October 30, 2014

Security Advisory – SOS-14-001 – Cisco CUCDM IP Phone Services Multiple Vulnerabilities

The security vulnerabilities found in the IP phone services of the Cisco Unified Communications Domain Manager (a.k.a. CUCDM or VOSS Solutions Domain Manager) can be used to obtain unauthorised...

October 30, 2014

Security Advisory – SOS-14-002 – Cisco CUCDM Administration Portal Multiple Vulnerabilities

Multiple high risk security vulnerabilities were detected in the administration portal of the Cisco Unified Communications Domain Manager (a.k.a. CUCDM or VOSS Solutions Domain Manager). The security vulnerabilities can be used...

September 10, 2013

Security Advisory – SOS-13-003 – Juniper Junos J-Web Privilege Escalation Vulnerability

The J-Web is a GUI based network management application used on Junos devices. The web application is vulnerable to a remote code execution vulnerability which permits privilege escalation. ...

April 29, 2013

Security Advisory – SOS-13-002 – Mi-Token Enterprise Edition & API Edition – Brute-Force Vulnerability

The Mi-Token Two-Factor Authentication (2FA) system before version (4.3.6) does not implement rate-limiting or lockout on One-Time-Password (OTP) verification attempts....

April 3, 2013

Security Advisory – SOS-13-001 – Google Active Directory Sync Tool – Exposure of Sensitive Information Vulnerability

Due to a weakness in the way the Java encryption algorithm (PBEwithMD5andDES) has been implemented in the Google Active Directory Sync tool all stored credentials can be decrypted into plain-text....

November 30, 2012

Security Advisory – SOS-12-011 – SilverStripe CMS Multiple Vulnerabilities

SilverStripe CMS is an open source web content management system used to build websites, intranets, and web applications. ...

October 10, 2012

Security Advisory – SOS-12-010 – FileBound Privilege Escalation Vulnerability

The FileBound On-Site document management application is vulnerable to a privilege escalation attack by sending a modified password request to the FileBound web service....

September 5, 2012

Security Advisory – SOS-12-009 – Ektron CMS – Multiple Vulnerabilities

The web application is vulnerable to multiple security vulnerabilities, such as unauthenticated file upload and XML eXternal Entities (XXE) injection....

August 24, 2012

Security Advisory – SOS-12-008 – Elcom CMS – Community Manger Insecure File Upload Vulnerability

The https://[server]/UploadStyleSheet.aspx script does not validate the file type passed in the parameter “myfile0” on the server side allowing the uploading and execution of ASPX files. ...

June 14, 2012

Security Advisory – SOS-12-007 – Squiz Matrix – Multiple Vulnerabilities

The Squiz Matrix web application is vulnerable to multiple security vulnerabilities, such as XML eXternal Entities (XXE) injection and Cross-Site Scripting (XSS)....

June 13, 2012

Security Advisory – SOS-12-006 – QNAP Turbo NAS – Multiple Vulnerabilities

QNAP provide NAS technology solutions to consumers and enterprises. Multiple vulnerabilities have been identified in the web management interface....

May 13, 2012

Security Advisory – SOS-12-005 – NETGEAR WNDRMAC Exposure of Sensitive Information Vulnerability

The NETGEAR Wireless Extreme for Mac computer and PCs (WNDRMAC) is a N600 wireless dual-band gigabit router. ...

March 12, 2012

Security Advisory – SOS-12-004 – Aurora WebOPAC SQL Injection Vulnerability

Aurora WebOPAC is an online library system which allows users to perform tasks, such as reservations, renewal of books, search the catalogue, etc....

March 7, 2012

Security Advisory – SOS-12-003 – Iciniti Store SQL Injection Vulnerability

Iciniti Store is a web application providing e-commerce and payment solutions. ...

March 5, 2012

Security Advisory – SOS-12-002 – Symfony2 Local File Disclosure

The XMLEncoder component of Symfony 2.0.x fails to disable external entities when parsing XML. ...

February 23, 2012

Security Advisory – SOS-12-001 – Snom IP Phone Privilege Escalation Vulnerability

The Snow IP Phone privilege escalation is possible because the form used to login as the admin user is the same form for resetting the admin password, and the user...