what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 25 of 38 RSS Feed

Files Date: 2014-12-12

Wordpress Download Manager (download-manager) Unauthenticated File Upload
Posted Dec 12, 2014
Authored by Christian Mehlmauer, Mickael Nadeau | Site metasploit.com

The WordPress download-manager plugin contains multiple unauthenticated file upload vulnerabilities which were fixed in version 2.7.5.

tags | exploit, vulnerability, file upload
SHA-256 | 079e34e20841af90322c299baf4e66895abbbef7cea8d6d73043669dc843d6bf
Microsoft Security Bulletin Revision Increment For December, 2014
Posted Dec 12, 2014
Site microsoft.com

This bulletin summary lists one bulletin that has undergone a major revision increment for December, 2014.

tags | advisory
SHA-256 | 10f297ef1c2d5cdcff4b9051acd3dab402f0f4dc2931074932d16cef502726d8
Suricata IDPE 2.0.5
Posted Dec 12, 2014
Site openinfosecfoundation.org

Suricata is a network intrusion detection and prevention engine developed by the Open Information Security Foundation and its supporting vendors. The engine is multi-threaded and has native IPv6 support. It's capable of loading existing Snort rules and signatures and supports the Barnyard and Barnyard2 tools.

Changes: Various bug fixes and some stream improvements.
tags | tool, intrusion detection
systems | unix
SHA-256 | 57b1120e91bd4e348e1a4cee9eb7b197d05fc25169e062f1a11f5dd4b9322c60
Tuleap PHP Unserialize Code Execution
Posted Dec 12, 2014
Authored by EgiX | Site metasploit.com

This Metasploit module exploits a PHP object injection vulnerability in Tuelap <= 7.6-4 which could be abused to allow authenticated users to execute arbitrary code with the permissions of the web server. The dangerous unserialize() call exists in the 'src/www/project/register.php' file. The exploit abuses the destructor method from the Jabbex class in order to reach a call_user_func_array() call in the Jabbex class and call the fetchPostActions() method from the Transition_PostAction_FieldFactory class to execute PHP code through an eval() call. In order to work, the target must have the 'sys_create_project_in_one_step' option disabled.

tags | exploit, web, arbitrary, php
advisories | CVE-2014-8791
SHA-256 | 5a33756ac6f164ee2fb059946d33588c9b36b6022e2d724e212c9716e418d54e
RSA Authentication Manager 8.0 / 8.1 Unvalidated Redirect
Posted Dec 12, 2014
Site emc.com

A potential vulnerability in RSA Authentication Manager 8.0 and RSA Authentication Manager 8.1 may allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks.

tags | advisory, remote, web, arbitrary
SHA-256 | c94e4103d1b1f6c1f48e2083bc20a14a126ed6661565ecc81889a562ba568adb
RSA Archer GRC Platform 5.x Cross Site Scripting
Posted Dec 12, 2014
Site emc.com

RSA Archer GRC Platform version 5.x suffers from cross site scripting and various other Oracle JRE 7 vulnerabilities.

tags | advisory, vulnerability, xss
advisories | CVE-2014-4633
SHA-256 | 6b4a2792bb657ccb72440c6bd80139f9a70eac83846efd16aae3847693ce4c1c
EMC Isilon InsightIQ Cross Site Scripting
Posted Dec 12, 2014
Site emc.com

EMC Isilon InsightIQ may be potentially affected by a cross-site scripting vulnerability that could be exploited by malicious users to compromise the affected system. EMC Isilon InsightIQ versions 3.0.1, 3.0.0, 2.5.2, 2.5.1, 2.5.0, 2.1.0, 2.0.1, and 2.0.0 are affected.

tags | advisory, xss
advisories | CVE-2014-4628
SHA-256 | df55b5989651d1f6edd03b4ab30686d501dbe2c8291efc49da5667b050cb47a9
Docker Privilege Escalation / Path Traversal / Spoofing
Posted Dec 12, 2014
Authored by Eric Windisch, Tonis Tiigi

Docker version 1.3.3 has been released to address privilege escalation, path traversal, and spoofing vulnerabilities.

tags | advisory, spoof, vulnerability, file inclusion
advisories | CVE-2014-9356, CVE-2014-9357, CVE-2014-9358
SHA-256 | 8500831f87dd1053a5b03c9bb78a961217c43693b105c24e9149353125d6553a
HP Security Bulletin HPSBUX03162 SSRT101767 3
Posted Dec 12, 2014
Authored by HP | Site hp.com

HP Security Bulletin HPSBUX03162 SSRT101767 3 - Potential security vulnerabilities have been identified with HP-UX running OpenSSL. These vulnerabilities could be exploited remotely to create a Denial of Service (DoS), allow unauthorized access, or a man-in-the-middle (MitM) attack. This is the SSLv3 vulnerability known as "Padding Oracle On Downgraded Legacy Encryption" also known as "POODLE", which could be exploited remotely to allow disclosure of information. Revision 3 of this advisory.

tags | advisory, denial of service, vulnerability
systems | hpux
advisories | CVE-2014-3566, CVE-2014-3567, CVE-2014-3568
SHA-256 | ac73ab793d3e143cbf0d6f6b0e608c4518b82d95afb0fd03bef55139f7c4359f
Debian Security Advisory 3099-1
Posted Dec 12, 2014
Authored by Debian | Site debian.org

Debian Linux Security Advisory 3099-1 - Simon McVittie discovered that the fix for CVE-2014-3636 was incorrect, as it did not fully address the underlying denial-of-service vector. This update starts the D-Bus daemon as root initially, so that it can properly raise its file descriptor count.

tags | advisory, root
systems | linux, debian
advisories | CVE-2014-7824
SHA-256 | b16d3d2ddbe47620229c22a1286fd9cd9b5f6f1382c46f6f464f040d0fb9cfd5
Red Hat Security Advisory 2014-1985-01
Posted Dec 12, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-1985-01 - The Berkeley Internet Name Domain is an implementation of the Domain Name System protocols. BIND includes a DNS server ; a resolver library ; and tools for verifying that the DNS server is operating correctly. A denial of service flaw was found in the way BIND followed DNS delegations. A remote attacker could use a specially crafted zone containing a large number of referrals which, when looked up and processed, would cause named to use excessive amounts of memory or crash.

tags | advisory, remote, denial of service, protocol
systems | linux, redhat
advisories | CVE-2014-8500
SHA-256 | 80b5d38f57260b3a962b8a2b0f4fd7064ffb4a33fe8c3de927322f243c9d200a
Red Hat Security Advisory 2014-1984-01
Posted Dec 12, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-1984-01 - The Berkeley Internet Name Domain is an implementation of the Domain Name System protocols. BIND includes a DNS server ; a resolver library ; and tools for verifying that the DNS server is operating correctly. A denial of service flaw was found in the way BIND followed DNS delegations. A remote attacker could use a specially crafted zone containing a large number of referrals which, when looked up and processed, would cause named to use excessive amounts of memory or crash.

tags | advisory, remote, denial of service, protocol
systems | linux, redhat
advisories | CVE-2014-8500
SHA-256 | 87b5b982594ba2b6e1106bf92f7524c83e64a6f93b0b3a96deb18212d2feb05d
Gentoo Linux Security Advisory 201412-11
Posted Dec 12, 2014
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 201412-11 - Multiple vulnerabilities have been found in AMD64 x86 emulation base libraries, the worst of which may allow remote execution of arbitrary code. Versions prior to 20140406-r1 are affected.

tags | advisory, remote, arbitrary, x86, vulnerability
systems | linux, gentoo
advisories | CVE-2007-0720, CVE-2007-1536, CVE-2007-2026, CVE-2007-2445, CVE-2007-2741, CVE-2007-3108, CVE-2007-4995, CVE-2007-5116, CVE-2007-5135, CVE-2007-5266, CVE-2007-5268, CVE-2007-5269, CVE-2007-5849, CVE-2010-1205, CVE-2013-0338, CVE-2013-0339, CVE-2013-1664, CVE-2013-1969, CVE-2013-2877, CVE-2014-0160
SHA-256 | 0d52bd946d4c830b5f1f480535296f513bafe2d3abc811d6666cbb6fb317a087
Gentoo Linux Security Advisory 201412-10
Posted Dec 12, 2014
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 201412-10 - This GLSA contains notification of vulnerabilities found in several Gentoo packages which have been fixed prior to January 1, 2013. The worst of these vulnerabilities could lead to local privilege escalation and remote code execution.

tags | advisory, remote, local, vulnerability, code execution
systems | linux, gentoo
advisories | CVE-2008-4776, CVE-2010-2713, CVE-2010-3313, CVE-2010-3314, CVE-2011-0765, CVE-2011-2198, CVE-2012-0807, CVE-2012-0808, CVE-2012-1620, CVE-2012-2738, CVE-2012-3448
SHA-256 | dfae5213058f17a174e44b8ab87d7bf913eba47a9c114a364faf2921fd834a0e
Gentoo Linux Security Advisory 201412-09
Posted Dec 12, 2014
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 201412-9 - This GLSA contains notification of vulnerabilities found in several Gentoo packages which have been fixed prior to January 1, 2012. The worst of these vulnerabilities could lead to local privilege escalation and remote code execution.

tags | advisory, remote, local, vulnerability, code execution
systems | linux, gentoo
advisories | CVE-2007-4370, CVE-2009-4023, CVE-2009-4111, CVE-2010-0778, CVE-2010-1780, CVE-2010-1782, CVE-2010-1783, CVE-2010-1784, CVE-2010-1785, CVE-2010-1786, CVE-2010-1787, CVE-2010-1788, CVE-2010-1790, CVE-2010-1791, CVE-2010-1792, CVE-2010-1793, CVE-2010-1807, CVE-2010-1812, CVE-2010-1814, CVE-2010-1815, CVE-2010-2526, CVE-2010-2901, CVE-2010-3255, CVE-2010-3257, CVE-2010-3259, CVE-2010-3362, CVE-2010-3374, CVE-2010-3389
SHA-256 | 4995f714768dc9489827ec4c465280ca801c6e87a06c8c8703f318a02caf11a8
Ubuntu Security Notice USN-2448-1
Posted Dec 12, 2014
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 2448-1 - An information leak in the Linux kernel was discovered that could leak the high 16 bits of the kernel stack address on 32-bit Kernel Virtual Machine (KVM) paravirt guests. A user in the guest OS could exploit this leak to obtain information that could potentially be used to aid in attacking the kernel. Rabin Vincent, Robert Swiecki, Russell King discovered that the ftrace subsystem of the Linux kernel does not properly handle private syscall numbers. A local user could exploit this flaw to cause a denial of service (OOPS). Various other issues were also addressed.

tags | advisory, denial of service, kernel, local
systems | linux, ubuntu
advisories | CVE-2014-3673, CVE-2014-3687, CVE-2014-3688, CVE-2014-7825, CVE-2014-7826, CVE-2014-7970, CVE-2014-8086, CVE-2014-8134, CVE-2014-8369, CVE-2014-9090
SHA-256 | cc26cddcf990c6e4806b8a2830ba32c515f3b08214bf8c6381b965ed04395de6
Ubuntu Security Notice USN-2444-1
Posted Dec 12, 2014
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 2444-1 - An information leak in the Linux kernel was discovered that could leak the high 16 bits of the kernel stack address on 32-bit Kernel Virtual Machine (KVM) paravirt guests. A user in the guest OS could exploit this leak to obtain information that could potentially be used to aid in attacking the kernel. Rabin Vincent, Robert Swiecki, Russell King discovered that the ftrace subsystem of the Linux kernel does not properly handle private syscall numbers. A local user could exploit this flaw to cause a denial of service (OOPS). Various other issues were also addressed.

tags | advisory, denial of service, kernel, local
systems | linux, ubuntu
advisories | CVE-2014-7825, CVE-2014-7826, CVE-2014-7841, CVE-2014-8134, CVE-2014-8884, CVE-2014-9090
SHA-256 | 8d55b495c08c469f393a908849b08199e4e913ec6381b4b38d921293f81b5df4
Ubuntu Security Notice USN-2447-1
Posted Dec 12, 2014
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 2447-1 - An information leak in the Linux kernel was discovered that could leak the high 16 bits of the kernel stack address on 32-bit Kernel Virtual Machine (KVM) paravirt guests. A user in the guest OS could exploit this leak to obtain information that could potentially be used to aid in attacking the kernel. Rabin Vincent, Robert Swiecki, Russell King discovered that the ftrace subsystem of the Linux kernel does not properly handle private syscall numbers. A local user could exploit this flaw to cause a denial of service (OOPS). Various other issues were also addressed.

tags | advisory, denial of service, kernel, local
systems | linux, ubuntu
advisories | CVE-2014-3673, CVE-2014-3687, CVE-2014-3688, CVE-2014-7825, CVE-2014-7826, CVE-2014-7970, CVE-2014-8086, CVE-2014-8134, CVE-2014-8369, CVE-2014-9090
SHA-256 | df1d53cc9704187a3bff3f08f70b26ee26d8e4cf0a0fd71fa2bd5ced9530d3d6
Ubuntu Security Notice USN-2446-1
Posted Dec 12, 2014
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 2446-1 - An information leak in the Linux kernel was discovered that could leak the high 16 bits of the kernel stack address on 32-bit Kernel Virtual Machine (KVM) paravirt guests. A user in the guest OS could exploit this leak to obtain information that could potentially be used to aid in attacking the kernel. Rabin Vincent, Robert Swiecki, Russell King discovered that the ftrace subsystem of the Linux kernel does not properly handle private syscall numbers. A local user could exploit this flaw to cause a denial of service (OOPS). Various other issues were also addressed.

tags | advisory, denial of service, kernel, local
systems | linux, ubuntu
advisories | CVE-2014-3673, CVE-2014-3687, CVE-2014-3688, CVE-2014-7825, CVE-2014-7826, CVE-2014-8134, CVE-2014-8369, CVE-2014-9090
SHA-256 | 8e8cdac6a89c267aaf2a3f6860b6f66859cff32a439578520916813950701dd3
Ubuntu Security Notice USN-2445-1
Posted Dec 12, 2014
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 2445-1 - An information leak in the Linux kernel was discovered that could leak the high 16 bits of the kernel stack address on 32-bit Kernel Virtual Machine (KVM) paravirt guests. A user in the guest OS could exploit this leak to obtain information that could potentially be used to aid in attacking the kernel. Rabin Vincent, Robert Swiecki, Russell King discovered that the ftrace subsystem of the Linux kernel does not properly handle private syscall numbers. A local user could exploit this flaw to cause a denial of service (OOPS). Various other issues were also addressed.

tags | advisory, denial of service, kernel, local
systems | linux, ubuntu
advisories | CVE-2014-3673, CVE-2014-3687, CVE-2014-3688, CVE-2014-7825, CVE-2014-7826, CVE-2014-8134, CVE-2014-8369, CVE-2014-9090
SHA-256 | 94e812239191ebdb5a1cef87d91adbdb63a8e570f57301b832942b8b783b3c83
Ubuntu Security Notice USN-2443-1
Posted Dec 12, 2014
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 2443-1 - An information leak in the Linux kernel was discovered that could leak the high 16 bits of the kernel stack address on 32-bit Kernel Virtual Machine (KVM) paravirt guests. A user in the guest OS could exploit this leak to obtain information that could potentially be used to aid in attacking the kernel. Rabin Vincent, Robert Swiecki, Russell King discovered that the ftrace subsystem of the Linux kernel does not properly handle private syscall numbers. A local user could exploit this flaw to cause a denial of service (OOPS). Various other issues were also addressed.

tags | advisory, denial of service, kernel, local
systems | linux, ubuntu
advisories | CVE-2014-7825, CVE-2014-7826, CVE-2014-7841, CVE-2014-8134, CVE-2014-8884, CVE-2014-9090
SHA-256 | cf6047ccb1b24e003bd8fa8a4bde8410e0623e015f81104c409931c57084f548
Ubuntu Security Notice USN-2442-1
Posted Dec 12, 2014
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 2442-1 - An information leak in the Linux kernel was discovered that could leak the high 16 bits of the kernel stack address on 32-bit Kernel Virtual Machine (KVM) paravirt guests. A user in the guest OS could exploit this leak to obtain information that could potentially be used to aid in attacking the kernel. A flaw in the handling of malformed ASCONF chunks by SCTP (Stream Control Transmission Protocol) implementation in the Linux kernel was discovered. A remote attacker could exploit this flaw to cause a denial of service (system crash). Various other issues were also addressed.

tags | advisory, remote, denial of service, kernel, protocol
systems | linux, ubuntu
advisories | CVE-2014-3673, CVE-2014-3687, CVE-2014-3688, CVE-2014-7841, CVE-2014-8134, CVE-2014-8709, CVE-2014-8884, CVE-2014-9090
SHA-256 | 288267c834792a8e3246504ad1734c3fe48f348a5065045fb6df325ec1dcf9ee
Ubuntu Security Notice USN-2441-1
Posted Dec 12, 2014
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 2441-1 - An information leak in the Linux kernel was discovered that could leak the high 16 bits of the kernel stack address on 32-bit Kernel Virtual Machine (KVM) paravirt guests. A user in the guest OS could exploit this leak to obtain information that could potentially be used to aid in attacking the kernel. A flaw in the handling of malformed ASCONF chunks by SCTP (Stream Control Transmission Protocol) implementation in the Linux kernel was discovered. A remote attacker could exploit this flaw to cause a denial of service (system crash). Various other issues were also addressed.

tags | advisory, remote, denial of service, kernel, protocol
systems | linux, ubuntu
advisories | CVE-2014-3673, CVE-2014-3687, CVE-2014-3688, CVE-2014-7841, CVE-2014-8134, CVE-2014-8709, CVE-2014-8884, CVE-2014-9090
SHA-256 | 351ac93482ab04f44a623a4251f21fe15ca92d2c32eaf98a44a99b4d5a247b0e
Gentoo Linux Security Advisory 201412-08
Posted Dec 12, 2014
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 201412-8 - This GLSA contains notification of vulnerabilities found in several Gentoo packages which have been fixed prior to January 1, 2011. The worst of these vulnerabilities could lead to local privilege escalation and remote code execution.

tags | advisory, remote, local, vulnerability, code execution
systems | linux, gentoo
advisories | CVE-2006-3005, CVE-2007-2741, CVE-2008-0553, CVE-2008-1382, CVE-2008-5907, CVE-2008-6218, CVE-2008-6661, CVE-2009-0040, CVE-2009-0360, CVE-2009-0361, CVE-2009-0946, CVE-2009-2042, CVE-2009-2624, CVE-2009-3736, CVE-2009-4029, CVE-2009-4411, CVE-2009-4896, CVE-2010-0001, CVE-2010-0436, CVE-2010-0732, CVE-2010-0829, CVE-2010-1000, CVE-2010-1205, CVE-2010-1511, CVE-2010-2056, CVE-2010-2060, CVE-2010-2192, CVE-2010-2251
SHA-256 | a863e2eb03f0ac1937834e096aa9a52158ef6e9eb8144f3d6df45b14d4002a27
WordPress WP Construction Mode 1.91 XSS
Posted Dec 12, 2014
Authored by Morten Nortoft, Kenneth Jepsen, Mikkel Vej

WordPress WP Construction Mode plugin version 1.91 suffers from a reflective cross site scripting vulnerability.

tags | exploit, xss
SHA-256 | 4b3a420c975d97c587880090e2cd44f989c3707e35392b402ae97274917b937f
Page 1 of 2
Back12Next

File Archive:

July 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    52 Files
  • 2
    Jul 2nd
    0 Files
  • 3
    Jul 3rd
    0 Files
  • 4
    Jul 4th
    11 Files
  • 5
    Jul 5th
    0 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    0 Files
  • 9
    Jul 9th
    0 Files
  • 10
    Jul 10th
    0 Files
  • 11
    Jul 11th
    0 Files
  • 12
    Jul 12th
    0 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    0 Files
  • 16
    Jul 16th
    0 Files
  • 17
    Jul 17th
    0 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close