libXp: Integer overflow leading to heap-based buffer overflow

Multiple integer overflows in X.org libXp 1.0.1 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the 1 XpGetAttributes, 2 XpGetOneAttribute, 3 XpGetPrinterList, and 4 XpQueryScreens functions...

PT-2014-1929

Name of the Vulnerable Software and Affected Versions MIT Kerberos 5 versions prior to 1.13 Description The issue allows remote authenticated users to forge tickets by leveraging administrative access. This is due to the kadm5 randkey principal 3 function in lib/kadm5/srv/svr principal.c in kadmi...

CVE-2014-7205

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for the hapi server framework for Node.js allows remote attackers to execute arbitrary Javascript code via unspecified vectors...

CVE-2014-7205

The Bassmaster Node.js plugin for the Hapi server contains CVE-2014-7205: an eval-based injection in the internals.batch function (lib/batch.js) before version 1.5.2, enabling remote arbitrary JavaScript execution. Documents show affected version range is bassmaster

CVE-2014-5308

Multiple SQL injection vulnerabilities in TestLink 1.9.11 allow remote authenticated users to execute arbitrary SQL commands via the 1 name parameter in a Search action to lib/project/projectView.php or 2 id parameter to lib/events/eventinfo.php...

CVE-2014-5308: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in TestLink 1.9.11 allow remote authenticated users to execute arbitrary SQL commands via the 1 name parameter in a Search action to lib/project/projectView.php or 2 id parameter to lib/events/eventinfo.php...

PT-2014-7837

Name of the Vulnerable Software and Affected Versions bassmaster versions prior to 1.5.2 Description The issue allows remote attackers to execute arbitrary Javascript code via unspecified vectors, due to an eval injection vulnerability in the internals.batch function in lib/batch.js. This...

CVE-2014-7205: Improper Control of Generation of Code

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for the hapi server framework for Node.js allows remote attackers to execute arbitrary Javascript code via unspecified vectors...

CVE-2014-3631

The assocarraygc function in the associative-array implementation in lib/assocarray.c in the Linux kernel before 3.16.3 does not properly implement garbage collection, which allows local users to cause a denial of service NULL pointer dereference and system crash or possibly have unspecified othe...

PT-2014-2229

Name of the Vulnerable Software and Affected Versions OrangeHRM versions prior to 2.7 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the hspSummaryId parameter to the "plugins/ajaxCalls/haltResumeHsp.php" endpoint, specifically...

WS-2014-0042

In “moby/moby”, v0.11.0 to v1.2.0 there is a vulnerability as a result of bad management of containers’ privileges, that allows them to read/write content to “/var/lib/docker”...

CVE-2014-5247

The UpgradeBeforeConfigurationChange function in lib/client/gntcluster.py in Ganeti 2.10.0 before 2.10.7 and 2.11.0 before 2.11.5 uses world-readable permissions for the configuration backup file, which allows local users to obtain SSL keys, remote API credentials, and other sensitive information...

PT-2014-6363

Name of the Vulnerable Software and Affected Versions Ganeti versions 2.10.0 through 2.10.6 Ganeti versions 2.11.0 through 2.11.4 Description The issue allows local users to obtain sensitive information, including SSL keys and remote API credentials, by reading a configuration backup file. This i...

CVE-2014-5247: Undefined Security Weakness

The UpgradeBeforeConfigurationChange function in lib/client/gntcluster.py in Ganeti 2.10.0 before 2.10.7 and 2.11.0 before 2.11.5 uses world-readable permissions for the configuration backup file, which allows local users to obtain SSL keys, remote API credentials, and other sensitive information...

CVE-2014-5261

The graph settings script graphsettings.php in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a font size, related to the rrdtool commandline in lib/rrd.php...

Code injection

The graph settings script graphsettings.php in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a font size, related to the rrdtool commandline in lib/rrd.php...

CVE-2014-5261

The graph settings script graphsettings.php in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a font size, related to the rrdtool commandline in lib/rrd.php...

CVE-2014-5261: Improper Control of Generation of Code

The graph settings script graphsettings.php in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a font size, related to the rrdtool commandline in lib/rrd.php...

openSUSE Security Update : - Update to version neutron-2013.2.4.dev84.gbe0c1d1 (openSUSE-SU-2014:1051-1)

Update to version neutron-2013.2.4.dev84.gbe0c1d1 : - Fix getvifportbyid to only return relevant ports - Update to version neutron-2013.2.4.dev82.gd1a9a9d : - LBaaS add missing rootwrap filter for route - NVP plugin:fix delete sec group when backend is out of sync - Kill 'Skipping unknown group...

PT-2014-6375

Name of the Vulnerable Software and Affected Versions Cacti versions 0.8.8b and earlier Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in a font size, related to the rrdtool commandline in lib/rrd.php. This is due to a problem in the graph...