e107 version 0.7.25_full suffers from cross site scripting and remote file inclusion vulnerabilities.
a1009de0e9d35d4684ddf711c669b7f6adc01cfdf2acabcd1c1311d4efad15bbMandriva Linux Security Advisory 2012-137 - Oliver-Tobias Ripka discovered that an ACPI script incorrectly handled power button events. A local attacker could use this to execute arbitrary code, and possibly escalate privileges. Helmut Grohne and Michael Biebl discovered that ACPI scripts were executed with a permissive file mode creation mask. A local attacker could read files and modify directories created by ACPI scripts that did not set a strict umask. The updated packages have been patched to correct these issues.
bf64566f3857d8378c5f530d05dddf5ae935df9d405244ca913d69759b5cc8fbMandriva Linux Security Advisory 2012-136 - Multiple cross-site scripting vulnerabilities was discovered by using the Database structure page with a crafted table name. This upgrade provides the latest phpmyadmin version to address this vulnerability.
4f113b7473341f4b5b1404d9fbf72c22dd8466370f6b383c45f0eb638cb6c89eLsoft ListServ version 16 suffers from a cross site scripting vulnerability. The issue is fixed in WA revision r4276.
ffe1f02e0f063983d7edcebebc145edd536e5798c84727d1e438b00cb820d5c1Jaow CMS version 2.3 suffers from a cross site request forgery vulnerability.
c657173514edace566f414ca34f718968863e18646b9923687c4ad2e09b82608Elastix version 2.2.0 suffers from a local file inclusion vulnerability.
e3766268449894cd90fba749cdfdc3b110bd29043924e14cf6418689bfa23382Hastymail2 Webmail version 1.1 RC2 suffers from a stored cross site scripting vulnerability.
e5603aa49a000259245c4d8c25c238c4b532a5ced67a9626f40e89c41de66dc6T-dah Webmail version 3.2.0 suffers from stored cross site scripting vulnerabilities.
f849cce7db945350fcf31a0846493b9158d0a5016e1c297b052c01017c41218bWeBid versions 1.0.4 and below suffer from local file disclosure, remote file inclusion, and remote SQL injection vulnerabilities.
cadf34d43c06b4a8884f133bd4533936acc454d86939dd74decdbe83787a788eICS-CERT Advisory ICSA-12-228-01 - Independent security researchers Billy Rios and Terry McCorkle have identified multiple vulnerabilities in the Tridium Niagara AX Framework software. The vulnerabilities include directory traversal, weak credential storage, session cookie weaknesses, and predictable session IDs, all of which can be exploited remotely. All known versions of the Tridium Niagara AX Framework software products are susceptible to these vulnerabilities.
a321597efe4a62df5a3a2266cf1f16eb392c55adffe8c8fa35b7747b79ea649bGnuTLS is a secure communications library implementing the SSL and TLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols, as well as APIs to parse and write X.509, PKCS #12, OpenPGP, and other required structures. It is intended to be portable and efficient with a focus on security and interoperability.
4fdb58572fb91fc0afbdfcd7845d4467d4b13ef2f9141bdaa955b959a319f8ccThere is an arbitrary command execution vulnerability in the scriptfu network server console in the GIMP 2.6 branch. It is possible to use a python scriptfu command to run arbitrary operating-system commands and potentially take full control of the host.
6bb8abc35df548c551fcf9ff102ee8db444b1e273993fe8a725e91885c36da04ManageEngine OpStor version 7.4 suffers from cross site scripting and remote SQL injection vulnerabilities.
0d32814a7c7e07a67aa2e95cf6174ae8d8c2d00a3fc33f9753921e77bd33d89fDNS Spider is a multithreaded bruteforcer of subdomains that leverages a wordlist and/or character permutation.
42aac743fdc74591a341e7fe933e13851912c3eae3ac0c04086913041adab349Hashes is a cross-platform tool that generates and injects different keys with the same hash code in order to test web applications against hash collision attacks. Written in Java. Has support for Java, PHP, ASP, and V8.
6bedf1fbba1ca220222bc6be3b897176d50aac02f53df2ed5328792dd158289cMandriva Linux Security Advisory 2012-135 - The DCP ETSI dissector could trigger a zero division. The MongoDB dissector could go into a large loop. The XTP dissector could go into an infinite loop. The AFP dissector could go into a large loop. The RTPS2 dissector could overflow a buffer. The CIP dissector could exhaust system memory. The STUN dissector could crash. The EtherCAT Mailbox dissector could abort. The CTDB dissector could go into a large loop. This advisory provides the latest version of Wireshark which is not vulnerable to these issues.
ed1f626a9ec66091da1ced33f9dcf94853900a07685bff02a384520cb736cdfcRoundcube Webmail version 0.8.0 suffers from multiple stored cross site scripting vulnerabilities.
6dfa0a7ef6c176b11b524cca79272af01deb78987c2cd19c827f958047b30f1eNike+ Panel and Mobile App suffers from multiple cross site scripting vulnerabilities.
318952fc36f8ecd15a627349d8609286daecfc86c7dc03596b132349ec1fbeedShopperPress WordPress theme version 2.7 suffers from cross site scripting vulnerabilities.
491c4ea2642b413280ac3851a6e53813f20e256059abdc11931d3d115eea5543Mandriva Linux Security Advisory 2012-134 - The DCP ETSI dissector could trigger a zero division. The MongoDB dissector could go into a large loop. The XTP dissector could go into an infinite loop. The AFP dissector could go into a large loop. The RTPS2 dissector could overflow a buffer. The GSM RLC MAC dissector could overflow a buffer. The CIP dissector could exhaust system memory. The STUN dissector could crash. The EtherCAT Mailbox dissector could abort. The CTDB dissector could go into a large loop. This advisory provides the latest version of Wireshark which is not vulnerable to these issues.
e7a2ce0735205d049fc69106cd58cf7bc1f4cbae6e55ed2fc256e52ad05d4759ProQuiz version 2.0.2 suffers from a cross site request forgery vulnerability.
1d3692f82eccc72015fdd11936a3d8a2526c9cdc5a3e7bfa34d939d1a50b1171Slackware Security Advisory - New t1lib packages are available for Slackware 12.1, 12.2, 13.0, 13.1, 13.37, and -current to fix security issues. These fixes include overflows, crashes, and pointer bugs.
aca91d3d6ff3435ba1461c911ecfeabf51d810fd120a10d94a1a06a0d8a10e46The Timed Interactive Multimedia Extensions (aka HTML+TIME) implementation in Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that was not properly initialized or is deleted, aka "Time Element Memory Corruption Vulnerability." This is an exploit for the vulnerability noted in MS11-050.
ce6d03f8afb8da5e9fab7773161352eac8d3bfb7b25bc19d2aa5c97279ad7812E-Mail Security Virtual Appliance (EVSA) suffers from a remote command execution vulnerability. Versions prior to 2.0.6 are affected.
6e4b74507cc0d89132a2039f65a75dcfe8903fdc24f6e4e066324b6bdfab2cacMandriva Linux Security Advisory 2012-133 - It was discovered that usbmuxd did not correctly perform bounds checking when processing the SerialNumber field of USB devices. An attacker with physical access could use this to crash usbmuxd or potentially execute arbitrary code as the usbmux user. The updated packages have been patched to correct this issue.
3ae2eaf49a9bfc802e659cf70f95a8ee4095350027b507c59c3be723c46cae97The ShopperPress WordPress theme version 2.7 suffers from a remote SQL injection vulnerability.
ed35edb8650c19623a01a17b915ca31339739c6d58d3e1a859b296896830b99d
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed