accept no compromises
Showing 1 - 25 of 30 RSS Feed

Files Date: 2014-03-06

ownCloud 4.0.x / 4.5.x Remote Code Execution
Posted Mar 6, 2014
Authored by Alejo Murillo Moya | Site portcullis-security.com

ownCloud versions 4.0.x and 4.5.x suffer from a remote code execution vulnerability.

tags | exploit, remote, code execution
advisories | CVE-2014-2044
MD5 | a10e864fb2aeae9c58f1f98773cf64ba
SonicWall Dashboard Cross Site Scripting
Posted Mar 6, 2014
Authored by Benjamin Kunz Mejri | Site vulnerability-lab.com

The Vulnerability Laboratory Research Team discovered a client-side cross site scripting web vulnerability in the SonicWall backend servers with which firewalls communicate.

tags | exploit, web, xss
MD5 | 3a58b0cebeff45f7465f901531544c5f
Apache Struts 2 ClassLoader Manipulation / DoS
Posted Mar 6, 2014
Site struts.apache.org

Apache Struts version 2.3.16.1 addresses a ClassLoader manipulation issue and adds some denial of service controls around the Common FileUpload library.

tags | advisory, denial of service
MD5 | 503878ccb93bd18c64333596b844f782
Slackware Security Advisory - sudo Updates
Posted Mar 6, 2014
Authored by Slackware Security Team | Site slackware.com

Slackware Security Advisory - New sudo packages are available for Slackware 13.0, 13.1, and 13.37 to fix a security issue.

tags | advisory
systems | linux, slackware
advisories | CVE-2014-0106
MD5 | 79ff59cedfa859a3cf44e58b5fde63f2
Ubuntu Security Notice USN-2131-1
Posted Mar 6, 2014
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 2131-1 - Michael Scherer discovered that IcedTea Web created temporary directories in an unsafe fashion. A local attacker could possibly use this issue to obtain or modify sensitive information from other local user sessions.

tags | advisory, web, local
systems | linux, ubuntu
advisories | CVE-2013-6493
MD5 | 72c9459f708be3703ca5beffce11535c
Ubuntu Security Notice USN-2130-1
Posted Mar 6, 2014
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 2130-1 - It was discovered that Tomcat incorrectly handled certain inconsistent HTTP headers. A remote attacker could possibly use this flaw to conduct request smuggling attacks. It was discovered that Tomcat incorrectly handled certain requests submitted using chunked transfer encoding. A remote attacker could use this flaw to cause the Tomcat server to stop responding, resulting in a denial of service. Various other issues were also addressed.

tags | advisory, remote, web, denial of service
systems | linux, ubuntu
advisories | CVE-2013-4286, CVE-2013-4322, CVE-2014-0033, CVE-2014-0050, CVE-2013-4286, CVE-2013-4322, CVE-2014-0033, CVE-2014-0050
MD5 | c3426739b24f0d8b9697ba017eea7d05
Ubuntu Security Notice USN-2129-1
Posted Mar 6, 2014
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 2129-1 - An information leak was discovered in the Linux kernel when inotify is used to monitor the /dev/ptmx device. A local user could exploit this flaw to discover keystroke timing and potentially discover sensitive information like password length. Vasily Kulikov reported a flaw in the Linux kernel's implementation of ptrace. An unprivileged local user could exploit this flaw to obtain sensitive information from kernel memory. Various other issues were also addressed.

tags | advisory, kernel, local
systems | linux, ubuntu
advisories | CVE-2013-0160, CVE-2013-2929, CVE-2013-4587, CVE-2013-6367, CVE-2013-6380, CVE-2013-6382, CVE-2013-7027, CVE-2013-7266, CVE-2013-7267, CVE-2013-7268, CVE-2013-7269, CVE-2013-7270, CVE-2013-7271, CVE-2014-1444, CVE-2014-1445, CVE-2014-1446, CVE-2014-1874, CVE-2013-0160, CVE-2013-2929, CVE-2013-4587, CVE-2013-6367, CVE-2013-6380, CVE-2013-6382, CVE-2013-7027, CVE-2013-7266, CVE-2013-7267, CVE-2013-7268, CVE-2013-7269
MD5 | 2b5ef64b0fa7fc519aac07e53e213e85
Ubuntu Security Notice USN-2132-1
Posted Mar 6, 2014
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 2132-1 - Aleksis Kauppinen, Joonas Kuorilehto and Tuomas Parttimaa discovered that ImageMagick incorrectly handled certain restart markers in JPEG images. If a user or automated system using ImageMagick were tricked into opening a specially crafted JPEG image, an attacker could exploit this to cause memory consumption, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS. It was discovered that ImageMagick incorrectly handled decoding certain PSD images. If a user or automated system using ImageMagick were tricked into opening a specially crafted PSD image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of the user invoking the program. Various other issues were also addressed.

tags | advisory, denial of service
systems | linux, ubuntu
advisories | CVE-2012-0260, CVE-2012-0260, CVE-2014-1958, CVE-2014-2030
MD5 | 8c5d50af595015cc97ae59cb00554fb5
Red Hat Security Advisory 2014-0261-01
Posted Mar 6, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-0261-01 - In accordance with the Red Hat Enterprise MRG Life Cycle policy, the Red Hat Enterprise MRG product, which includes MRG-Messaging, MRG-Realtime, and MRG-Grid, Version 1 offering for Red Hat Enterprise Linux 5 will be retired as of March 31, 2014, and support will no longer be provided. Accordingly, Red Hat will no longer provide updated packages, including critical impact security patches or urgent priority bug fixes, for MRG-Messaging, MRG-Realtime, and MRG-Grid Version 1 on Red Hat Enterprise Linux 5 after that date. In addition, technical support through Red Hat's Global Support Services will no longer be provided for Red Hat Enterprise MRG Version 1 on Red Hat Enterprise Linux 5 after March 31, 2014.

tags | advisory
systems | linux, redhat
MD5 | 987304221ab7615f7c1a857f83458f84
Ubuntu Security Notice USN-2128-1
Posted Mar 6, 2014
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 2128-1 - An information leak was discovered in the Linux kernel when inotify is used to monitor the /dev/ptmx device. A local user could exploit this flaw to discover keystroke timing and potentially discover sensitive information like password length. Vasily Kulikov reported a flaw in the Linux kernel's implementation of ptrace. An unprivileged local user could exploit this flaw to obtain sensitive information from kernel memory. Various other issues were also addressed.

tags | advisory, kernel, local
systems | linux, ubuntu
advisories | CVE-2013-0160, CVE-2013-2929, CVE-2013-4587, CVE-2013-6367, CVE-2013-6380, CVE-2013-6382, CVE-2013-7027, CVE-2013-7266, CVE-2013-7267, CVE-2013-7268, CVE-2013-7269, CVE-2013-7270, CVE-2013-7271, CVE-2014-1444, CVE-2014-1445, CVE-2014-1446, CVE-2014-1874, CVE-2013-0160, CVE-2013-2929, CVE-2013-4587, CVE-2013-6367, CVE-2013-6380, CVE-2013-6382, CVE-2013-7027, CVE-2013-7266, CVE-2013-7267, CVE-2013-7268, CVE-2013-7269
MD5 | 92fd9720236968983a17c8b73cf30478
WordPress Premium Gallery Manager Shell Upload
Posted Mar 6, 2014
Authored by eX-Sh1Ne

WordPress Premium Gallery Manager plugin suffers from a remote shell upload vulnerability.

tags | exploit, remote, shell
MD5 | 4147cf70a39a704fd0a15f885353c227
SolidWorks Workgroup PDM 2014 pdmwService.exe Arbitrary File Write
Posted Mar 6, 2014
Authored by Brendan Coles, Mohamed Shetta | Site metasploit.com

This Metasploit module exploits a remote arbitrary file write vulnerability in SolidWorks Workgroup PDM 2014 SP2 and prior. For targets running Windows Vista or newer the payload is written to the startup folder for all users and executed upon next user logon. For targets before Windows Vista code execution can be achieved by first uploading the payload as an exe file, and then upload another mof file, which schedules WMI to execute the uploaded payload. This Metasploit module has been tested successfully on SolidWorks Workgroup PDM 2011 SP0 on Windows XP SP3 (EN) and Windows 7 SP1 (EN).

tags | exploit, remote, arbitrary, code execution
systems | windows, xp, vista, 7
MD5 | 616b6529ac383dc0589643283677afc7
HP Data Protector Backup Client Service Remote Code Execution
Posted Mar 6, 2014
Authored by Aniway, juan vazquez | Site metasploit.com

This Metasploit module abuses the Backup Client Service (OmniInet.exe) to achieve remote code execution. The vulnerability exists in the EXEC_BAR operation, which allows to execute arbitrary processes. This Metasploit module has been tested successfully on HP Data Protector 6.20 on Windows 2003 SP2 and Windows 2008 R2.

tags | exploit, remote, arbitrary, code execution
systems | windows
advisories | CVE-2013-2347
MD5 | 08b88f75df71bafc815c57e6e4d06468
Cisco Security Advisory 20140305-rpd
Posted Mar 6, 2014
Authored by Cisco Systems | Site cisco.com

Cisco Security Advisory - A vulnerability in the web management interface of the Cisco RV110W Wireless-N VPN Firewall, the Cisco RV215W Wireless-N VPN Router, and the Cisco CVR100W Wireless-N VPN Router could allow an unauthenticated, remote attacker to gain administrative-level access to the web management interface of the affected device. The vulnerability is due to improper handling of authentication requests by the web framework. An attacker could exploit this vulnerability by intercepting, modifying and resubmitting an authentication request. Successful exploitation of this vulnerability could give an attacker administrative-level access to the web-based administration interface on the affected device.

tags | advisory, remote, web
systems | cisco
MD5 | 4055e94411cce45510878631e3d39403
EMC Documentum TaskSpace 6.7SP1 / 6.7SP2 Privilege Escalation / File Retrieval
Posted Mar 6, 2014
Site emc.com

EMC Documentum TaskSpace (TSP) versions 6.7SP1 and 6.7SP2 suffer from privilege escalation and arbitrary file retrieval vulnerabilities.

tags | advisory, arbitrary, vulnerability
advisories | CVE-2014-0629, CVE-2014-0630
MD5 | de7ea5f86d6e9cbdb99461a72ffd697a
OpenDocMan 1.2.7 SQL Injection / Access Control
Posted Mar 6, 2014
Authored by High-Tech Bridge SA | Site htbridge.com

OpenDocMan versions 1.2.7 and below suffer from improper access control and remote SQL injection vulnerabilities.

tags | exploit, remote, vulnerability, sql injection
advisories | CVE-2014-1945, CVE-2014-1946
MD5 | d063ab8f44d8570aa7e8fce33d754dbf
Drupal NewsFlash 6.x / 7.x Cross Site Scripting
Posted Mar 6, 2014
Authored by Dennis Walgaard | Site drupal.org

Drupal NewsFlash third party module versions 6.x and 7.x suffer from a cross site scripting vulnerability.

tags | advisory, xss
MD5 | bb0acd5adc170ba9d983afb860c9bd44
Cisco Security Advisory 20140305-wlc
Posted Mar 6, 2014
Authored by Cisco Systems | Site cisco.com

Cisco Security Advisory - The Cisco Wireless LAN Controller (WLC) product family is affected by denial of service and unauthorized access vulnerabilities.

tags | advisory, denial of service, vulnerability
systems | cisco
MD5 | 3a8734c2bef9283989516b4c36645e2a
Cisco RV110W / RV215W / CVR100W Login Bypass
Posted Mar 6, 2014
Authored by Gustavo Speranza

Cisco RV110W, RV215W, and CVR100W suffer from a login bypass vulnerability. Affected includes Cisco RV110W Wireless-N VPN Firewall running firmware versions 1.2.0.9 and prior, Cisco RV215W Wireless-N VPN Router running firmware versions 1.1.0.5 and prior, and Cisco CVR100W Wireless-N VPN Router running firmware versions 1.0.1.19 and prior.

tags | exploit, bypass
systems | cisco
advisories | CVE-2014-0683
MD5 | 5e003024e16f0b44f05501494e1ae992
Drupal Masquerade 6.x / 7.x Access Bypass
Posted Mar 6, 2014
Authored by Jeff H | Site drupal.org

Drupal Masquerade third party module versions 6.x and 7.x suffer from an access bypass vulnerability.

tags | advisory, bypass
MD5 | 7f6f5f9d5e26c878155bf449ee2a4f03
Drupal Mime Mail 6.x / 7.x Access Bypass
Posted Mar 6, 2014
Authored by Heine Deelstra | Site drupal.org

Drupal Mime Mail third party module versions 6.x and 7.x suffer from an access bypass vulnerability.

tags | advisory, bypass
MD5 | a3f10ebb692bf41db37555026a1e982c
Capstone 2.1
Posted Mar 6, 2014
Authored by Nguyen Anh Quynh | Site capstone-engine.org

Capstone is a multi-architecture, multi-platform disassembly framework. It has a simple and lightweight architecture-neutral API, thread-safe by design, provides details on disassembled instruction, and more.

Changes: Various bug fixes and added support.
tags | tool
systems | linux, unix
MD5 | 1756abf7af7e08576703d35cc34202ba
Nsdtool Netgear Switch Scanner
Posted Mar 6, 2014
Authored by Stephan Zeisberg | Site curesec.com

Nsdtool is a toolset of scripts used to detect Netgear switches in local networks. The tool contains some extra features like bruteforce and setting a new password. Netgear has its own protocol called NSDP (Netgear Switch Discovery Protocol), which is implemented to support security tests on the commandline. It is not being bound to the delivered tools by Netgear.

tags | tool, local, protocol
systems | unix
MD5 | 876dbac6639b84c40c9e1241adb041a1
Red Hat Security Advisory 2014-0253-01
Posted Mar 6, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-0253-01 - Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. A denial of service flaw was found in the way Apache Commons FileUpload, which is embedded in the JBoss Web component of JBoss EAP, handled small-sized buffers used by MultipartStream. A remote attacker could use this flaw to create a malformed Content-Type header for a multipart request, causing JBoss Web to enter an infinite loop when processing such an incoming request. Warning: Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

tags | advisory, java, remote, web, denial of service
systems | linux, redhat
advisories | CVE-2014-0050
MD5 | 022bb7b643cd15557c4709f8a5857a3c
Red Hat Security Advisory 2014-0254-01
Posted Mar 6, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-0254-01 - Apache ActiveMQ provides a SOA infrastructure to connect processes across heterogeneous systems. A flaw was found in Apache Camel's parsing of the FILE_NAME header. A remote attacker able to submit messages to a Camel route, which would write the provided message to a file, could provide expression language expressions in the FILE_NAME header, which would be evaluated on the server. This could lead to arbitrary remote code execution in the context of the Camel server process. It was found that the Apache Camel XSLT component allowed XSL stylesheets to call external Java methods. A remote attacker able to submit messages to a Camel route could use this flaw to perform arbitrary remote code execution in the context of the Camel server process.

tags | advisory, java, remote, arbitrary, code execution
systems | linux, redhat
advisories | CVE-2013-2035, CVE-2013-4152, CVE-2013-4330, CVE-2014-0003
MD5 | b54bdea8db7c12e21553162fa4440a09
Page 1 of 2
Back12Next

File Archive:

July 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    2 Files
  • 2
    Jul 2nd
    3 Files
  • 3
    Jul 3rd
    15 Files
  • 4
    Jul 4th
    4 Files
  • 5
    Jul 5th
    15 Files
  • 6
    Jul 6th
    15 Files
  • 7
    Jul 7th
    10 Files
  • 8
    Jul 8th
    2 Files
  • 9
    Jul 9th
    10 Files
  • 10
    Jul 10th
    15 Files
  • 11
    Jul 11th
    15 Files
  • 12
    Jul 12th
    19 Files
  • 13
    Jul 13th
    16 Files
  • 14
    Jul 14th
    15 Files
  • 15
    Jul 15th
    3 Files
  • 16
    Jul 16th
    2 Files
  • 17
    Jul 17th
    8 Files
  • 18
    Jul 18th
    11 Files
  • 19
    Jul 19th
    15 Files
  • 20
    Jul 20th
    15 Files
  • 21
    Jul 21st
    15 Files
  • 22
    Jul 22nd
    7 Files
  • 23
    Jul 23rd
    2 Files
  • 24
    Jul 24th
    19 Files
  • 25
    Jul 25th
    28 Files
  • 26
    Jul 26th
    2 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close