Category Archives: Security

Security

Full Disclosure

CVE-2014-2230 – OpenX Open Redirect Vulnerability

Posted by Jing Wang on Oct 16

Exploit Title: OpenX Open Redirect Vulnerability
Product: OpenX
Vendor: OpenX
Vulnerable Versions: 2.8.10 and probably prior
Tested Version: 2.8.10
Advisory Publication: OCT 8, 2014
Latest Update: OCT 8, 2014
Vulnerability Type: Open Redirect [CWE-601]
CVE Reference: CVE-2014-2230
Risk Level: Low
CVSSv2 Base Score: 2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N)
Solution Status: Solution Available
Credit: Wang Jing [Mathematics, Nanyang Technological…

CentOS

CESA-2014:1647 Important CentOS 5 thunderbirdSecurity Update

CentOS Errata and Security Advisory 2014:1647 Important

Upstream details at : https://rhn.redhat.com/errata/RHSA-2014-1647.html

The following updated files have been uploaded and are currently 
syncing to the mirrors: ( sha256sum Filename ) 

i386:
bc59af1c3aa2950614736db2e2e1e1596eb77228a98ac4a83fec2735e6a58257  thunderbird-31.2.0-2.el5.centos.i386.rpm

x86_64:
b3065ffa9bbe359d2b810a2c7ac3eb702966e4c37cb638b69229019965584992  thunderbird-31.2.0-2.el5.centos.x86_64.rpm

Source:
0c0305b9aedc7ced272157b8582dfa756f4db974dc4d5bdb394b02a0fe489cb0  thunderbird-31.2.0-2.el5.centos.src.rpm
NVD

CVE-2014-7237

lib/TWiki/Sandbox.pm in TWiki 6.0.0 and earlier, when running on Windows, allows remote attackers to bypass intended access restrictions and upload files with restricted names via a null byte (%00) in a filename to bin/upload.cgi, as demonstrated using .htaccess to execute arbitrary code.

NVD

CVE-2014-3704

The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.

NVD

CVE-2014-3686

wpa_supplicant and hostapd 0.7.2 through 2.2, when running with certain configurations and using wpa_cli or hostapd_cli with action scripts, allows remote attackers to execute arbitrary commands via a crafted frame.