SQL Injection, Reflected XSS, Path Traversal, Function Execution in ZenPhoto 1.4.8

2015-07-10 Thread Tim Coen
Vulnerability: SQL Injection, Reflected XSS, Path Traversal Affected Software: ZenPhoto (http://www.zenphoto.org/) Affected Version: 1.4.8 (probably also prior versions) Patched Version: 1.4.9 Risk: Medium Vendor Contacted: 2015-05-18 Vendor Fix: 2015-07-09 Public Disclosure: 2015-07-10 SQL Inject

[security bulletin] HPSBGN03373 rev.1 - HP Release Control running TLS, Remote Disclosure of Information

2015-07-10 Thread security-alert
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c04740527 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04740527 Version: 1 HPSBGN03373 r

Cisco Security Advisory: OpenSSL Alternative Chains Certificate Forgery Vulnerability (July 2015) Affecting Cisco Products

2015-07-10 Thread Cisco Systems Product Security Incident Response Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Cisco Security Advisory: OpenSSL Alternative Chains Certificate Forgery Vulnerability (July 2015) Affecting Cisco Products Advisory ID: cisco-sa-20150710-openssl Revision 1.0 For Public Release 2015 July 10 16:00 UTC (GMT

[security bulletin] HPSBGN03351 rev.2 - HP IceWall SSO Dfw, SSO Certd, MCRP, and Federation Agent running OpenSSL, Remote Disclosure of Information

2015-07-10 Thread security-alert
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c04710027 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04710027 Version: 2 HPSBGN03351 r

[security bulletin] HPSBGN03371 rev.1 - HP IceWall Products running OpenSSL, Remote Denial of Service (DoS)

2015-07-10 Thread security-alert
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c04739301 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04739301 Version: 1 HPSBGN03371 r

ESA-2015-115: EMC RecoverPoint for Virtual Machines (VMs) Restriction Bypass Vulnerability

2015-07-10 Thread Security Alert
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ESA-2015-115: EMC RecoverPoint for Virtual Machines (VMs) Restriction Bypass Vulnerability EMC Identifier: ESA-2015-115 CVE Identifier: CVE-2015-4526 Severity Rating: CVSSv2 Base Score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C) Affected products: •

CVE-2014-7952, Android ADB backup APK injection vulnerability

2015-07-10 Thread Imre RAD
The Android operating system offers a backup/restore mechanism of installed packages through the ADB utility. Full backup of applications including the private files stored on /data partition is performed by default, but applications can customize this behavior by implementing a BackupAgent class.

NEW VMSA-2015-0005 : VMware Workstation, Player and Horizon View Client for Windows updates address a host privilege escalation vulnerability

2015-07-10 Thread VMware Security Response Center
VMware Security Advisory Advisory ID: VMSA-2015-0005 Synopsis:VMware Workstation, Player and Horizon View Client for Windows updates address a host privilege escalation vulnera

[SECURITY] [DSA 3307-1] pdns-recursor security update

2015-07-10 Thread Alessandro Ghedini
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-3307-1 secur...@debian.org https://www.debian.org/security/ Alessandro Ghedini July 09, 2015

[SECURITY] [DSA 3306-1] pdns security update

2015-07-10 Thread Alessandro Ghedini
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-3306-1 secur...@debian.org https://www.debian.org/security/ Alessandro Ghedini July 09, 2015

[slackware-security] openssl (SSA:2015-190-01)

2015-07-10 Thread Slackware Security Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 [slackware-security] openssl (SSA:2015-190-01) New openssl packages are available for Slackware 14.0, 14.1, and -current to fix a security issue. Here are the details from the Slackware 14.1 ChangeLog: +--+ patches/packages

FreeBSD Security Advisory FreeBSD-SA-15:12.openssl

2015-07-10 Thread FreeBSD Security Advisories
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 = FreeBSD-SA-15:12.opensslSecurity Advisory The FreeBSD Project Topic:

Cisco Security Advisory: Multiple Vulnerabilities in Cisco ASA Software

2015-07-10 Thread Cisco Systems Product Security Incident Response Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Multiple Vulnerabilities in Cisco ASA Software Advisory ID: cisco-sa-20141008-asa http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20141008-asa Revision 3.0 Last Updated 2015 July 8 21:04 UTC (GMT) For Public Releas

Extra information for CVE-2014-2513 - EMC Documentum Content Server: arbitrary code execution

2015-07-10 Thread andrew
Product: EMC Documentum Content Server Vendor: EMC Version: ANY CVE: N/A Risk: High Status: public/not fixed On November 2013 I discovered vulnerability in EMC Documentum Content Server which allow authenticated user to execute arbitrary commands using dm_bp_transition docbase method (for detaile

[SECURITY] [DSA 3305-1] python-django security update

2015-07-10 Thread Alessandro Ghedini
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-3305-1 secur...@debian.org https://www.debian.org/security/ Alessandro Ghedini July 08, 2015