UNA version 10.0.0 RC1 suffers from a persistent cross site scripting vulnerability in polyglot.php.
e5256b578b274aaf68a41ee33a072fae920639e4f32a32ad3e061c9f3af6ca4bHP Security Bulletin HPSBMU02792 SSRT100820 2 - A potential security vulnerability has been identified with HP Business Service Management (BSM) . The vulnerability could be remotely exploited to allow unauthorized disclosure of information, unauthorized modification, and Denial of Service (DoS) Revision 2 of this advisory.
02ada30c5b2b25138587bce2855554d1cb43092030ae3f9bb9451f0ed3b6029cUploadify-amazon-s3 version 1.01 suffers from an unauthenticated remote shell upload vulnerability.
3fedca85b43e85a694af66f50341b8b58f1c1f02698b86a7a56803fb85064a59WordPress Fancy Gallery third party module version 1.2.4 suffers from an unauthenticated remote shell upload vulnerability.
8a2fb5b1f4ae8ecef95b382c7596ce5d79fb9b70f251562bb8aec2f2af9f5f9eSilverstripe Pixlr Image Editor third party module version 1.0.4 suffers from an unauthenticated remote shell upload vulnerability.
92892941f615b9e1625148e66de6d4d5988ac58f60888dc1ef2d18d0ebbf6912WordPress Flip Book third party module version 1.0 suffers from an unauthenticated remote shell upload vulnerability.
445dc1cba025683e25702468ac7b05c787028b8bb03fba668b4d7e571c112022Wolf CMS / Frog CMS BD uploadR third party module suffers from an unauthenticated remote shell upload vulnerability.
7862b280d447ca7cc95905170c85512b0e3708ccdf66616a1a377cdd51241072e107 Articulate third party module version 1.1.1 suffers from an unauthenticated remote shell upload vulnerability.
41b99ecb1b11992f69a368336dd53421e432b6e6aac49f238f066819b66025b8WordPress Ajax Multi Upload third party module version 1.1 suffers from an unauthenticated remote shell upload vulnerability.
6a9bf1a55bac81bf7a7209412588bbfae984b0ccd4a0657024b25eb69f8a678bHP Security Bulletin HPSBOV02793 SSRT100891 - Potential security vulnerabilities have been identified with HP OpenVMS running SSL. The vulnerabilities could be remotely exploited to cause a Denial of Service (DoS) or to gain unauthorized access. Revision 1 of this advisory.
81afd5381e1f8df30bc1eda96940a682d60e52c9185ef5115fed35b8f301ab7cHP Security Bulletin HPSBOV02780 SSRT100766 2 - A potential security vulnerability has been identified with OpenVMS ACMELOGIN (sys$acm enabled loginout.exe). The vulnerability could be locally exploited to allow unauthorized access and increased privileges. Revision 2 of this advisory.
c7fac5abe033fcf31fad2b0de47c641ed9441f0a5f47ddb5321c8d71544bad5aZero Day Initiative Advisory 12-100 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP OpenView Performance Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the PMParamHandler component of Performance Manager, which is served via an Apache Tomcat instance that listens on TCP port 8081. The process receives a filename from a remote user and performs insufficient validation of the provided file path. Additionally, the user can specify an arbitrary extension due to premature truncation resulting from an embedded null byte. Remote unauthenticated attackers can exploit this vulnerability by sending malformed message packets to the target, which could lead to a directory traversing arbitrary file write and ultimately remote code execution under the context of the SYSTEM user.
62fba378efa118194bf75380e1caf3bdbb3a81ca43f314376ca1627030337be8Zero Day Initiative Advisory 12-097 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP Data Protector Express. Authentication is not required to exploit this vulnerability. User interaction is not required to exploit this vulnerability. The specific flaw exists within the dpwinsdr.exe process which listens on TCP port 3817 by default. The process has insufficient bounds checking on user-supplied data copied to a fixed-length buffer on the stack. Remote, unauthenticated attackers can exploit this vulnerability by sending malformed opcode 0x320 message packets to the target, which could ultimately lead to arbitrary code execution under the context of the SYSTEM user.
1c1f3a3e3b1ea2c30d5e88a6ed5a02758054e2e93ac7c92988ed4cbb989df1d4Zero Day Initiative Advisory 12-096 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP Data Protector Express. Authentication is not required to exploit this vulnerability. User interaction is not required to exploit this vulnerability. The specific flaw exists within the dpwinsdr.exe process which listens on TCP port 3817 by default. The process has insufficient bounds checking on user-supplied data copied to a fixed-length buffer on the stack. Remote, unauthenticated attackers can exploit this vulnerability by sending malformed opcode 0x330 message packets to the target, which could ultimately lead to arbitrary code execution under the context of the SYSTEM user.
ff843e03fe1fd89ea3c39d8a5267a02514914a3b649920437ff61e21fc352272Cisco Security Advisory - Cisco ASA 5500 Series Adaptive Security Appliances (Cisco ASA) and Cisco Catalyst 6500 Series ASA Services Module (Cisco ASASM) contain a vulnerability that may allow an unauthenticated, remote attacker to cause the reload of the affected device. Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available.
b2138abe79ccd8a8c42dc9e1dd56625e65c8b779de339dfbe6292280c1a13fc6Red Hat Security Advisory 2012-1024-01 - JBoss Application Server is the base package for JBoss Enterprise Application Platform, providing the core server components. The Java Naming and Directory Interface Java API allows Java software clients to locate objects or services in an application server. It was found that the JBoss JNDI service allowed unauthenticated, remote write access by default. The JNDI and HA-JNDI services, and the HAJNDIFactory invoker servlet were all affected. A remote attacker able to access the JNDI service, HA-JNDI service, or the HAJNDIFactory invoker servlet on a JBoss server could use this flaw to add, delete, and modify items in the JNDI tree. This could have various, application-specific impacts.
8cc9c3945525422b04633921dec6bd1564cbb738676ec11d5e3d8b5b39714c3eRed Hat Security Advisory 2012-1027-01 - JBoss Application Server is the base package for JBoss Enterprise Web Platform, providing the core server components. The Java Naming and Directory Interface Java API allows Java software clients to locate objects or services in an application server. The Java Authorization Contract for Containers specification defines Permission classes and the binding of container access decisions to operations on instances of these permission classes. JaccAuthorizationRealm performs authorization based on Java ACC permissions and a Policy implementation. It was found that the JBoss JNDI service allowed unauthenticated, remote write access by default. The JNDI and HA-JNDI services, and the HAJNDIFactory invoker servlet were all affected. A remote attacker able to access the JNDI service, HA-JNDI service, or the HAJNDIFactory invoker servlet on a JBoss server could use this flaw to add, delete, and modify items in the JNDI tree. This could have various, application-specific impacts.
1578bf172d8363fc992779d77d8a4145fd48215f84c717867f2aff0ef979d171Red Hat Security Advisory 2012-1025-01 - JBoss Application Server is the base package for JBoss Enterprise Application Platform, providing the core server components. The Java Naming and Directory Interface Java API allows Java software clients to locate objects or services in an application server. It was found that the JBoss JNDI service allowed unauthenticated, remote write access by default. The JNDI and HA-JNDI services, and the HAJNDIFactory invoker servlet were all affected. A remote attacker able to access the JNDI service, HA-JNDI service, or the HAJNDIFactory invoker servlet on a JBoss server could use this flaw to add, delete, and modify items in the JNDI tree. This could have various, application-specific impacts.
438ecd3704f472ac339ff1c305b869175056410b1f32535578f2aaf8cef02993Red Hat Security Advisory 2012-1026-01 - JBoss Application Server is the base package for JBoss Enterprise Application Platform, providing the core server components. The Java Naming and Directory Interface Java API allows Java software clients to locate objects or services in an application server. The Java Authorization Contract for Containers specification defines Permission classes and the binding of container access decisions to operations on instances of these permission classes. JaccAuthorizationRealm performs authorization based on Java ACC permissions and a Policy implementation. It was found that the JBoss JNDI service allowed unauthenticated, remote write access by default. The JNDI and HA-JNDI services, and the HAJNDIFactory invoker servlet were all affected. A remote attacker able to access the JNDI service, HA-JNDI service, or the HAJNDIFactory invoker servlet on a JBoss server could use this flaw to add, delete, and modify items in the JNDI tree. This could have various, application-specific impacts.
4168e8b5dde8d8685ff22bfc83da9f6eacabfa3c71ef704249f1b017705b45a7Red Hat Security Advisory 2012-1023-01 - JBoss Application Server is the base package for JBoss Enterprise Web Platform, providing the core server components. The Java Naming and Directory Interface Java API allows Java software clients to locate objects or services in an application server. It was found that the JBoss JNDI service allowed unauthenticated, remote write access by default. The JNDI and HA-JNDI services, and the HAJNDIFactory invoker servlet were all affected. A remote attacker able to access the JNDI service, HA-JNDI service, or the HAJNDIFactory invoker servlet on a JBoss server could use this flaw to add, delete, and modify items in the JNDI tree. This could have various, application-specific impacts.
af4b1c4d6857f6b733bd13ef19814d9228ac4ff24bec6d9d9171c97b4150362eRed Hat Security Advisory 2012-1022-01 - JBoss Application Server is the base package for JBoss Enterprise Application Platform, providing the core server components. The Java Naming and Directory Interface Java API allows Java software clients to locate objects or services in an application server. It was found that the JBoss JNDI service allowed unauthenticated, remote write access by default. The JNDI and HA-JNDI services, and the HAJNDIFactory invoker servlet were all affected. A remote attacker able to access the JNDI service, HA-JNDI service, or the HAJNDIFactory invoker servlet on a JBoss server could use this flaw to add, delete, and modify items in the JNDI tree. This could have various, application-specific impacts.
af9bdf7c93929aa109a8674418359aeec8a8c9c8ff4dcb42a6ff52118a155d22Red Hat Security Advisory 2012-0774-04 - libguestfs is a library for accessing and modifying guest disk images. It was found that editing files with virt-edit left said files in a world-readable state. If an administrator on the host used virt-edit to edit a file inside a guest, the file would be left with world-readable permissions. This could lead to unprivileged guest users accessing files they would otherwise be unable to. These updated libguestfs packages include numerous bug fixes and enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 6.3 Technical Notes for information on the most significant of these changes.
3c03e868e79d870f5fd7c1ec1e25276d1ae7821980f54507b63d5e89bea9fc32HP Security Bulletin HPSBMU02792 SSRT100820 - A potential security vulnerability has been identified with HP Business Service Management (BSM) . The vulnerability could be remotely exploited to allow unauthorized disclosure of information, unauthorized modification, and Denial of Service (DoS) Revision 1 of this advisory.
87ee6408887b1f21eec68ff57a37c58194ab7d3e4fb41b1a14c42d30bb20334bThe Mandos system allows computers to have encrypted root file systems and at the same time be capable of remote or unattended reboots. The computers run a small client program in the initial RAM disk environment which will communicate with a server over a network. All network communication is encrypted using TLS. The clients are identified by the server using an OpenPGP key that is unique to each client. The server sends the clients an encrypted password. The encrypted password is decrypted by the clients using the same OpenPGP key, and the password is then used to unlock the root file system.
36ea3627ca945f7c7e5d36e2cf2f4151341760f14dc63b2acc36e37c0b639bc0Ubuntu Security Notice 1463-2 - USN-1463-1 fixed vulnerabilities in Firefox. The Firefox update exposed a bug in Unity 2D which resulted in Firefox being unable to obtain pointer grabs in order to open popup menus. This update fixes the problem.
bef3895f9a125674fe04f748fe7706202ae21a5366398f9271d459db90d0bb60HP Security Bulletin HPSBMU02776 SSRT100852 - Potential security vulnerabilities have been identified with HP Onboard Administrator (OA). The vulnerabilities could be exploited remotely resulting in unauthorized access to data, unauthorized disclosure of information, and Denial of Service (DoS). Revision 1 of this advisory.
81bc660490835ba3e0d0c8bb863ac4728f1c3963fde22d565671ac239b46f148
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed