Cross-site scripting (XSS) vulnerability in the SimpleCorp theme 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the “administer themes” permission to inject arbitrary web script or HTML via vectors related to theme settings.
CVE-2014-7980 (zen)
Multiple cross-site scripting (XSS) vulnerabilities in template.php in Zen theme 7.x-3.x before 7.x-3.3 and 7.x-5.x before 7.x-5.5 for Drupal allow remote authenticated users with the “administer themes” permission to inject arbitrary web script or HTML via the skip_link_text setting and unspecified other theme settings.
SAP Business Objects Information Disclosure Via CORBA
Onapsis Security Advisory – Business Objects CORBA listeners include the ability to run unauthenticated InfoStore queries via CORBA. Although some authorization is enforced, it is possible to obtain a considerable amount of information by making requests to the InfoStore via CORBA.
SAP HANA Reflective Cross Site Scripting
Onapsis Security Advisory – The SAP HANA Developer Edition contains multiple reflected cross site scripting vulnerabilities (XSS) in the democontent area.
BMC Track-it! Remote Code Execution / SQL Injection
BMC Track-it! suffers from code execution, arbitrary file download, and remote SQL injection vulnerabilities.
Re: Yahoo! hacked on October 5, 2014…
Posted by illwill on Oct 08
Cisco Releases Security Advisory for ASA Software
Original release date: October 08, 2014
Cisco has released an advisory to address multiple vulnerabilities in the Cisco Adaptive Security Appliance (ASA) Software that could result in a denial of service condition. Cisco has released free software updates that address these vulnerabilities.
Users and administrators are encouraged to review the Cisco Advisory and apply the necessary updates.
This product is provided subject to this Notification and this Privacy & Use policy.
CVE-2014-5308 (testlink)
Multiple SQL injection vulnerabilities in TestLink 1.9.11 allow remote authenticated users to execute arbitrary SQL commands via the (1) name parameter in a Search action to lib/project/projectView.php or (2) id parameter to lib/events/eventinfo.php.
CVE-2014-7205 (bassmaster_plugin)
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for the hapi server framework for Node.js allows remote attackers to execute arbitrary Javascript code via unspecified vectors.
CVE-2014-7185 (python)
Integer overflow in bufferobject.c in Python before 2.7.8 allows context-dependent attackers to obtain sensitive information from process memory via a large size and offset in a “buffer” function.