WiFi HD version 7.3.0 suffers from local file inclusion, directory traversal, command injection, and cross site request forgery vulnerabilities.
385a35c17ef6e5d6fe31cad54fc9c513afe14f1ef33ed25c6b35b80ff42a5f85Proof of concept project that demonstrates how old FPGA boards can be reused for hash cracking purposes.
a5d7dd772b6f73f7bfd7ffca2d5849a002cf66e9c9f01f669a988bda7fac8011Siemens SIMATIC WinCC versions prior to 7.3 suffer from unauthenticated access, privilege escalation, and hard-coded encryption key vulnerabilities.
7b2386094198c589bb175e6f6352b3527830abc474c16d1dbe09639309362020Lyris ListManagerWeb version 8.95a suffers from a cross site scripting vulnerability.
e824ac215ca489b54cbb8e68ab45e456ebda1efbabb8167f8f80f7e30fe06d18Red Hat Security Advisory 2014-0981-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. A use-after-free flaw was found in the way the ping_init_sock() function of the Linux kernel handled the group_info reference counter. A local, unprivileged user could use this flaw to crash the system or, potentially, escalate their privileges on the system. A NULL pointer dereference flaw was found in the way the futex_wait_requeue_pi() function of the Linux kernel's futex subsystem handled the requeuing of certain Priority Inheritance futexes. A local, unprivileged user could use this flaw to crash the system.
de80732b0357d6b9f6be6f8c9e7da59e5a32c6ff3a767b3625c79cfd20dbec82Red Hat Security Advisory 2014-0979-01 - The rhev-hypervisor6 package provides a Red Hat Enterprise Virtualization Hypervisor ISO disk image. The Red Hat Enterprise Virtualization Hypervisor is a dedicated Kernel-based Virtual Machine hypervisor. It includes everything necessary to run and manage virtual machines: a subset of the Red Hat Enterprise Linux operating environment and the Red Hat Enterprise Virtualization Agent. Note: Red Hat Enterprise Virtualization Hypervisor is only available for the Intel 64 and AMD64 architectures with virtualization extensions. It was found that NSS accepted weak Diffie-Hellman Key exchange parameters. This could possibly lead to weak encryption being used in communication between the client and the server.
7e472af39243b2111c21f2041f546e46ac85697a4ad1633bc4b0836a92c7ee63Red Hat Security Advisory 2014-0982-01 - This update corrects several security vulnerabilities in the IBM Java Runtime Environment shipped as part of Red Hat Network Satellite Server 5.4, 5.5, and 5.6. In a typical operating environment, these are of low security risk as the runtime is not used on untrusted applets. Several flaws were fixed in the IBM Java 2 Runtime Environment.
b4ddf444c5203044fecdf2fbe1d797919572413a3765151f718ef34faded1004LinkedIn suffered from a user account handling vulnerability.
dd6ed709186c8feeaebc535e20b97700385afcfc7f3bff6f93e8a57396aa2011This whitepaper discusses hacking with sqlmap and leveraging cross site request forgery vulnerabilities. Written in Turkish.
7130a96bfe8e601c63c6db831c76a47578959bc3aa160183ca7c39ba4c380efdWordPress WhyDoWork AdSense plugin version 1.2 suffers from cross site request forgery and cross site scripting vulnerabilities.
af9bca3fe65b0a9bbf0292a7c524d2bc3961c3d5ba4dc081c13b25eb55493d3dSites created by J&W Communications appear to suffer from remote SQL injection vulnerabilities. Note that this finding houses site-specific data.
65f4085262255284edb648a36920c83ccae9bf601ad67291db7f5c7ac9a711b3Oxwall suffers from an authenticated arbitrary PHP code execution. The vulnerability is caused due to the improper verification of uploaded files in '/admin/settings/user' script thru the 'avatar' and 'bigAvatar' POST parameters. This can be exploited to execute arbitrary PHP code by uploading a malicious PHP script file with '.php5' extension (to bypass the '.htaccess' block rule) that will be stored in '/ow_userfiles/plugins/base/avatars/' directory. Version 1.7.0 (builds 7907 and 7906) are affected.
8c841d9fd35b8ea44852d334bfc0cbfb91d113810cf27954d9f28bd0fe47a749Oxwall version 1.7.0 (builds 7907 and 7906) suffer from cross site request forgery and cross site scripting vulnerabilities.
34546a5be05a8197c0ae4879533d170e5c4a9b004a6b0c51de251d8dcc6cfb19HP Security Bulletin HPSBGN02936 - A potential security vulnerability has been identified with HP and H3C VPN Firewall Module Products. The vulnerability could be remotely exploited resulting in a Denial of Service (DoS). Revision 1 of this advisory.
edff2d81ce7184365529aef787166593faca72b38d334fdef41d69d33eb4d493This is a very thorough cheatsheet for using SQLmap.
ddc97c7300247d96dea29d50c29d669f4ea5e85011b11619ce9658f9642b3ae4This python script port scans a host using a redis server.
e34e7469c343ec4c195957f541a7b939f348e4592e0efa5781b15ab3d1c6083eParallels Tools version 9.0 for Windows suffers from an unquoted search path local privilege escalation vulnerability.
4ac561e0a8ae43976d960ffd7ca304c4850b8d9c8ae4062502ad7e6f64ca3b20This python script parses the Manifest.mbdb binary database file from iTunes Backup and prints CSV output.
00948cd9ec05d0f8cce9a5a8d032ae719d7500423c9432e6280010936d75eaa2The Ground Zero Summit (G0S) 2014 Call For Papers has been announced. It will take place November 13th through the 16th, 2014 in New Delhi.
c02e17c904e25b586337adeb4e003360b4ff3222641904017d48172a23e777c6Web Encryption Extension (WEE) suffers from an authentication bypass vulnerability.
d5595fa91a8fa0538252e28f43e88473d0efbfa67e816fb5451770506195f0b3ZeroCMS version 1.0 suffers from a persistent cross site scripting vulnerability.
909ebd6b36ef74dee3a5d9bdee2d1d0b598e85a27c2cf26579452bf3c12b75afRed Hat Security Advisory 2014-0949-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. It was found that the Linux kernel's ptrace subsystem allowed a traced process' instruction pointer to be set to a non-canonical memory address without forcing the non-sysret code path when returning to user space. A local, unprivileged user could use this flaw to crash the system or, potentially, escalate their privileges on the system. Note: The CVE-2014-4699 issue only affected systems using an Intel CPU.
f9777ca1631aa2e4c1e414fb55781fb71e7081b5f670f58256119195823e51daDebian Linux Security Advisory 2991-1 - Martin Holst Swende discovered a flaw in the way chunked requests are handled in ModSecurity, an Apache module whose purpose is to tighten the Web application security. A remote attacker could use this flaw to bypass intended mod_security restrictions by using chunked transfer coding with a capitalized Chunked value in the Transfer-Encoding HTTP header, allowing to send requests containing content that should have been removed by mod_security.
0825c96504b99d210fe961acdb714473b46a1f7fcddf8251e31b0490e8e42c0cDebian Linux Security Advisory 2990-1 - It was discovered that the web interface in CUPS, the Common UNIX Printing System, incorrectly validated permissions on rss files and directory index files. A local attacker could possibly use this issue to bypass file permissions and read arbitrary files, possibly leading to a privilege escalation.
cc938fc7d54d51a015c06e68ed74d219f09c0baf6016e28dce18fb4e2629a93bGentoo Linux Security Advisory 201407-5 - Multiple vulnerabilities have been found in OpenSSL, possibly allowing remote attackers to execute arbitrary code. Versions less than 1.0.1h-r1 are affected.
058715fbe6887e5fa7531493f741e2281a8b6fbd10beffa54560903e427c61b1
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed