[FD] XXE Injection in NetIQ Access

Hello list! I'll give you additional information concerning advisory Multiple high risk vulnerabilities in NetIQ Access Manager (http://securityvulns.ru/docs31510.html). There are five different vulnerabilities in the advisory. For my attack it's needed to use only one vulnerability, XML Exte

[FD] CollabNet Subversion Edge index local file inclusion

# Vuln Title: Local file inclusion in CollabNet Subversion Edge Management # Frontend via logfile "listViewItem" parameter of the "index" action # # Date: 28.06.2015 # Author: otr # Software Link: https://www.open.collab.net/downloads/svnedge # Vendor: CollabNet # Version: 4.0.11 # Tested on: Fedor

[FD] CollabNet Subversion Edge missing single login restriction

# Vuln Title: The CollabNet Subversion Edge management missing single login # restriction # # Date: 28.06.2015 # Author: otr # Software Link: https://www.open.collab.net/downloads/svnedge # Vendor: CollabNet # Version: 4.0.11 # Tested on: Fedora Linux # Type: No single login restriction # # Risk: L

[FD] CollabNet Subversion Edge weak password storage mechanism

# Vuln Title: The CollabNet Subversion Edge stores passwords as unsalted MD5 hashes # Date: 28.06.2015 # Author: otr # Software Link: https://www.open.collab.net/downloads/svnedge # Vendor: CollabNet # Version: 4.0.11 # Tested on: Fedora Linux # Type: Insecure password storage # Risk: Medium # St

[FD] CollabNet Subversion Edge missing XSRF protection

# Vuln Title: The CollabNet Subversion Edge Management Frontend does not implement XSRF protection tokens # # Date: 28.06.2015 # Author: otr # Software Link: https://www.open.collab.net/downloads/svnedge # Vendor: CollabNet # Version: 4.0.11 # Tested on: Fedora Linux # Type: XSRF # # Risk: Low # S

[FD] CollabNet Subversion Edge weak password policy

# Vuln Title: The CollabNet Subversion Edge Management Frontend does not # implement a strong password policy # # Date: 28.06.2015 # Author: otr # Software Link: https://www.open.collab.net/downloads/svnedge # Vendor: CollabNet # Version: 4.0.11 # Tested on: Fedora Linux # Type: Lack of defensive m

[FD] CollabNet Subversion Edge missing clickjacking protection

# Vuln Title: The CollabNet Subversion Edge Management Frontend does not # implement clickjacking protection # # Date: 28.06.2015 # Author: otr # Software Link: https://www.open.collab.net/downloads/svnedge # Vendor: CollabNet # Version: 4.0.11 # Tested on: Fedora Linux # Type: Clickjacking # # Ris

[FD] CollabNet Subversion Edge autocomplete on

# Vuln Title: The CollabNet Subversion Edge management frontend login page # password field has autocomplete enabled # # Date: 28.06.2015 # Author: otr # Software Link: https://www.open.collab.net/downloads/svnedge # Vendor: CollabNet # Version: 4.0.11 # Tested on: Fedora Linux # Type: Lack of defe

[FD] CollabNet Subversion Edge missing brute force protection

# Vuln Title: The CollabNet Subversion Edge does not protect against brute # forcing accounts # # Date: 28.06.2015 # Author: otr # Software Link: https://www.open.collab.net/downloads/svnedge # Vendor: CollabNet # Version: 4.0.11 # Tested on: Fedora Linux # Type: Lack of defensive measures # # Risk

[FD] CollabNet Subversion Edge insecure password change

# Vuln Title: The CollabNet Subversion Edge management frontend does not require # current password upon password change # # Date: 28.06.2015 # Author: otr # Software Link: https://www.open.collab.net/downloads/svnedge # Vendor: CollabNet # Version: 4.0.11 # Tested on: Fedora Linux # Type: Insecure

[FD] CollabNet Subversion Edge tail local file inclusion

# Vuln Title: Local file inclusion in CollabNet Subversion Edge Management # Frontend via logfile "fileName" parameter of the "tail" action # # Date: 28.06.2015 # Author: otr # Software Link: https://www.open.collab.net/downloads/svnedge # Vendor: CollabNet # Version: 4.0.11 # Tested on: Fedora Lin

[FD] CollabNet Subversion Edge show local file inclusion

# Vuln Title: Local file inclusion in CollabNet Subversion Edge Management # Frontend via "fileName" parameter of the show action # # Date: 10.10.2014 # Author: otr # Software Link: https://www.open.collab.net/downloads/svnedge # Vendor: CollabNet # Version: 4.0.11 # Tested on: Fedora Linux # Type:

[FD] CollabNet Subversion Edge downloadHook local file inclusion

# Vuln Title: Local file inclusion in CollabNet Subversion Edge Management # Frontend via logfile "filename" parameter of the "downloadHook" action # # Date: 28.06.2015 # Author: otr # Software Link: https://www.open.collab.net/downloads/svnedge # Vendor: CollabNet # Version: 4.0.11 # Tested on: Fe

[FD] CollabNet Subversion Edge Password Hash Leak

# Vuln Title: The CollabNet Subversion Edge Management frontend user credential # (hash) leak # # Date: 28.06.2015 # Author: otr # Software Link: https://www.open.collab.net/downloads/svnedge # Vendor: CollabNet # Version: 4.0.11 # Tested on: Fedora Linux # Type: Credential leak # # Risk: Medium #

[FD] CollabNet Subversion Edge Hook Script Privilege Escalation

# Vuln Title: The CollabNet Subversion Edge Management Frontend SVN hook scripts # privilege escalation # # Date: 28.06.2015 # Author: otr # Software Link: https://www.open.collab.net/downloads/svnedge # Vendor: CollabNet # Version: 4.0.11 # Tested on: Fedora Linux # Type: Privilege escalation desi

[FD] Courier mail server: Write heap overflow in mailbot tool and out of bounds heap read in imap folder parser

https://blog.fuzzing-project.org/17-Courier-mail-server-Write-heap-overflow-in-mailbot-tool-and-out-of-bounds-heap-read-in-imap-folder-parser.html Two memory access issues were found in the Courier mail server. These issues were discovered by compiling the software with Address Sanitizer (-fsaniti

[FD] Watchguard XCS Multiple Vulnerabilities

(, ) (, . '.' ) ('.', ). , ('. ( ) ( (_,) .'), ) _ _, / _/ / _ \ _ \ \==/ /_\ \ _/ ___\/ _ \ / \ / \/ |\\ \__( <_> ) Y Y \ /__ /\___|__ / \___ >/|__|_| / \/ \/.-.\/ \/:wq

[FD] WedgeOS Multiple Vulnerabilities

(, ) (, . '.' ) ('.', ). , ('. ( ) ( (_,) .'), ) _ _, / _/ / _ \ _ \ \==/ /_\ \ _/ ___\/ _ \ / \ / \/ |\\ \__( <_> ) Y Y \ /__ /\___|__ / \___ >/|__|_| / \/ \/.-.\/ \/:wq