[security bulletin] HPSBOV03318 rev.1 - HP SSL for OpenVMS, Remote Denial of Service (DoS) and other Vulnerabilities

2015-04-13 Thread security-alert
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c04635715 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04635715 Version: 1 HPSBOV03318 r

[security bulletin] HPSBHF03310 rev.2 - HP Thin Clients running Windows Embedded Standard 7 (WES7) or Windows Embedded Standard 2009 (WES09) with HP Easy Deploy, Remote Elevation of Privilege, Executi

2015-04-13 Thread security-alert
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c04629160 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04629160 Version: 2 HPSBHF03310 r

Apache HTTPD 2.4.12, 2.2.29 Security Audit - Advanced Information Security Corp

2015-04-13 Thread lem . nikolas
-=[Advanced Information Security Corp]=- Author: Nicholas Lemonias Advisory Date: 13/4/2015 Email: lem.nikolas (at) gmail (dot) com Introduction == During a source-code audit of the Apache HTTPD 2.2.29 release implementation for linux; conducted internally by the Advanced Information Secu

Apache HTTPD 2.4.12/ 2.2.29 Security Audit Notes - Advanced Information Security Corp

2015-04-13 Thread Nicholas Lemonias.
-=[Advanced Information Security Corp]=- Author: Nicholas Lemonias Advisory Date: 13/4/2015 Email: lem.nikolas (at) gmail (dot) com Introduction == During a source-code audit of the Apache HTTPD 2.2.29 release implementation for linux; conducted internally by the Advanced Information Secu

Ruxcon 2015 Call For Presentations

2015-04-13 Thread cfp
Ruxcon 2015 Call For Presentations Melbourne, Australia, October 24-25 CQ Function Centre http://www.ruxcon.org.au The Ruxcon team is pleased to announce the first round of Call For Presentations for Ruxcon 2015. This year the conference will take place over the weekend of the 24th and 25th of

[SECURITY] [DSA 3224-1] libx11 security update

2015-04-13 Thread Moritz Muehlenhoff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - Debian Security Advisory DSA-3224-1 secur...@debian.org http://www.debian.org/security/Moritz Muehlenhoff April 12, 2015

[SECURITY] [DSA 3223-1] ntp security update

2015-04-13 Thread Alessandro Ghedini
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-3223-1 secur...@debian.org http://www.debian.org/security/Alessandro Ghedini April 12, 2015

[SECURITY] [DSA 3222-1] chrony security update

2015-04-13 Thread Alessandro Ghedini
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-3222-1 secur...@debian.org http://www.debian.org/security/Alessandro Ghedini April 12, 2015

[SECURITY] [DSA 3221-1] das-watchdog security update

2015-04-13 Thread Salvatore Bonaccorso
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-3221-1 secur...@debian.org http://www.debian.org/security/ Salvatore Bonaccorso April 12, 2015

Safari iOS/OS X/Windows cookie access vulnerability

2015-04-13 Thread Jouko Pynnonen
OVERVIEW == The 4/8/2015 security updates from Apple included a patch for a Safari cross-domain vulnerability. An attacker could create web content which, when viewed by a target user, bypasses some of the normal cross-domain restrictions to access or modify HTTP cookies belonging to any w

[SECURITY] [DSA 3220-1] libtasn1-3 security update

2015-04-13 Thread Salvatore Bonaccorso
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-3220-1 secur...@debian.org http://www.debian.org/security/ Salvatore Bonaccorso April 11, 2015

Hijacking any Weebly Website [Insecure Direct Object Reference Vulnerability]

2015-04-13 Thread huehuehuehue10
Title: Hijack any website from weebly.com by just adding an administrator to their website. [Insecure Direct Object Reference Vulnerability] = Weebly is a web-hosting service that allows the user to “drag-and-drop” while using their website builder. As of August 2012, Weebly hosts over 20 m

[SECURITY] [DSA 3219-1] libdbd-firebird-perl security update

2015-04-13 Thread Alessandro Ghedini
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-3219-1 secur...@debian.org http://www.debian.org/security/Alessandro Ghedini April 11, 2015

OrangeHRM Blind SQL Injection & XSS Vulnerabilities

2015-04-13 Thread Rehan Ahmed
I. Overview OrangeHRM (Opensource 3.2.1, Professional & Enterprise 4.11) are prone to a multiple Blind SQL injection & XSS vulnerabilities. These vulnerabilities allows an attacker to inject SQL commands to compromise the affected databas

[ MDVSA-2015:203 ] batik

2015-04-13 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2015:203 http://www.mandriva.com/en/support/security/ __

[security bulletin] HPSBGN03316 rev.1 - HP Support Solution Framework on Windows, Remote Execution of Code, Disclosure of Information

2015-04-13 Thread security-alert
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c04634535 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04634535 Version: 1 HPSBGN03316 r

[SECURITY] [DSA 3218-1] wesnoth-1.10 security update

2015-04-13 Thread Moritz Muehlenhoff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - Debian Security Advisory DSA-3218-1 secur...@debian.org http://www.debian.org/security/Moritz Muehlenhoff April 10, 2015

Hidden backdoor API to root privileges in Apple OS X

2015-04-13 Thread Jeffrey Walton
https://truesecdev.wordpress.com/2015/04/09/hidden-backdoor-api-to-root-privileges-in-apple-os-x/ The Admin framework in Apple OS X contains a hidden backdoor API to root privileges. It’s been there for several years (at least since 2011), I found it in October 2014 and it can be exploited to esca

SEC Consult SA-20150410-0 :: Unauthenticated Local File Disclosure in multiple TP-LINK products (CVE-2015-3035)

2015-04-13 Thread SEC Consult Vulnerability Lab
SEC Consult Vulnerability Lab Security Advisory < 20150410-0 > === title: Unauthenticated Local File Disclosure product: Multiple TP-LINK products (see Vulnerable / tested versions) vulnerable version: M

[ MDVSA-2015:201 ] arj

2015-04-13 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2015:201 http://www.mandriva.com/en/support/security/ __

[ MDVSA-2015:202 ] ntp

2015-04-13 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2015:202 http://www.mandriva.com/en/support/security/ __

[ MDVSA-2015:200 ] mediawiki

2015-04-13 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2015:200 http://www.mandriva.com/en/support/security/ __

[ MDVSA-2015:199 ] less

2015-04-13 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2015:199 http://www.mandriva.com/en/support/security/ __