EMC Avamar: World writable cache files

2012-12-19 Thread fulldisclosure
Product: Avamar backup client for Linux (Proberly also Unix but not tested) Vendor: EMC (http://www.emc.com) Tested version: 6.1.100-402 (Latest) Vendor Notification: December 17, 2012 Vender Patch: None Vender Workaround: workaround is to run a script at the end of each backup which set the files

Multiple XSS vulnerabilities in Cerberus FTP Server <= 5.0.5.1 [CVE-2012-6339]

2012-12-19 Thread Ken
Overview === Cerberus FTP Server (http://www.cerberusftp.com/) is a secure and reliable FTP server with many features and available functionality. It was discovered that the Web Administration interface has multiple persistent Cross Site Scripting (XSS) vulnerabilities. In the log view

[ MDVSA-2012:181 ] python-django

2012-12-19 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2012:181 http://www.mandriva.com/security/ _

Multiple vulnerabilities in Banana Dance

2012-12-19 Thread advisory
Advisory ID: HTB23118 Product: Banana Dance Vendor: bananadance.org Vulnerable Version(s): B.2.6 and probably prior Tested Version: B.2.6 Vendor Notification: October 3, 2012 Public Disclosure: December 19, 2012 Vulnerability Type: PHP File Inclusion [CWE-98], Improper Access Control [CWE-284],

Firefly MediaServer Multiple Remote DoS Vulnerabilities

2012-12-19 Thread advisory
Advisory ID: HTB23129 Product: FireFly Mediaserver Vendor: FireFly Vulnerable Version(s): 1.0.0.1359 and probably prior Tested Version: 1.0.0.1359 in Windows 7 SP1 Vendor Notification: November 21, 2012 Public Disclosure: December 19, 2012 Vulnerability Type: NULL Pointer Dereference [CWE-476] CV

Multiple SQL Injection Vulnerabilities in Elite Bulletin Board

2012-12-19 Thread advisory
Advisory ID: HTB23133 Product: Elite Bulletin Board Vendor: elite-board.us Vulnerable Version(s): 2.1.21 and probably prior Tested Version: 2.1.21 Vendor Notification: November 28, 2012 Vendor Patch: December 6, 2012 Public Disclosure: December 19, 2012 Vulnerability Type: SQL Injection [CWE-89]

Local root exploit for Centrify Deployment Manager < v2.1.0.283 local root

2012-12-19 Thread larry0
/*Local root exploit for Centrify Deployment Manager v2.1.0.283 local root, Centrify released a fix very quickly - nice vendor response. http://vapid.dhs.org/exploits/centrify_local_r00t.c CVE-2012-6348 12/17/2012 http://vapid.dhs.org/advisories/centrify_deployment_manager_insecure_tmp2.html Gr

Enterpriser16 LoadBalancer v7.1 - Multiple Web Vulnerabilities

2012-12-19 Thread Vulnerability Lab
Title: == Enterpriser16 LB v7.1 - Multiple Web Vulnerabilities Date: = 2012-12-12 References: === http://www.vulnerability-lab.com/get_content.php?id=785 VL-ID: = 785 Common Vulnerability Scoring System: 3.5 Introduction: ==

SonicWall SonicOS 5.8.1.8 WAF - POST Inject Vulnerability

2012-12-19 Thread Vulnerability Lab
Title: == SonicWall SonicOS 5.8.1.8 WAF - POST Inject Vulnerability Date: = 2012-12-18 References: === http://www.vulnerability-lab.com/get_content.php?id=769 Sonicwall Bug ID [SBID]: 123995 VL-ID: = 769 Common Vulnerability Scoring System: =

Microsoft Internet Explorer 9.x <= Remote Stack Overflow Vulnerability

2012-12-19 Thread pereira
--- Microsoft Internet Explorer 9.x <= Remote Stack Overflow Vulnerability --- Author: Jean Pascal Pereira Vendor: Microsoft Internet Explorer 9.x and below De