[SECURITY] CVE-2014-7810: Apache Tomcat Security Manager Bypass

2015-05-14 Thread Mark Thomas
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 CVE-2014-7810 Security Manager Bypass Severity: Moderate Vendor: The Apache Software Foundation Versions Affected: - - Apache Tomcat 8.0.0-RC1 to 8.0.15 - - Apache Tomcat 7.0.0 to 7.0.57 - - Apache Tomcat 6.0.0 to 6.0.43 Description: Malicious we

SEC Consult SA-20150514-0 :: Multiple vulnerabilities in Loxone Smart Home (part 2)

2015-05-14 Thread SEC Consult Vulnerability Lab
SEC Consult Vulnerability Lab Security Advisory < 20150514-0 > === title: Multiple vulnerabilities product: Loxone Smart Home vulnerable version: Firmware version <6.4.5.12 fixed version:

Sidu 5.2 Admin XSS Vulnerability

2015-05-14 Thread apparitionsec
Affected Vendor: www.topnew.net/sidu/ Credits: John Page ( hyp3rlinx ) Domains: hyp3rlinx.altervista.org Source: http://hyp3rlinx.altervista.org/advisories/AS-SIDU0513.txt Product: Sidu version 5.2 is a web based database front-end administration tool. Advisory Information: =

Certificate trust vulnerability in Websense Content Gateway

2015-05-14 Thread Steve Shockley
SUMMARY Websense Content Gateway proxy explicitly trusts compromised certificate authorities Affected versions: Content Gateway 7.8.x Not affected: Content Gateway 7.7.x, 8.0 DESCRIPTION Websense Content Gateway is a filtering web proxy and content inspection application based on a modified I