 |
|
|
|
| Multiple HP printers unauthorized access | | Published: |  | 05.12.2011 | | Source: |  | BUGTRAQ | | SecurityVulns ID: |  | 12068 | | Type: |  | remote | | Level: |  | 7/10 | | Description: |  | Remote Firmware Update option is enabled by default and allows to replace firmware via TCP/9100. |
| CVE: |  | CVE-2011-4161 (The default configuration of the HP CM8060 Color MFP with Edgeline; Color LaserJet 3xxx, 4xxx, 5550, 9500, CMxxxx, CPxxxx, and Enterprise CPxxxx; Digital Sender 9200c and 9250c; LaserJet 4xxx, 5200, 90xx, Mxxxx, and Pxxxx; and LaserJet Enterprise 500 color M551, 600, M4555 MFP, and P3015 enables the Remote Firmware Update (RFU) setting, which allows remote attackers to execute arbitrary code by using a session on TCP port 9100 to upload a crafted firmware update.) |
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
updated since 04.12.2011 | | Published: | | 05.12.2011 | | Source: | | | | SecurityVulns ID: | | 12064 | | Type: | | remote | | Level: | | 5/10 | | Description: | | PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. |
| Affected: |  | ROUNDCUBE : RoundCube 0.6 | | | | ARIADNECMS : Ariadne 2.7 | | | | PHPWARES : PHP Inventory 1.3 | | | | WIKKAWIKI : WikkaWiki 1.3 | | | | SUGARCRM : SugarCRM 6.3 | | | | ORANGEGRM : OrangeHRM 2.6 | | | | CLEARSILVER : clearsilver 0.10 | | | | JCRYPTON : jCryption 1.2 | | | | ELLISLAB : ExpressionEngine 2.2 | | | | ELLISLAB : CodeIgniter 2.0 | | CVE: | | CVE-2011-4448 (SQL injection vulnerability in actions/usersettings/usersettings.php in WikkaWiki 1.3.1 and 1.3.2 allows remote attackers to execute arbitrary SQL commands via the default_comment_display parameter in an update action.) | | | | CVE-2011-4357 (Format string vulnerability in the p_cgi_error function in python/neo_cgi.c in the Python CGI Kit (neo_cgi) module for Clearsilver 0.10.5 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers that are not properly handled when creating CGI error messages using the cgi_error API function.) | | | | CVE-2011-4025 | | | | CVE-2009-4597 (Multiple SQL injection vulnerabilities in index.php in PHP Inventory 1.2 allow (1) remote authenticated users to execute arbitrary SQL commands via the user_id parameter in a users details action, and allow remote attackers to execute arbitrary SQL commands via the (2) user (username) and (3) pass (password) parameters. NOTE: some of these details are obtained from third party information.) | | | | CVE-2009-4596 (Cross-site scripting (XSS) vulnerability in index.php in PHP Inventory 1.2 allows remote attackers to inject arbitrary web script or HTML via the sup_id parameter in a suppliers details action.) | | | | CVE-2009-4595 (SQL injection vulnerability in index.php in PHP Inventory 1.2 allows remote authenticated users to execute arbitrary SQL commands via the sup_id parameter in a suppliers details action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.) |
| Original document |  | marian.ventuneac_(at)_gmail.com, MVSA-11-013 - EllisLab xss_clean Filter Bypass - ExpressionEngine and CodeIgniter (05.12.2011) |
| | | Nick Freeman, Security-Assessment.com Release: Hacking Hollywood Slides, Advisories and Exploits (05.12.2011) |
| | | Daniel Roethlisberger, Insecure RSA Encryption in jCryption, PEAR Crypt_RSA and Crypt_RSA2 (05.12.2011) |
| | | DEBIAN, [SECURITY] [DSA 2355-1] clearsilver security update (05.12.2011) |
| | | Amir_(at)_irist.ir, Wordpress skysa-official plugin Cross-Site Scripting Vulnerabilities (04.12.2011) |
| | | advisory_(at)_htbridge.ch, Multiple vulnerabilities in OrangeHRM (04.12.2011) |
| | | advisory_(at)_htbridge.ch, Sql injection in SugarCRM (04.12.2011) |
| | | n0b0d13s_(at)_gmail.com, WikkaWiki <= 1.3.2 Multiple Security Vulnerabilities (04.12.2011) |
| | | Amir_(at)_irist.ir, Wordpress 1-jquery-photo-gallery-slideshow-flash plugin Cross-Site Scripting Vulnerabilities (04.12.2011) |
| | | Amir_(at)_irist.ir, Wordpress flash-album-gallery plugin Cross-Site Scripting Vulnerabilities (04.12.2011) |
| | | security_(at)_infoserve.de, PHP Inventory 1.3.1 Remote (Auth Bypass) SQL Injection Vulnerability (04.12.2011) |
| | | sschurtz_(at)_t-online.de, Ariadne 2.7.6 Multiple XSS vulnerabilities (04.12.2011) |
| | | noreply_(at)_ptsecurity.ru, [PT-2011-43] Database information disclosure in Kayako Fusion (04.12.2011) |
| | | MustLive, Multiple vulnerabilities in RoundCube (04.12.2011) |
| | | MustLive, Уязвимости в Zeema CMS (04.12.2011) |
| 3S CoDeSys multiple security vulnerabilities | | Published: | | 05.12.2011 | | Source: | | BUGTRAQ | | SecurityVulns ID: | | 12069 | | Type: | | remote | | Level: | | 5/10 | | Description: | | Buffer overflow, integer overflow, DoS conditions. |
| Oxide M0N0X1D3 HTTP server directory traversal | | Published: | | 05.12.2011 | | Source: | | BUGTRAQ | | SecurityVulns ID: | | 12070 | | Type: | | remote | | Level: | | 5/10 | | Description: | | There are multiple weays to download arbitrary files. |
| Siemens Automation License Manager multiple security vulnerabilities | | Published: | | 05.12.2011 | | Source: | | BUGTRAQ | | SecurityVulns ID: | | 12072 | | Type: | | remote | | Level: | | 6/10 | | Description: | | Code execution, unauthorized files access, DoS. |
| Siemens SIMATIC WinCC flexible multiple security vulnerabilities | | Published: | | 05.12.2011 | | Source: | | BUGTRAQ | | SecurityVulns ID: | | 12073 | | Type: | | remote | | Level: | | 5/10 | | Description: | | HmiLoad and miniweb multiple security vulnerabilities. |
RealNetworks RealPlayer multiple security vulnerabilities
updated since 05.12.2011 | | Published: | | 11.12.2011 | | Source: | | BUGTRAQ | | SecurityVulns ID: | | 12071 | | Type: | | client | | Level: | | 7/10 | | Description: | | Multiple vulnerabilities on different media formats parsing. |
| Affected: | | REAL : RealPlayer 14.0 | | | | REAL : Mac RealPlayer 12.0 | | CVE: | | CVE-2011-4260 (RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a malformed header in an MP4 file.) | | | | CVE-2011-4259 (Integer underflow in RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a crafted width value in an MPG file.) | | | | CVE-2011-4258 (RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a crafted length of an MLTI chunk in an IVR file.) | | | | CVE-2011-4256 (The RV30 codec in RealNetworks RealPlayer before 15.0.0 and Mac RealPlayer before 12.0.0.1703 does not initialize an unspecified index value, which allows remote attackers to execute arbitrary code via unknown vectors.) | | | | CVE-2011-4255 (Unspecified vulnerability in RealNetworks RealPlayer before 15.0.0 and Mac RealPlayer before 12.0.0.1703 allows remote attackers to execute arbitrary code via an invalid codec name.) | | | | CVE-2011-4253 (Unspecified vulnerability in the RV20 codec in RealNetworks RealPlayer before 15.0.0 and Mac RealPlayer before 12.0.0.1703 allows remote attackers to execute arbitrary code via unknown vectors.) | | | | CVE-2011-4252 (The RV10 codec in RealNetworks RealPlayer before 15.0.0 and Mac RealPlayer before 12.0.0.1703 allows remote attackers to execute arbitrary code via a crafted sample height.) | | | | CVE-2011-4251 (RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a crafted sample size in a RealAudio file.) | | | | CVE-2011-4250 (Unspecified vulnerability in the ATRC codec in RealNetworks RealPlayer before 15.0.0 and Mac RealPlayer before 12.0.0.1703 allows remote attackers to execute arbitrary code via unknown vectors.) | | | | CVE-2011-4248 (RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a malformed AAC file.) |
| Original document | | ZDI, ZDI-11-343 : RealNetworks RealPlayer mp4arender esds channel count Remote Code Execution Vulnerability (11.12.2011) |
| | | ZDI, ZDI-11-344 : RealNetworks RealPlayer RV20 Decoding Remote Code Execution Vulnerability (11.12.2011) |
| | | ZDI, ZDI-11-331 : RealNetwork RealPlayer MPG Width Integer Underflow Remote Code Execution Vulnerability (05.12.2011) |
| | | ZDI, ZDI-11-332 : RealNetworks RealPlayer Malformed AAC File Parsing Remote Code Execution Vulnerability (05.12.2011) |
| | | ZDI, ZDI-11-333 : RealNetworks RealPlayer ATRC Code Data Parsing Remote Code Execution Vulnerability (05.12.2011) |
| | | ZDI, ZDI-11-334 : RealNetworks RealPlayer genr Sample Size Parsing Remote Code Execution Vulnerability (05.12.2011) |
| | | ZDI, ZDI-11-335 : RealNetworks RealPlayer RV10 Sample Height Parsing Remote Code Execution Vulnerability (05.12.2011) |
| | | ZDI, ZDI-11-336 : RealNetworks RealPlayer Invalid Codec Name Remote Code Execution Vulnerability (05.12.2011) |
| | | ZDI, ZDI-11-337 : RealNetworks RealPlayer RV30 Uninitialized Index Value Remote Code Execution Vulnerability (05.12.2011) |
| | | ZDI, ZDI-11-338 : RealNetworks RealPlayer IVR MLTI Chunk Length Parsing Remote Code Execution Vulnerability (05.12.2011) |
|
|
|
|
|
|
|
|
