq

  Posted by Vulnerability Lab on May 13

  ======
  File Lite 3.3 & 3.5 PRO iOS - Multiple Web Vulnerabilities
  
  Date:
  =====
  2013-05-04
  
  References:
  ===========
  http://www.vulnerability-lab.com/get_content.php?id=939
  
  VL-ID:
  =====
  939
  
  Common Vulnerability Scoring System:
  ====================================
  5.9
  
  Introduction:
  =============
  You have tons of files you need to get from one device to another, so what do you do? You use File Pro, that’s what you
  do.
  App Chronicles!...
  

  Tags:   

• 9:46

  SimpleTransfer 2.2.1 - Command Injection Vulnerabilities

   » ‎ Bugtraq

  Posted by Vulnerability Lab on May 13

  Title:
  ======
  SimpleTransfer 2.2.1 - Command Injection Vulnerabilities
  
  Date:
  =====
  2013-05-03
  
  References:
  ===========
  http://www.vulnerability-lab.com/get_content.php?id=937
  
  VL-ID:
  =====
  937
  
  Common Vulnerability Scoring System:
  ====================================
  5.6
  
  Introduction:
  =============
  Simple Transfer is the easiest way of transferring your Photos and Videos to computer and other iOS devices via WiFi.
  No need for cable, iTunes or...
  

  Tags:   

• 9:33

  Wireless Photo Access 1.0.10 iOS - Multiple Vulnerabilities

   » ‎ Bugtraq

  Posted by Vulnerability Lab on May 13

  Title:
  ======
  Wireless Photo Access 1.0.10 iOS - Multiple Vulnerabilities
  
  Date:
  =====
  2013-04-27
  
  References:
  ===========
  http://www.vulnerability-lab.com/get_content.php?id=934
  
  VL-ID:
  =====
  934
  
  Common Vulnerability Scoring System:
  ====================================
  5.6
  
  Introduction:
  =============
  Is it too difficult to get your photos and videos in original quality from your iPhone or iPad? Simply access them
  from any nearby computer or...
  

  Tags:   

• 9:19

  Wifi Album v1.47 iOS - Command Injection Vulnerability

   » ‎ Bugtraq

  Posted by Vulnerability Lab on May 13

  Title:
  ======
  Wifi Album v1.47 iOS - Command Injection Vulnerability
  
  Date:
  =====
  2013-04-25
  
  References:
  ===========
  http://www.vulnerability-lab.com/get_content.php?id=935
  
  VL-ID:
  =====
  935
  
  Common Vulnerability Scoring System:
  ====================================
  5.6
  
  Introduction:
  =============
  WiFi Album allows you to easily transfer photos and videos between iPhone,iPad,iTouch,iMac and PC. Transfer photos and
  videos
  over WiFi, no cables...
  

  Tags:   

• 9:05

  Wifi Photo Transfer 2.1 & 1.1 PRO - Multiple Vulnerabilities

   » ‎ Bugtraq

  Posted by Vulnerability Lab on May 13

  Title:
  ======
  Wifi Photo Transfer 2.1 & 1.1 PRO - Multiple Vulnerabilities
  
  Date:
  =====
  2013-04-21
  
  References:
  ===========
  http://www.vulnerability-lab.com/get_content.php?id=932
  
  VL-ID:
  =====
  932
  
  Common Vulnerability Scoring System:
  ====================================
  6.1
  
  Introduction:
  =============
  Easily access your photo libraries via wifi from any computer with a web browser! Just start the app and enter the
  displayed address into...
  

  Tags:   

• 8:52

  Wireless Disk PRO v2.3 iOS - Multiple Web Vulnerabilities

   » ‎ Bugtraq

  Posted by Vulnerability Lab on May 13

  Title:
  ======
  Wireless Disk PRO v2.3 iOS - Multiple Web Vulnerabilities
  
  Date:
  =====
  2013-02-26
  
  References:
  ===========
  http://www.vulnerability-lab.com/get_content.php?id=883
  
  VL-ID:
  =====
  883
  
  Common Vulnerability Scoring System:
  ====================================
  6.2
  
  Introduction:
  =============
  AirDisk Pro allows you to store, view and manage files on your iPhone, iPad or iPod touch. You can connect to AirDisk
  Pro from any Mac or
  PC over...
  

  Tags:   

• 8:38

  [RT-SA-2013-001] Advisory: Exim with Dovecot: Typical Misconfiguration Leads to Remote Command Execution

   » ‎ Bugtraq

  Posted by RedTeam Pentesting GmbH on May 13

  Advisory: Exim with Dovecot: Typical Misconfiguration Leads to Remote
  Command Execution
  
  During a penetration test a typical misconfiguration was found in the
  way Dovecot is used as a local delivery agent by Exim. A common use
  case for the Dovecot IMAP and POP3 server is the use of Dovecot as a
  local delivery agent for Exim. The Dovecot documentation contains an example
  using a dangerous configuration option for Exim, which leads to a...
  

  Tags:   

• 8:22

  [ MDVSA-2013:164 ] mesa

   » ‎ Bugtraq

  Posted by security on May 13

  _______________________________________________________________________
  
  Mandriva Linux Security Advisory MDVSA-2013:164
  http://www.mandriva.com/en/support/security/
  _______________________________________________________________________
  
  Package : mesa
  Date : May 13, 2013
  Affected: Business Server 1.0
  _______________________________________________________________________
  
  Problem Description:
  
  Updated mesa...
  

  Tags:   

• 8:05

  [SECURITY] [DSA 2667-1] mysql-5.5 security update

   » ‎ Bugtraq

  Posted by Moritz Muehlenhoff on May 13

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2667-1 security () debian org
  http://www.debian.org/security/ Moritz Muehlenhoff
  May 12, 2013 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : mysql-5.5
  Vulnerability : several
  Problem type : remote...
  

  Tags:   

• 7:53

  [SECURITY] [DSA 2666-1] xen security update

   » ‎ Bugtraq

  Posted by Salvatore Bonaccorso on May 13

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2666-1 security () debian org
  http://www.debian.org/security/ Salvatore Bonaccorso
  May 12, 2013 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : xen
  Vulnerability : several
  Problem type : remote...
  

  Tags:   

• 7:40

  [ MDVSA-2013:164 ] mesa

   » ‎ Full Disclosure

  Posted by security on May 13

  _______________________________________________________________________
  
  Mandriva Linux Security Advisory MDVSA-2013:164
  http://www.mandriva.com/en/support/security/
  _______________________________________________________________________
  
  Package : mesa
  Date : May 13, 2013
  Affected: Business Server 1.0
  _______________________________________________________________________
  
  Problem Description:
  
  Updated mesa...
  

  Tags:   

• 7:38

  US Data Breach Exposes 160,000 Social Security Numbers

   » ‎ Packet Storm Security Headlines
  US Data Breach Exposes 160,000 Social Security Numbers

  Tags:   

• 7:35

  Bitcoins Are Being Traded For Hack Tools

   » ‎ Packet Storm Security Headlines
  Bitcoins Are Being Traded For Hack Tools

  Tags:   

• 7:35

  WASC Announcement: Static Analysis Technologies Evaluation Criteria Published

   » ‎ Bugtraq

  Posted by announcements on May 13

  The Web Application Security Consortium (WASC) is pleased to announce the
  Static Analysis Technologies Evaluation Criteria. The goal of the SATEC
  project is to create a vendor-neutral set of criteria to help guide
  application security professionals during the process of acquiring a
  static code analysis technology that is intended to be used during
  source-code driven security programs. This document provides a
  comprehensive list of criteria that...
  

  Tags:   

• 7:12

  [dos / poc] - No-IP Dynamic Update Client (DUC) 2.1.9 - Local IP Address Stack Overflow

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  [dos / poc] - No-IP Dynamic Update Client (DUC) 2.1.9 - Local IP Address Stack Overflow

  Tags:   

• 7:11

  [local exploits] - Kloxo 6.1.6 - Local Privilege Escalation

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  [local exploits] - Kloxo 6.1.6 - Local Privilege Escalation

  Tags:   

• 0:00

  Vuln: Schneider Electric Accutech Manager Heap Buffer Overflow Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Schneider Electric Accutech Manager Heap Buffer Overflow Vulnerability

  Tags:   

• 0:00

  Vuln: Xen CVE-2013-1964 Local Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Xen CVE-2013-1964 Local Denial of Service Vulnerability

  Tags:   

• 0:00

  Vuln: IBM Sterling External Authentication Server Local Arbitrary Command Execution Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  IBM Sterling External Authentication Server Local Arbitrary Command Execution Vulnerability

  Tags:   

• 0:00

  Vuln: Oracle Java SE CVE-2013-2434 Remote Code Execution Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Oracle Java SE CVE-2013-2434 Remote Code Execution Vulnerability

  Tags:   

• 0:00

  Vuln: Cisco Network Admission Control Manager CVE-2013-1177 SQL Injection Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Cisco Network Admission Control Manager CVE-2013-1177 SQL Injection Vulnerability

  Tags:   

• 0:00

  Vuln: Oracle Java SE CVE-2013-1491 Remote Code Execution Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Oracle Java SE CVE-2013-1491 Remote Code Execution Vulnerability

  Tags:   

• 0:00

  Vuln: Oracle Java SE CVE-2013-2436 Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Oracle Java SE CVE-2013-2436 Security Bypass Vulnerability

  Tags:   

• 0:00

  Vuln: Linux Kernel hypervkvpd 'hv_kvp_daemon.c' Netlink Packet Processing Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Linux Kernel hypervkvpd 'hv_kvp_daemon.c' Netlink Packet Processing Denial of Service Vulnerability

  Tags:   

• 0:00

  Vuln: Oracle Java SE CVE-2013-0440 Remote Java Runtime Environment Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Oracle Java SE CVE-2013-0440 Remote Java Runtime Environment Vulnerability

  Tags:   

• 0:00

  Vuln: Multiple TLS And DTLS Implementations CVE-2013-0169 Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Multiple TLS And DTLS Implementations CVE-2013-0169 Information Disclosure Vulnerability

  Tags:   

• 0:00

  Vuln: Google Chrome OS Prior to 23.0.1271.94 CVE-2012-5129 Heap Based Buffer Overflow Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Google Chrome OS Prior to 23.0.1271.94 CVE-2012-5129 Heap Based Buffer Overflow Vulnerability

  Tags:   

• 0:00

  Vuln: Invision Power Board IP.Board Administrator Account Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Invision Power Board IP.Board Administrator Account Security Bypass Vulnerability

  Tags:   

• 0:00

  Vuln: Apache HTTP Server Multiple Cross Site Scripting Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  Apache HTTP Server Multiple Cross Site Scripting Vulnerabilities

  Tags:   

• May 12, 2013
• 17:00

  [local] - Kloxo 6.1.6 - Local Privilege Escalation

   » ‎ Exploit-DB
  Kloxo 6.1.6 - Local Privilege Escalation

  Tags:   

• 17:00

  [webapps] - GetSimpleCMS 3.2.1 Arbitrary File Upload Vulnerability

   » ‎ Exploit-DB
  GetSimpleCMS 3.2.1 Arbitrary File Upload Vulnerability

  Tags:   

• 17:00

  [webapps] - File Lite 3.3 & 3.5 PRO iOS - Multiple Vulnerabilities

   » ‎ Exploit-DB
  File Lite 3.3 & 3.5 PRO iOS - Multiple Vulnerabilities

  Tags:   

• 17:00

  [webapps] - SimpleTransfer 2.2.1 - Command Injection Vulnerabilities

   » ‎ Exploit-DB
  SimpleTransfer 2.2.1 - Command Injection Vulnerabilities

  Tags:   

• 17:00

  [webapps] - Wireless Photo Access 1.0.10 iOS - Multiple Vulnerabilities

   » ‎ Exploit-DB
  Wireless Photo Access 1.0.10 iOS - Multiple Vulnerabilities

  Tags:   

• 17:00

  [webapps] - Wifi Album v1.47 iOS - Command Injection Vulnerability

   » ‎ Exploit-DB
  Wifi Album v1.47 iOS - Command Injection Vulnerability

  Tags:   

• 17:00

  [webapps] - Wifi Photo Transfer 2.1 & 1.1 PRO - Multiple Vulnerabilities

   » ‎ Exploit-DB
  Wifi Photo Transfer 2.1 & 1.1 PRO - Multiple Vulnerabilities

  Tags:   

• 17:00

  [webapps] - Wireless Disk PRO v2.3 iOS - Multiple Vulnerabilities

   » ‎ Exploit-DB
  Wireless Disk PRO v2.3 iOS - Multiple Vulnerabilities

  Tags:   

• 17:00

  [dos] - No-IP Dynamic Update Client (DUC) 2.1.9 - Local IP Address Stack Overflow

   » ‎ Exploit-DB
  No-IP Dynamic Update Client (DUC) 2.1.9 - Local IP Address Stack Overflow

  Tags:   

• 16:33

  Debian Security Advisory 2667-1

   » ‎ Packet Storm Security Advisories
  Debian Linux Security Advisory 2667-1 - Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to a new upstream version, 5.5.31, which includes additional changes, such as performance improvements and corrections for data loss defects.

  Tags:   

• 14:25

  Re: Paypal Bug Bounty #31 - Mail Encoding Web Vulnerability

   » ‎ Full Disclosure

  Posted by Jakub Zoczek on May 12

  This bug was disclosed few months before it was found ;-)
  
  On Sun, May 12, 2013 at 10:45 PM, Michal Zalewski <lcamtuf () coredump cx>wrote:
  

  Tags:   

• 14:21

  File Lite 3.3 & 3.5 PRO iOS - Multiple Web Vulnerabilities

   » ‎ Full Disclosure

  Posted by Vulnerability Lab on May 12

  Title:
  ======
  File Lite 3.3 & 3.5 PRO iOS - Multiple Web Vulnerabilities
  
  Date:
  =====
  2013-05-04
  
  References:
  ===========
  http://www.vulnerability-lab.com/get_content.php?id=939
  
  VL-ID:
  =====
  939
  
  Common Vulnerability Scoring System:
  ====================================
  5.9
  
  Introduction:
  =============
  You have tons of files you need to get from one device to another, so what do you do? You use File Pro, that’s what you
  do.
  App...
  

  Tags:   

• 14:16

  SimpleTransfer 2.2.1 - Command Injection Vulnerabilities

   » ‎ Full Disclosure

  Posted by Vulnerability Lab on May 12

  Title:
  ======
  SimpleTransfer 2.2.1 - Command Injection Vulnerabilities
  
  Date:
  =====
  2013-05-03
  
  References:
  ===========
  http://www.vulnerability-lab.com/get_content.php?id=937
  
  VL-ID:
  =====
  937
  
  Common Vulnerability Scoring System:
  ====================================
  5.6
  
  Introduction:
  =============
  Simple Transfer is the easiest way of transferring your Photos and Videos to computer and other iOS devices via WiFi.
  No need for cable, iTunes or...
  

  Tags:   

• 14:08

  Wireless Photo Access 1.0.10 iOS - Multiple Vulnerabilities

   » ‎ Full Disclosure

  Posted by Vulnerability Lab on May 12

  Title:
  ======
  Wireless Photo Access 1.0.10 iOS - Multiple Vulnerabilities
  
  Date:
  =====
  2013-04-27
  
  References:
  ===========
  http://www.vulnerability-lab.com/get_content.php?id=934
  
  VL-ID:
  =====
  934
  
  Common Vulnerability Scoring System:
  ====================================
  5.6
  
  Introduction:
  =============
  Is it too difficult to get your photos and videos in original quality from your iPhone or iPad? Simply access them
  from any nearby computer or...
  

  Tags:   

• 13:59

  Wifi Album v1.47 iOS - Command Injection Vulnerability

   » ‎ Full Disclosure

  Posted by Vulnerability Lab on May 12

  Title:
  ======
  Wifi Album v1.47 iOS - Command Injection Vulnerability
  
  Date:
  =====
  2013-04-25
  
  References:
  ===========
  http://www.vulnerability-lab.com/get_content.php?id=935
  
  VL-ID:
  =====
  935
  
  Common Vulnerability Scoring System:
  ====================================
  5.6
  
  Introduction:
  =============
  WiFi Album allows you to easily transfer photos and videos between iPhone,iPad,iTouch,iMac and PC. Transfer photos and
  videos
  over WiFi, no cables...
  

  Tags:   

• 13:56

  Wifi Photo Transfer 2.1 & 1.1 PRO - Multiple Vulnerabilities

   » ‎ Full Disclosure

  Posted by Vulnerability Lab on May 12

  Title:
  ======
  Wifi Photo Transfer 2.1 & 1.1 PRO - Multiple Vulnerabilities
  
  Date:
  =====
  2013-04-21
  
  References:
  ===========
  http://www.vulnerability-lab.com/get_content.php?id=932
  
  VL-ID:
  =====
  932
  
  Common Vulnerability Scoring System:
  ====================================
  6.1
  
  Introduction:
  =============
  Easily access your photo libraries via wifi from any computer with a web browser! Just start the app and enter the
  displayed address into...
  

  Tags:   

• 13:51

  Re: Paypal Bug Bounty #31 - Mail Encoding Web Vulnerability

   » ‎ Full Disclosure

  Posted by Michal Zalewski on May 12

  Total word count: ~1065
  Words that provide relevant information about the bug: ~95
  
  /mz
  

  Tags:   

• 13:46

  Wireless Disk PRO v2.3 iOS - Multiple Web Vulnerabilities

   » ‎ Full Disclosure

  Posted by Vulnerability Lab on May 12

  Title:
  ======
  Wireless Disk PRO v2.3 iOS - Multiple Web Vulnerabilities
  
  Date:
  =====
  2013-02-26
  
  References:
  ===========
  http://www.vulnerability-lab.com/get_content.php?id=883
  
  VL-ID:
  =====
  883
  
  Common Vulnerability Scoring System:
  ====================================
  6.2
  
  Introduction:
  =============
  AirDisk Pro allows you to store, view and manage files on your iPhone, iPad or iPod touch. You can connect to AirDisk
  Pro from any Mac or
  PC over...
  

  Tags:   

• 13:45

  [web applications] - Ajax Availability Calendar 3.X.X Multiple Vulnerabilties

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  [web applications] - Ajax Availability Calendar 3.X.X Multiple Vulnerabilties

  Tags:   

• 13:44

  [web applications] - Joomla Component com_myalbum Blind Injection Vulnerability

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  [web applications] - Joomla Component com_myalbum Blind Injection Vulnerability

  Tags:   

• 13:44

  Paypal Bug Bounty #31 - Mail Encoding Web Vulnerability

   » ‎ Full Disclosure

  Posted by Vulnerability Lab on May 12

  Title:
  ======
  Paypal Bug Bounty #31 - Mail Encoding Web Vulnerability
  
  Date:
  =====
  2013-04-03
  
  References:
  ===========
  http://www.vulnerability-lab.com/get_content.php?id=706
  
  PayPal Security UID: erc849qoz
  
  VL-ID:
  =====
  706
  
  Common Vulnerability Scoring System:
  ====================================
  6.3
  
  Introduction:
  =============
  PayPal is a global e-commerce business allowing payments and money transfers to be made through the Internet. Online...
  

  Tags:   

• 13:44

  [web applications] - Joomla Component com_shohada Local File Inclusion Vulnerability

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  [web applications] - Joomla Component com_shohada Local File Inclusion Vulnerability

  Tags:   

• 13:44

  [web applications] - Joomla Component com_s5clanroster Sql Injection Vulnerability

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  [web applications] - Joomla Component com_s5clanroster Sql Injection Vulnerability

  Tags:   

• 12:41

  [SECURITY] [DSA 2667-1] mysql-5.5 security update

   » ‎ Full Disclosure

  Posted by Moritz Muehlenhoff on May 12

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2667-1 security () debian org
  http://www.debian.org/security/ Moritz Muehlenhoff
  May 12, 2013 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : mysql-5.5
  Vulnerability : several
  Problem type : remote...
  

  Tags:   

• 11:47

  The US Government Might Be The Biggest Hacker In The World

   » ‎ Packet Storm Security Headlines
  The US Government Might Be The Biggest Hacker In The World

  Tags:   

• 11:47

  US Government Orders Removal Of Defcad 3D-Gun Designs

   » ‎ Packet Storm Security Headlines
  US Government Orders Removal Of Defcad 3D-Gun Designs

  Tags:   

• 11:47

  Apple iPhone Encryption Causing Police Backlog

   » ‎ Packet Storm Security Headlines
  Apple iPhone Encryption Causing Police Backlog

  Tags:   

• 11:38

  Common OAuth Issues You Can Use To Take Over Accounts

   » ‎ Packet Storm Security Headlines
  Common OAuth Issues You Can Use To Take Over Accounts

  Tags:   

• 10:50

  XSS and FPD vulnerabilities in Search and Share for WordPress

   » ‎ Full Disclosure

  Posted by MustLive on May 12

  Hello list!
  
  I want to inform you about vulnerabilities in Search and Share plugin for
  WordPress.
  
  These are Cross-Site Scripting and Full path disclosure vulnerabilities.
  These XSS holes are in ZeroClipboard.swf, which is used in the plugin. In
  February I've wrote about Cross-Site Scripting vulnerabilities in
  ZeroClipboard (http://seclists.org/fulldisclosure/2013/Feb/103) and in
  multiple web applications.
  
  -------------------------
  Affected...
  

  Tags:   

• 8:16

  [dos / poc] - Lan Messenger sending PM Buffer Overflow

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  [dos / poc] - Lan Messenger sending PM Buffer Overflow

  Tags:   

• 7:31

  [SECURITY] [DSA 2666-1] xen security update

   » ‎ Full Disclosure

  Posted by Salvatore Bonaccorso on May 12

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2666-1 security () debian org
  http://www.debian.org/security/ Salvatore Bonaccorso
  May 12, 2013 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : xen
  Vulnerability : several
  Problem type : remote...
  

  Tags:   

• May 11, 2013
• 12:44

  [Botconf] Botconf announcement and CFP reminder

   » ‎ Full Disclosure

  Posted by Eric Freyssinet on May 11

  Hello all!
  
  This is an announcement of Botconf 2013 - https://www.botconf.eu/
  *CFP is targetting both scientific papers and proposals for presentations*
  We are looking forward to welcome you in France on that occasion !
  
  Botconf’13 is an international conference aiming at bringing together
  academic, industrial, law enforcement and independent researchers working
  on issues related to the fight against botnets. The topics of interest
  include:
  
  *...
  

  Tags:   

• 0:00

  Vuln: Linux Kernel KVM 'MSR_KVM_SYSTEM_TIME' Use After Free Memory Corruption Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Linux Kernel KVM 'MSR_KVM_SYSTEM_TIME' Use After Free Memory Corruption Vulnerability

  Tags:   

• 0:00

  Vuln: GNU glibc 'nargs' Integer Overflow Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  GNU glibc 'nargs' Integer Overflow Security Bypass Vulnerability

  Tags:   

• May 10, 2013
• 19:00

  Bugtraq: [SECURITY] CVE-2013-2067 Session fixation with FORM authenticator

   » ‎ SecurityFocus Vulnerabilities
  [SECURITY] CVE-2013-2067 Session fixation with FORM authenticator

  Tags:   

• 17:00

  Bugtraq: [SECURITY] CVE-2012-3544 Chunked transfer encoding extension size is not limited

   » ‎ SecurityFocus Vulnerabilities
  [SECURITY] CVE-2012-3544 Chunked transfer encoding extension size is not limited

  Tags:   

• 17:00

  [dos] - Lan Messenger sending PM Buffer Overflow(UNICODE) - Overwrite SEH

   » ‎ Exploit-DB
  Lan Messenger sending PM Buffer Overflow(UNICODE) - Overwrite SEH

  Tags:   

• 16:33

  RSA Authentication Agent 7.1 Cross Site Scripting

   » ‎ Packet Storm Security Advisories
  A cross site scripting vulnerability could be potentially exploited by a malicious attacker for conducting scripting attacks in RSA Authentication Agent. The vulnerability could be exploited by getting an authenticated user to click on specially-crafted links that a malicious attacker can embed within an e-mail message, web page, or other source. This may lead to execution of malicious html requests or scripts in the context of the authenticated user.

  Tags:   

• 16:00

  Bugtraq: ESA-2013-031: RSA® Authentication Agent Cross-Site Scripting (XSS) Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  ESA-2013-031: RSA® Authentication Agent Cross-Site Scripting (XSS) Vulnerability

  Tags:   

• 13:15

  Apache Tomcat 7.0.39 AsyncListener RuntimeException

   » ‎ Packet Storm Security Advisories
  There was a scenario where elements of a previous request may be exposed to a current request. This was very difficult to exploit deliberately but fairly likely to happen unexpectedly if an application used AsyncListeners that threw RuntimeExceptions. The issue was fixed by catching the RuntimeExceptions. Apache Tomcat versions 7.0.0 through 7.0.39 are affected.

  Tags:   

• 11:22

  Apache Tomcat 7.0.29 / 6.0.36 Denial Of Service

   » ‎ Packet Storm Security Advisories
  Tomcat versions 7.0.0 through 7.0.29 and 6.0.0 through 6.0.36 are affected by a chunked transfer encoding extension size denial of service vulnerability.

  Tags:   

• 11:19

  ESA-2013-031: RSA® Authentication Agent Cross-Site Scrip ting (XSS) Vulnerability

   » ‎ Bugtraq

  Posted by Security Alert on May 10

  ESA-2013-031: RSA® Authentication Agent Cross-Site Scripting (XSS) Vulnerability
  
  EMC Identifier: ESA-2013-031
  
  CVE Identifier: CVE-2013-0942
  
  Severity Rating: CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
  
  Affected Products:
  
  RSA® Authentication Agent 7.1 for Web for Internet Information Services
  RSA® Authentication Agent 7.1 for Web for Apache
  
  Summary:
  
  RSA Authentication Agent contains a cross-site scripting (XSS)...
  

  Tags:   

• 11:02

  [SECURITY] CVE-2012-3544 Chunked transfer encoding extension size is not limited

   » ‎ Bugtraq

  Posted by Mark Thomas on May 10

  CVE-2012-3544 Chunked transfer encoding extension size is not limited
  
  Severity: Important
  
  Vendor: The Apache Software Foundation
  
  Versions Affected:
  - Tomcat 7.0.0 to 7.0.29
  - Tomcat 6.0.0 to 6.0.36
  
  Description:
  When processing a request submitted using the chunked transfer encoding,
  Tomcat ignored but did not limit any extensions that were included. This
  allows a client to perform a limited DOS by streaming an unlimited
  amount of data to the...
  

  Tags:   

• 11:00

  Bugtraq: CVE-2013-2071 Request mix-up if AsyncListener method throws RuntimeException

   » ‎ SecurityFocus Vulnerabilities
  CVE-2013-2071 Request mix-up if AsyncListener method throws RuntimeException

  Tags:   

• 10:46

  [SECURITY] CVE-2013-2067 Session fixation with FORM authenticator

   » ‎ Bugtraq

  Posted by Mark Thomas on May 10

  CVE-2013-2067 Session fixation with FORM authenticator
  
  Severity: Important
  
  Vendor: The Apache Software Foundation
  
  Versions Affected:
  - Tomcat 7.0.0 to 7.0.32
  - Tomcat 6.0.21 to 6.0.36
  
  Description:
  FORM authentication associates the most recent request requiring
  authentication with the current session. By repeatedly sending a request
  for an authenticated resource while the victim is completing the login
  form, an attacker could inject a request...
  

  Tags:   

• 10:32

  CVE-2013-2071 Request mix-up if AsyncListener method throws RuntimeException

   » ‎ Bugtraq

  Posted by Mark Thomas on May 10

  CVE-2013-2071 Request mix-up if AsyncListener method throws
  RuntimeException
  
  Severity: Moderate
  
  Vendor: The Apache Software Foundation
  
  Versions Affected:
  - Tomcat 7.0.0 to 7.0.39
  
  Description:
  Bug 54178 described a scenario where elements of a previous request may
  be exposed to a current request. This was very difficult to exploit
  deliberately but fairly likely to happen unexpectedly if an application
  used AsyncListeners that...
  

  Tags:   

• 10:22

  Re: OT bait on freelancer.com about md5 preimage

   » ‎ Full Disclosure

  Posted by Valdis . Kletnieks on May 10

  On Fri, 10 May 2013 17:31:57 +0300, Georgi Guninski said:
  
  Although there are easy attacks to collide two texts to the same MD5 hash, the
  actual hash generated is not controllable. As far as I know, there's no known
  easy way to pre-image a text to a pre-specified hash.
  
  Would be interesting to see who bids on that project for a few thousand $$.
  I know if I knew how to do that, I'd be busy making a bit more than a few
  thousand doing it....
  

  Tags:   

• 10:19

  CFP: Hacktivity 2013, October 11-12, Budapest, Hungary

   » ‎ Bugtraq

  Posted by cfp on May 10

  Hi,
  
  Hacktivity is the largest IT Security Festival in CEE region which will be held between October 11-12, 2013 in
  Budapest, Hungary.
  
  Hacktivity traditionally brings together the official and alternative representatives of information security
  profession with all those interested in the area, in an informal, yet educational, and usually deep into the technical
  form.
  
  We are seeking submissions for the conference track, 40 minutes "Hello...
  

  Tags:   

• 8:01

  [web applications] - Joomla DJ Classifieds Extension 2.0 - Blind SQL Injection Vulnerability

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  [web applications] - Joomla DJ Classifieds Extension 2.0 - Blind SQL Injection Vulnerability

  Tags:   

• 7:57

  Biometric Database Of All Adult Americans Hidden In Immigration Reform

   » ‎ Packet Storm Security Headlines
  Biometric Database Of All Adult Americans Hidden In Immigration Reform

  Tags:   

• 7:57

  Microsoft Fixes 33 Issues Next Tuesday

   » ‎ Packet Storm Security Headlines
  Microsoft Fixes 33 Issues Next Tuesday

  Tags:   

• 7:56

  Hackers Spread Winnti Malware Using Legitimate Analysis Tool

   » ‎ Packet Storm Security Headlines
  Hackers Spread Winnti Malware Using Legitimate Analysis Tool

  Tags:   

• 7:56

  German Government Throws Out 170 New PCs Riddled With Conficker

   » ‎ Packet Storm Security Headlines
  German Government Throws Out 170 New PCs Riddled With Conficker

  Tags:   

• 7:44

  Apache Tomcat 7.0.32 / 6.0.36 Session Fixation

   » ‎ Packet Storm Security Advisories
  Tomcat versions 7.0.0 through 7.0.32 and 6.0.21 through 6.0.36 are affected by a session fixation vulnerability. FORM authentication associates the most recent request requiring authentication with the current session. By repeatedly sending a request for an authenticated resource while the victim is completing the login form, an attacker could inject a request that would be executed using the victim's credentials. This attack has been prevented by changing the session ID prior to displaying the login page as well as after the user has successfully authenticated.

  Tags:   

• 7:37

  OT bait on freelancer.com about md5 preimage

   » ‎ Full Disclosure

  Posted by Georgi Guninski on May 10

  stumbled upon this
  http://www.freelancer.com/projects/Cryptography/Preimage-for-specific-hash.html
  
  Project Description:
  I need a preimage for a specific MD5 hash (will be revealed in private message).
  Length or content of the image doesnt matter (however I would pay more if I could choose a prefix).
  

  Tags:   

• 2:17

  [remote exploits] - SAP SOAP RFC SXPG_CALL_SYSTEM Remote Command Execution

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  [remote exploits] - SAP SOAP RFC SXPG_CALL_SYSTEM Remote Command Execution

  Tags:   

• 2:17

  [remote exploits] - SAP SOAP RFC SXPG_COMMAND_EXECUTE Remote Command Execution

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  [remote exploits] - SAP SOAP RFC SXPG_COMMAND_EXECUTE Remote Command Execution

  Tags:   

• 1:45

  [SECURITY] CVE-2012-3544 Chunked transfer encoding extension size is not limited

   » ‎ Full Disclosure

  Posted by Mark Thomas on May 10

  CVE-2012-3544 Chunked transfer encoding extension size is not limited
  
  Severity: Important
  
  Vendor: The Apache Software Foundation
  
  Versions Affected:
  - Tomcat 7.0.0 to 7.0.29
  - Tomcat 6.0.0 to 6.0.36
  
  Description:
  When processing a request submitted using the chunked transfer encoding,
  Tomcat ignored but did not limit any extensions that were included. This
  allows a client to perform a limited DOS by streaming an unlimited
  amount of data to the...
  

  Tags:   

• 1:44

  [SECURITY] CVE-2013-2067 Session fixation with FORM authenticator

   » ‎ Full Disclosure

  Posted by Mark Thomas on May 10

  CVE-2013-2067 Session fixation with FORM authenticator
  
  Severity: Important
  
  Vendor: The Apache Software Foundation
  
  Versions Affected:
  - Tomcat 7.0.0 to 7.0.32
  - Tomcat 6.0.21 to 6.0.36
  
  Description:
  FORM authentication associates the most recent request requiring
  authentication with the current session. By repeatedly sending a request
  for an authenticated resource while the victim is completing the login
  form, an attacker could inject a request...
  

  Tags:   

• 1:42

  CVE-2013-2071 Request mix-up if AsyncListener method throws RuntimeException

   » ‎ Full Disclosure

  Posted by Mark Thomas on May 10

  CVE-2013-2071 Request mix-up if AsyncListener method throws
  RuntimeException
  
  Severity: Moderate
  
  Vendor: The Apache Software Foundation
  
  Versions Affected:
  - Tomcat 7.0.0 to 7.0.39
  
  Description:
  Bug 54178 described a scenario where elements of a previous request may
  be exposed to a current request. This was very difficult to exploit
  deliberately but fairly likely to happen unexpectedly if an application
  used AsyncListeners that...
  

  Tags:   

• 0:00

  Vuln: PHP 'php-cgi' Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  PHP 'php-cgi' Information Disclosure Vulnerability

  Tags:   

• 0:00

  Vuln: OpenSSL Multiple Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Multiple Vulnerabilities

  Tags:   

• 0:00

  Vuln: phpMyAdmin 'filename_template' Remote Code Execution Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  phpMyAdmin 'filename_template' Remote Code Execution Vulnerability

  Tags:   

• 0:00

  Vuln: LibTIFF CVE-2013-1961 Stack Based Buffer Overflow Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  LibTIFF CVE-2013-1961 Stack Based Buffer Overflow Vulnerability

  Tags:   

• 0:00

  Vuln: LibTIFF 't2_process_jpeg_strip()' Function Heap-based Buffer Overflow Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  LibTIFF 't2_process_jpeg_strip()' Function Heap-based Buffer Overflow Vulnerability

  Tags:   

• 0:00

  Vuln: SAP Netweaver 'SAPHostControl' Service Remote Code Execution Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  SAP Netweaver 'SAPHostControl' Service Remote Code Execution Vulnerability

  Tags:   

• 0:00

  Vuln: OpenStack Keystone CVE-2013-2006 LDAP Password Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenStack Keystone CVE-2013-2006 LDAP Password Information Disclosure Vulnerability

  Tags:   

• 0:00

  Vuln: OpenStack Keystone Tokens Validation Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenStack Keystone Tokens Validation Security Bypass Vulnerability

  Tags:   

• 0:00

  Vuln: Linux Kernel KVM CVE-2013-1796 Buffer Overflow Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Linux Kernel KVM CVE-2013-1796 Buffer Overflow Vulnerability

  Tags:   

• 0:00

  Vuln: Linux Kernel CVE-2012-4542 Remote Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Linux Kernel CVE-2012-4542 Remote Security Bypass Vulnerability

  Tags:   

• 0:00

  Vuln: Linux Kernel CVE-2013-1792 Local Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Linux Kernel CVE-2013-1792 Local Denial of Service Vulnerability

  Tags:   

• 0:00

  Vuln: Linux Kernel CVE-2013-1767 Local Privilege Escalation Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Linux Kernel CVE-2013-1767 Local Privilege Escalation Vulnerability

  Tags:   

• May 09, 2013
• 22:46

  Patch Tuesday To Fully Patch Recent IE Zero Day

   » ‎ Packet Storm Security Headlines
  Patch Tuesday To Fully Patch Recent IE Zero Day

  Tags:   

• 22:46

  India Joins List Of Nations Vetting Huawei, ZTE

   » ‎ Packet Storm Security Headlines
  India Joins List Of Nations Vetting Huawei, ZTE

  Tags:   

• 22:46

  New Zealand Bans Software Patents

   » ‎ Packet Storm Security Headlines
  New Zealand Bans Software Patents

  Tags:   

• 17:13

  GlobaLeaks 0.2 Alpha (herMario edition) released!

   » ‎ Full Disclosure

  Posted by Arturo Filastò on May 10

  Dear All,
  
  We are pleased to announce the release of GlobaLeaks 0.2 Anonymous Whistleblowing Software.
  
  GlobaLeaks enables organizations interested in running Whistleblowing initiatives to setup their own safe zone, where
  whistleblowers and recipients can exchange data.
  
  The software is provided for Linux with a ready-made system and network hardened installation.
  
  Thanks to Tor software, a GlobaLeaks node provides anonymity to whoever runs it...
  

  Tags:   

• 17:11

  DDIVRT-2013-53 Actuate 'ActuateJavaComponent' Multiple Vulnerabilities

   » ‎ Full Disclosure

  Posted by ddivulnalert on May 10

  Title
  -----
  DDIVRT-2013-53 Actuate 'ActuateJavaComponent' Multiple Vulnerabilities
  
  Severity
  --------
  High
  
  Date Discovered
  ---------------
  March 19, 2013
  
  Discovered By
  -------------
  Digital Defense, Inc. Vulnerability Research Team
  Credit: Dennis Lavrinenko, Bobby Lockett, and r () b13$
  
  1. Actuate 'ActuateJavaComponent' Arbitrary File Retrieval
  
  Vulnerability Description
  -------------------------
  Actuate 10 contains a...
  

  Tags:   

• 16:57

  SAP SOAP RFC SXPG_CALL_SYSTEM Remote Command Execution

   » ‎ Packet Storm Security Exploits
  This Metasploit module abuses the SAP NetWeaver SXPG_CALL_SYSTEM function, on the SAP SOAP RFC Service, to execute remote commands. This Metasploit module needs SAP credentials with privileges to use the /sap/bc/soap/rfc in order to work. The module has been tested successfully on Windows 2008 64 bits and Linux 64 bits platforms.

  Tags:   

• 16:44

  SAP SOAP RFC SXPG_COMMAND_EXECUTE Remote Command Execution

   » ‎ Packet Storm Security Exploits
  This Metasploit module abuses the SAP NetWeaver SXPG_COMMAND_EXECUTE function, on the SAP SOAP RFC Service, to execute remote commands. This Metasploit module needs SAP credentials with privileges to use the /sap/bc/soap/rfc in order to work. The module has been tested successfully on Windows 2008 64 bits and Linux 64 bits platforms.

  Tags:   

• 16:33

  Securimage 3.5 Cross Site Scripting

   » ‎ Packet Storm Security Exploits
  Securimage suffers from a cross site scripting issue in 'example_form.php' that uses the 'REQUEST_URI' variable. The vulnerability is present because there isn't any filtering to the mentioned variable in the affected script. Attackers can exploit this weakness to execute arbitrary HTML and script code in a user's browser session.

  Tags:   

• 16:00

  Bugtraq: Re: Vulnerabilities in Windows 8 Professional x64 factory preinstallation of Fujitsu Lifebook A512 [continued]

   » ‎ SecurityFocus Vulnerabilities
  Re: Vulnerabilities in Windows 8 Professional x64 factory preinstallation of Fujitsu Lifebook A512 [continued]

  Tags:   

• 15:22

  EMC AlphaStor 4.0 Build 116 Buffer Overflow

   » ‎ Packet Storm Security Advisories
  A buffer overflow vulnerability exists in EMC AlphaStor that could potentially be exploited by a malicious user to create a denial of service condition or execute arbitrary code.

  Tags:   

• 15:00

  Bugtraq: ESA-2013-021: EMC Documentum Multiple Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  ESA-2013-021: EMC Documentum Multiple Vulnerabilities

  Tags:   

• 14:55

  Actuate 10 Service Pack 1 Fix 4 File Retrieval / Directory Browsing

   » ‎ Packet Storm Security Advisories
  Actuate 10 Service Pack 1 Fix 4 suffers from remote file disclosure and directory browsing vulnerabilities.

  Tags:   

• 14:00

  Bugtraq: DDIVRT-2013-53 Actuate 'ActuateJavaComponent' Multiple Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  DDIVRT-2013-53 Actuate 'ActuateJavaComponent' Multiple Vulnerabilities

  Tags:   

• 13:58

  [remote exploits] - ERS Viewer 2011 ERS File Handling Buffer Overflow Vulnerability

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  [remote exploits] - ERS Viewer 2011 ERS File Handling Buffer Overflow Vulnerability

  Tags:   

• 13:58

  [remote exploits] - Flightgear 2.0 / 2.4 Format String Vulnerability

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  [remote exploits] - Flightgear 2.0 / 2.4 Format String Vulnerability

  Tags:   

• 13:57

  [web applications] - AlienVault OSSIM 4.1.2 SQL Injection Vulnerability

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  [web applications] - AlienVault OSSIM 4.1.2 SQL Injection Vulnerability

  Tags:   

• 13:57

  [web applications] - UMI.CMS 2.9 Cross Site Request Forgery Vulnerability

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  [web applications] - UMI.CMS 2.9 Cross Site Request Forgery Vulnerability

  Tags:   

• 13:32

  DDIVRT-2013-53 Actuate 'ActuateJavaComponent' Multiple Vulnerabilities

   » ‎ Bugtraq

  Posted by ddivulnalert on May 09

  Title
  -----
  DDIVRT-2013-53 Actuate 'ActuateJavaComponent' Multiple Vulnerabilities
  
  Severity
  --------
  High
  
  Date Discovered
  ---------------
  March 19, 2013
  
  Discovered By
  -------------
  Digital Defense, Inc. Vulnerability Research Team
  Credit: Dennis Lavrinenko, Bobby Lockett, and r () b13$
  
  1. Actuate 'ActuateJavaComponent' Arbitrary File Retrieval
  
  Vulnerability Description
  -------------------------
  Actuate 10 contains a...
  

  Tags:   

• 13:12

  ESA-2013-021: EMC Documentum Multiple Vulnerabilities

   » ‎ Bugtraq

  Posted by Security Alert on May 09

  ESA-2013-021: EMC Documentum Multiple Vulnerabilities
  
  EMC Identifier: ESA-2013-021
  
  CVE Identifier: CVE-2013-0937, CVE-2013-0938, CVE-2013-0939
  
  Severity Rating: See below for individual scores
  
  Affected products:
  • EMC Documentum Webtop versions prior 6.7 SP2
  • EMC Documentum WDK versions prior 6.7 SP2
  • EMC Documentum Taskspace versions prior 6.7 SP2
  • EMC Documentum Records Manager versions prior 6.7 SP2...
  

  Tags:   

• 13:00

  Bugtraq: ESA-2013-037: EMC AlphaStor Buffer Overflow Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  ESA-2013-037: EMC AlphaStor Buffer Overflow Vulnerability

  Tags:   

• 12:53

  Re: Vulnerabilities in Windows 8 Professional x64 factory preinstallation of Fujitsu Lifebook A512 [continued]

   » ‎ Bugtraq

  Posted by Stefan Kanthak on May 09

  [...]
  
  and missed some more REALLY nice vulnerabilities (just like the one
  Microsoft fixed with <https://support.microsoft.com/kb/2781197>
  alias <http://technet.microsoft.com/security/bulletin/ms13-034>,
  which of course is present too).
  
  A.6: TWO vulnerabilities in the preinstalled services from Fujitsu:
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PFNService]
  "ImagePath"=expand:"C:\\Program...
  

  Tags:   

• 12:37

  ESA-2013-037: EMC AlphaStor Buffer Overflow Vulnerability

   » ‎ Bugtraq

  Posted by Security Alert on May 09

  ESA-2013-037: EMC AlphaStor Buffer Overflow Vulnerability
  
  EMC Identifier: ESA-2013-037
  
  EMC Identifier: NW150511
  
  CVE Identifier: CVE-2013-0946
  
  Severity Rating: CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
  
  Affected product:
  • EMC AlphaStor 4.0 build 116 and later
  
  Summary:
  A buffer overflow vulnerability exists in EMC AlphaStor that could potentially be exploited by a malicious user to
  create a denial of service condition...
  

  Tags:   

• 12:23

  Vulnerability in "Fujitsu Desktop Update" (for Windows)

   » ‎ Bugtraq

  Posted by Stefan Kanthak on May 09

  Hi @ll,
  
  Fujitsu's update utility "Fujitsu Desktop Update" (see
  <http://support.ts.fujitsu.com/DeskUpdate/Index.asp>), which is
  factory-preinstalled on every Fujitsu (Siemens) PC with Windows,
  has a vulnerability which allows the execution of a rogue program
  in the security context of the current user.
  
  The application is registered as control panel item via...
  

  Tags:   

• 12:22

  Red Hat Security Advisory 2013-0806-01

   » ‎ Packet Storm Security Advisories
  Red Hat Security Advisory 2013-0806-01 - The openstack-keystone packages provide Keystone, a Python implementation of the OpenStack identity service API, which provides Identity, Token, Catalog, and Policy services. These updated packages have been upgraded to upstream version 2012.2.4, which provides a number of bug fixes over the previous version. This update also fixes the following security issue: In environments using LDAP, if debug-level logging was enabled, the LDAP server password was logged in plain text to a world-readable log file. Debug-level logging is not enabled by default.

  Tags:   

• 12:11

  Red Hat Security Advisory 2013-0807-01

   » ‎ Packet Storm Security Advisories
  Red Hat Security Advisory 2013-0807-01 - The hypervkvpd package contains hypervkvpd, the guest Microsoft Hyper-V Key-Value Pair daemon. The daemon passes basic information to the host through VMBus, such as the guest IP address, fully qualified domain name, operating system name, and operating system release number. A denial of service flaw was found in the way hypervkvpd processed certain Netlink messages. A local, unprivileged user in a guest could send a Netlink message that, when processed, would cause the guest's hypervkvpd daemon to exit. The CVE-2012-5532 issue was discovered by Florian Weimer of the Red Hat Product Security Team.

  Tags:   

• 12:09

  [security bulletin] HPSBMU02786 SSRT100877 rev.2 - HP System Management Homepage (SMH) Running on Linux, Windows, and VMware ESX, Remote Unauthorized Access, Disclosure of Information, Data Modification, Denial of Service (DoS), Execution of Arbitrary Co

   » ‎ Bugtraq

  Posted by security-alert on May 09

  Note: the current version of the following document is available here:
  https://h20566.www2.hp.com/portal/site/hpsc/public/kb/
  docDisplay?docId=emr_na-c03360041
  
  SUPPORT COMMUNICATION - SECURITY BULLETIN
  
  Document ID: c03360041
  Version: 2
  
  HPSBMU02786 SSRT100877 rev.2 - HP System Management Homepage (SMH) Running on
  Linux, Windows, and VMware ESX, Remote Unauthorized Access, Disclosure of
  Information, Data Modification, Denial of Service (DoS),...
  

  Tags:   

• 8:55

  EMC Documentum XSS / Session Fixation

   » ‎ Packet Storm Security Advisories
  Vulnerabilities exist in several EMC Documentum products that could potentially be exploited by a malicious user. Session fixation vulnerability could be potentially exploited by an unauthorized user to gain privileges to perform actions as a valid user by utilizing techniques to steal or gain access to an authenticated session. Cross-site scripting vulnerability could be potentially exploited for conducting malicious scripting by getting an authenticated user to click on specially-crafted links maliciously embedded within an email, web page or other source. This may lead to execution of malicious html requests or scripts in the context of the authenticated user. Cross Frame Scripting vulnerability could potentially be exploited by an attacker to steal sensitive information by inducing the authenticated user to navigate to a web page the attacker controls.

  Tags:   

• 8:11

  Ubuntu Security Notice USN-1821-1

   » ‎ Packet Storm Security Advisories
  Ubuntu Security Notice 1821-1 - It was discovered that telepathy-idle did not perform any server certificate validation when using SSL connections. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to alter or compromise confidential information.

  Tags:   

• 8:07

  8 To Be Charged In $45 Million Cybertheft Bank Heist

   » ‎ Packet Storm Security Headlines
  8 To Be Charged In $45 Million Cybertheft Bank Heist

  Tags:   

• 8:07

  Raspberry Pi Housed Inside A Computer Monitor

   » ‎ Packet Storm Security Headlines
  Raspberry Pi Housed Inside A Computer Monitor

  Tags:   

• 8:07

  Malaysian Election Sparks Denial Of Service

   » ‎ Packet Storm Security Headlines
  Malaysian Election Sparks Denial Of Service

  Tags:   

• 8:07

  Google / Facebook Data-Sharing Measures Show There Is No Need For CISPA

   » ‎ Packet Storm Security Headlines
  Google / Facebook Data-Sharing Measures Show There Is No Need For CISPA

  Tags:   

• 7:44

  HP Security Bulletin HPSBMU02786 SSRT100877 2

   » ‎ Packet Storm Security Advisories
  HP Security Bulletin HPSBMU02786 SSRT100877 2 - Potential security vulnerabilities have been identified with HP System Management Homepage (SMH) running on Linux, Windows, and VMware ESX. The vulnerabilities could be exploited remotely resulting in unauthorized access, disclosure of information, data modification, Denial of Service (DoS), and execution of arbitrary code. Revision 2 of this advisory.

  Tags:   

• 0:00

  Vuln: Microsoft Internet Explorer CVE-2013-1347 Use-After-Free Remote Code Execution Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Microsoft Internet Explorer CVE-2013-1347 Use-After-Free Remote Code Execution Vulnerability

  Tags:   

• 0:00

  Vuln: ERDAS ER Viewer 'ERM_convert_to_correct_webpath()' Function Stack Buffer Overflow Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  ERDAS ER Viewer 'ERM_convert_to_correct_webpath()' Function Stack Buffer Overflow Vulnerability

  Tags:   

• 0:00

  Vuln: Symantec Brightmail Gateway Management Console Multiple HTML Injection Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  Symantec Brightmail Gateway Management Console Multiple HTML Injection Vulnerabilities

  Tags:   

• 0:00

  Vuln: Xen CVE-2013-1952 Local Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Xen CVE-2013-1952 Local Denial of Service Vulnerability

  Tags:   

• 0:00

  Vuln: Xen Page Table Manipulation CVE-2013-1918 Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Xen Page Table Manipulation CVE-2013-1918 Denial of Service Vulnerability

  Tags:   

• 0:00

  Vuln: GroundWork Monitor Enterprise Multiple Security Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  GroundWork Monitor Enterprise Multiple Security Vulnerabilities

  Tags:   

• 0:00

  Vuln: GroundWork Monitor Enterprise 'NeDi' Component Multiple Security Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  GroundWork Monitor Enterprise 'NeDi' Component Multiple Security Vulnerabilities

  Tags:   

• 0:00

  Vuln: RETIRED: GroundWork Monitor Enterprise 'Noma' Component Multiple Input Validation Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  RETIRED: GroundWork Monitor Enterprise 'Noma' Component Multiple Input Validation Vulnerabilities

  Tags:   

• 0:00

  Vuln: phpMyAdmin CVE-2013-3238 Multiple Arbitrary PHP Code Execution Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  phpMyAdmin CVE-2013-3238 Multiple Arbitrary PHP Code Execution Vulnerabilities

  Tags:   

• 0:00

  Vuln: Telepathy Idle SSL/TLS Certificate Validation Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Telepathy Idle SSL/TLS Certificate Validation Security Bypass Vulnerability

  Tags:   

• 0:00

  Vuln: phpMyAdmin 'filename_template' Remote Code Execution Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  phpMyAdmin 'filename_template' Remote Code Execution Vulnerability

  Tags:   

• May 08, 2013
• 21:39

  Integer Overflow Bug Leads To Diablo III Gold Duping

   » ‎ Packet Storm Security Headlines
  Integer Overflow Bug Leads To Diablo III Gold Duping

  Tags:   

• 20:53

  Use These Secret NSA Google Search Tips To Become Your Own Spy Agency

   » ‎ Packet Storm Security Headlines
  Use These Secret NSA Google Search Tips To Become Your Own Spy Agency

  Tags:   

• 20:26

  Cisco Security Advisory 20121031-dcnm-2

   » ‎ Packet Storm Security Advisories
  Cisco Security Advisory - Cisco Prime Data Center Network Manager (DCNM) contains a remote command execution vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands on the computer that is running the Cisco Prime DCNM application. Cisco has released free software updates that address this vulnerability.

  Tags:   

• 20:26

  Cisco Security Advisory 20130508-cvp

   » ‎ Packet Storm Security Advisories
  Cisco Security Advisory - Cisco Unified Customer Voice Portal Software (Unified CVP) contains multiple vulnerabilities. Various components of Cisco Unified CVP are affected; see the "Details" section for more information on the vulnerabilities. These vulnerabilities can be exploited independently; however, more than one vulnerability could be exploited on the same device. Cisco has released free software updates that address these vulnerabilities. Workarounds that mitigate some of these vulnerabilities are available.

  Tags:   

• 20:12

  IE 8 Zero-Day Attack Spreads To Military Sites

   » ‎ Packet Storm Security Headlines
  IE 8 Zero-Day Attack Spreads To Military Sites

  Tags:   

• 20:08

  Malware Spewing Attack Not Limited To Apache

   » ‎ Packet Storm Security Headlines
  Malware Spewing Attack Not Limited To Apache

  Tags:   

• 20:06

  Domain Registrar Attacked, Customer Passwords Reset

   » ‎ Packet Storm Security Headlines
  Domain Registrar Attacked, Customer Passwords Reset

  Tags:   

• 20:06

  ACLU Says FBI Snooping Emails Without Warrants

   » ‎ Packet Storm Security Headlines
  ACLU Says FBI Snooping Emails Without Warrants

  Tags: