Red Hat Security Advisory 2013-1185-01 - Red Hat JBoss Fuse 6.0.0, based on Apache ServiceMix, provides an integration platform. Red Hat JBoss Fuse 6.0.0 patch 2 is an update to Red Hat JBoss Fuse 6.0.0 and includes bug fixes.
0939186bded3bc21379c4815dec6ff27fa7ec3cd68880f3f51e0f782423a24acPerformance Guard from CapaSystems suffers from a traversal vulnerability that allows for arbitrary file reading.
ef90193100f7cdc65bdecf8b7d836ffcd9708cba4b2d4d930fc7cec1e399cd46Geonick Social Network suffers from a lack of clickjacking protection, it has an insecure crossdomain.xml file, and sends user credentials in the clear.
97a88857ba14577c519450180d5fb5211da072e083d09bb5b1895c33b26737a7Apprain version 3.0.2 suffers from multiple cross site request forgery vulnerabilities.
e606476fb827bd1dfe2fc1fc86cba2d171d51472da3a964744a23aa25cdf5e2dCyberArk Vault versions prior to 7.20.37 suffer from multiple user enumeration vulnerabilities.
2c9165f3e7ef400778699bc7ee1575c639a581bd0fa9c04fa40e4fac52460c6cDebian Linux Security Advisory 2746-1 - Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail and news client. Multiple memory safety errors, missing permission checks and other implementation errors may lead to the execution of arbitrary code or cross-site scripting.
066d7c113b0c85a7655f00b154282b537f716ce919215cbc842ab76b2915d745Gentoo Linux Security Advisory 201308-6 - Multiple vulnerabilities have been found in MySQL, allowing attackers to execute arbitrary code or cause Denial of Service. Versions less than 5.1.70 are affected.
a5ac28b86f0822c45d84e94416073eff2e1458438f359271b10e054b23cae04eDebian Linux Security Advisory 2745-1 - Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service, information leak or privilege escalation.
3eec460e99a9f554b7bc89f94799ac98b40ec17e5325c416c1ece8a5c548e48fThis is a whitepaper called Metasploit - The Exploit Learning Tree. Instead of being just another document discussing how to use Metasploit, the purpose of this document is to show you how to look deeper into the code and try to decipher how the various classes and modules hang together to produce the various functions.
8053bf6927fee92962392df083a57d2a8ab44f95c200a4b5ef0d6c585cbd073dMicrosoft Online Services suffered from a cross site scripting vulnerability. Note that this finding houses site-specific data.
ac8f587b214e78fe60fc63bef72a529ea7ee0d7a2fe599ea1178e65161a44489The official UK Department for Transport website suffered from a remote SQL injection vulnerability. Note that this finding houses site-specific data.
53f155f273318d0f9851d19a79ed0550d489cb4188fc5a2e0495ecf5a9344fc5Sites powered by CyberBizia suffer from cross site scripting and remote SQL injection vulnerabilities. Note that this finding houses site-specific data.
b5001e20cbe7dc3bdcb15d4aacf0d5be097d3df653269d605438d071b1f9228eThe University of Texas at Arlington's College of Engineering website suffered from a remote SQL injection vulnerability. Note that this finding houses site-specific data.
a8403741d5c50ea00355b08845351cc8d61ca25d32a6dc7ba79d32fa99fee12bVMWare Workstation (up to and including 9.0.2 build-1031769) and Player have a setuid executable called vmware-mount that invokes lsb_release in the PATH with popen(3). Since PATH is user-controlled, and the default system shell on Debian-derived distributions does not drop privs, we can put an arbitrary payload in an executable called lsb_release and have vmware-mount happily execute it as root for us.
d6d99d5e820653afe8fadb60e5b5067b276b612b74c995ebca5507a7c34190b3This Metasploit module exploits a vulnerability on the lrFileIOService ActiveX, as installed with HP LoadRunner 11.50. The vulnerability exists in the WriteFileBinary method where user provided data is used as a memory pointer. This Metasploit module has been tested successfully on IE6-IE9 on Windows XP, Vista and 7, using the LrWebIERREWrapper.dll 11.50.2216.0. In order to bypass ASLR the no aslr compatible module msvcr71.dll is used. This one is installed with HP LoadRunner.
a5e106a110e475d117b3500d373abbf472e7b81cec4cfdde2c8f9d7957853a9bThis Metasploit module exploits a vulnerability found on Firefox 17.0 (< 17.0.2), specifically an use after free of an Element object, when using the serializeToStream method with a specially crafted OutputStream defining its own write function. This Metasploit module has been tested successfully with Firefox 17.0.1 ESR, 17.0.1 and 17.0 on Windows XP SP3.
f58157e305e4290dd4e3a5a36814841073537da1ad441ef4e8c63cdafe49db1cThis Metasploit module exploits a PHP code injection in SPIP. The vulnerability exists in the connect parameter and allows an unauthenticated user to execute arbitrary commands with web user privileges. Branches 2.0, 2.1 and 3 are concerned. This module works only against branch 2.0 and has been tested successfully with SPIP 2.0.11 and SPIP 2.0.20 with Apache on Ubuntu and Fedora linux distributions.
d27325e9d83bde4fc580a0bfde93a3bfbc111c65ffc0b7db562ca093df580462Gentoo Linux Security Advisory 201308-5 - Multiple vulnerabilities have been found in Wireshark, allowing remote attackers to execute arbitrary code or cause Denial of Service. Versions less than 1.10.1 are affected.
afc074569b171377b721881b1008798f9d7adea3d3545cc57e14f5899a9a8a18Red Hat Security Advisory 2013-1182-01 - The 389 Directory Server is an LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol server and command-line utilities for server administration. It was discovered that the 389 Directory Server did not properly handle the receipt of certain MOD operations with a bogus Distinguished Name. A remote, unauthenticated attacker could use this flaw to cause the 389 Directory Server to crash. All 389-ds-base users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, the 389 server service will be restarted automatically.
ad79a80c525e40f5a8b8e35492bf65f8f8480d0c5b00f47e089143dfe954475d
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed