Cisco Security Advisory - Cisco Prime Central for Hosted Collaboration Solution (HCS) Assurance contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. Exploitation of this vulnerability could interrupt the monitoring of voice services. Cisco has released free software updates that address this vulnerability.
e8692d8dda3a665c7dd9de2f03a19590613ddcdb2a9380e15c20c121a14f0f14Cisco Security Advisory - Cisco Unified Presence Server (CUPS) contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. Cisco has released free software updates that address this vulnerability. A workaround is available to mitigate this vulnerability.
ded8e06b112e526831baf871d743d44d2c103cdf2681b8cd24634286b21672daUbuntu Security Notice 1753-1 - Sebastian Krahmer and Bastien Nocera discovered that DBus-GLib did not properly validate the message sender when the "NameOwnerChanged" signal was received. A local attacker could possibly use this issue to escalate their privileges.
9ce1ac4e5f067377afdafd7442b6e3c1e4f0943a1f5f93e3180598e214b52378Debian Linux Security Advisory 2633-1 - Helmut Grohne discovered multiple privilege escalation flaws in FusionForge, a web-based project-management and collaboration software. Most of the vulnerabilities are related to the bad handling of privileged operations on user-controlled files or directories.
887259b32ee22a9f8e0e8da18d4e9a19414ef7433786583622bc92c771b98ed4Debian Linux Security Advisory 2634-1 - Several vulnerabilities have been discovered in python-django, a high-level python web development framework.
8377d247b2330890d79f474d182321f1f3ac22f1b48dd7ed09f05e3891683554Drupal Creative Theme third party theme version 7.x suffers from a cross site scripting vulnerability.
7bd2d548ef1246483a1fd41308d4a1e69523c2b176e17fc4f0b8011557748495Drupal Fresh Theme third party theme version 7.x suffers from a cross site scripting vulnerability.
e3de67fa58d409a4f1ed295ca09c1ef3fd1d3ad772b98508639e2367e7725fefJoomla! versions 3.0.2 and below suffer from a PHP object injection vulnerability in highlight.php.
b92a59cc11acf090199faddc39dc367a4ca15c89eb182aeebe087497a2bb2b43Ubuntu Security Notice 1752-1 - Nadhem Alfardan and Kenny Paterson discovered that the TLS protocol as used in GnuTLS was vulnerable to a timing side-channel attack known as the "Lucky Thirteen" issue. A remote attacker could use this issue to perform plaintext-recovery attacks via analysis of timing data.
1cfa24fa1e2257b80843bb7496808728d5ace2f7a980167a435ad01d16cc82eaUbuntu Security Notice 1751-1 - Mathias Krause discovered a bounds checking error for netlink messages requesting SOCK_DIAG_BY_FAMILY. An unprivileged local user could exploit this flaw to crash the system or run programs as an administrator.
be2d43a9f5f1464ceb14a292a1fb9499c7f7c6dd60431ec4fe7bf9ee6b73c602This whitepaper is the story of Silent Signal LLC sharing a case study on achieving remote user-level access on an AIX server.
ef219a1b45e5d89670ecbe8a2b660a4c77111ecc02a5108596fadb9bec7c4141WordPress Comment Rating plugin version 2.9.32 suffers from vote limitation bypass and remote SQL injection vulnerabilities.
f3eff5dbde08320f1b9d6c19ee7a8ff2b8c4264d0143262e0b8d26506831ed4eThis whitepaper is the story of Silent Signal LLC sharing an experience of performing a client-side attack.
ac604eb1b18ace0ce59f47fbe848d4bb02d97b8fd31bc2e768bd586989f649d1Red Hat Security Advisory 2013-0570-01 - Oracle Java SE 6 will no longer receive updates after February 28, 2013. The Oracle Java SE 6 packages on the Red Hat Enterprise Linux 5 and 6 Supplementary media and Red Hat Network channels will continue to be available after February 28, 2013.
4b23dec91c0294f5db6ca888ca2eda4fa491bd1b5db966987a7953f62d50fdbaRed Hat Security Advisory 2013-0569-01 - JBoss Enterprise SOA Platform is the next-generation ESB and business process automation infrastructure. JBoss Enterprise Portal Platform is the open source implementation of the Java EE suite of services and Portal services running atop JBoss Enterprise Application Platform. An attack technique was found against the W3C XML Encryption Standard when block ciphers were used in cipher-block chaining mode. A remote attacker could use this flaw to conduct chosen-ciphertext attacks, leading to the recovery of the entire plain text of a particular cryptogram by examining the differences between SOAP responses sent from JBoss Web Services.
2587795973b4187dc98f0e3534f371af6311704b4e1d0fe7f9329c9f572d2026Gambas creates a directory in /tmp called gambas.UID where UID is the user id of the person running the software. Gambas does not check to see if a malicious user has already created that directory.
265512fa79bfac648de386e18f99ee937d26851f9df7995309f00539ecbf6106Red Hat Security Advisory 2013-0567-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issue: A race condition was found in the way the Linux kernel's ptrace implementation handled PTRACE_SETREGS requests when the debuggee was woken due to a SIGKILL signal instead of being stopped. A local, unprivileged user could use this flaw to escalate their privileges.
df9e621f7456eb9a73a631da3e476442cdd07e31b345df61d337cbbb9670e4b8Red Hat Security Advisory 2013-0568-01 - dbus-glib is an add-on library to integrate the standard D-Bus library with the GLib main loop and threading model. A flaw was found in the way dbus-glib filtered the message sender when the "NameOwnerChanged" signal was received. This could trick a system service using dbus-glib into believing a signal was sent from a privileged process, when it was not. A local attacker could use this flaw to escalate their privileges. All dbus-glib users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. All running applications linked against dbus-glib, such as fprintd and NetworkManager, must be restarted for this update to take effect.
f115f8f456a5b073c3c794a1f1c4435ef97f30b0ff1398b9309a9019ea8e3facUbuntu Security Notice 1750-1 - Brad Spengler discovered a bounds checking error for netlink messages requesting SOCK_DIAG_BY_FAMILY. An unprivileged local user could exploit this flaw to crash the system or run programs as an administrator.
73e13acda7d9d77b7969d9503affe8ed8dc750ce6f661c289555fcad458576a7Mandriva Linux Security Advisory 2013-015 - Multiple vulnerabilities has been found and corrected in apache. Various XSS flaws due to unescaped hostnames and URIs HTML output in mod_info, mod_status, mod_imagemap, mod_ldap, and mod_proxy_ftp. XSS in mod_proxy_balancer manager interface. Additionally the ASF bug 53219 was resolved which provides a way to mitigate the CRIME attack vulnerability by disabling TLS-level compression. Use the new directive SSLCompression on|off to enable or disable TLS-level compression, by default SSLCompression is turned on. The updated packages have been upgraded to the latest 2.2.24 version which is not vulnerable to these issues.
94833505f389d6e6209ac42e6b69342490887f9f5804bcc9728626e073cc31c9Slackware Security Advisory - New seamonkey packages are available for Slackware 13.37, 14.0, and -current to fix security issues.
86d92b3b2f7a535d4a89c45c0eaa6ff4582c09480cde5f8f160d499eb9778223Debian Linux Security Advisory 2632-1 - Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or privilege escalation.
54cf45d8989693da62afdd45038b3a32302b8109d2cab63de5e5015476212995In this paper, the author discusses the many challenges and problems concerning user-mode callbacks in win32k. In particular, they show how win32k's dependency on global locks in providing a thread-safe environment does not integrate well with the concept of user-mode callbacks. Although many vulnerabilities related to user-mode callbacks have been addressed, their complex nature suggests that more subtle flaws might still be present in win32k. Thus, in an effort to mitigate some of the more prevalent bug classes, they conclusively provide some suggestions as to how users may protect themselves against future kernel attacks.
51d1563fd83b26e69b8116dfefd3de44db9d463eea1972b575297a33f15a2fc2Brewthology version 0.1 remote SQL injection exploit that dumps the user table and leverages beerxml.php.
2a468fd42e9ff8f4ed89e105b058173e97ccfb7bcac8a4635e83bb2d0588d739Ubuntu Security Notice 1749-1 - Brad Spengler discovered a bounds checking error for netlink messages requesting SOCK_DIAG_BY_FAMILY. An unprivileged local user could exploit this flaw to crash the system or run programs as an administrator.
65bc984bc8f52390b39659cf092b4a628b4c705c08421d06c434a898eca785c6
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed