Fedora 17 : gegl-0.2.0-11.fc17 (2013-12075)

This update contains the following changes : - Fix buffer overflow in and add plausibility checks to the ppm-load operation. - Fix multi-lib issue where content of generated documentation could differ between architectures. Note that Tenable Network Security has extracted the preceding descriptio...

Fedora 19 : gegl-0.2.0-11.fc19 (2013-12115)

This update contains the following changes : - Fix buffer overflow in and add plausibility checks to the ppm-load operation. - Fix multi-lib issue where content of generated documentation could differ between architectures. Note that Tenable Network Security has extracted the preceding descriptio...

CVE-2014-2538 rubygem rack-ssl: URL error display XSS

Cross-site scripting XSS vulnerability in lib/rack/ssl.rb in the rack-ssl gem before 1.4.0 for Ruby allows remote attackers to inject arbitrary web script or HTML via a URI, which might not be properly handled by third-party adapters such as JRuby-Rack...

CVE-2013-2116: Improper Input Validation

The gnutlsciphertext2compressed function in lib/gnutlscipher.c in GnuTLS 2.12.23 allows remote attackers to cause a denial of service buffer over-read and crash via a crafted padding length. NOTE: this might be due to an incorrect fix for CVE-2013-0169...

DEBIAN-CVE-2013-1990

Multiple integer overflows in X.org libXvMC 1.0.7 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the 1 XvMCListSurfaceTypes and 2 XvMCListSubpictureTypes functions...

Fedora Update for step FEDORA-2013-10130

Check for the Version of step OpenVAS Vulnerability Test Fedora Update for step FEDORA-2013-10130 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms o...

Cross site request forgery (csrf)

The MoodleQuickForm class in lib/formslib.php in Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly handle a certain array-element syntax, which allows remote attackers to bypass intended form-data filtering via a crafted request...

PT-2013-3537

Name of the Vulnerable Software and Affected Versions Moodle versions prior to 2.1.11 Moodle versions 2.2.x prior to 2.2.10 Moodle versions 2.3.x prior to 2.3.7 Moodle versions 2.4.x prior to 2.4.4 Description The issue arises from the improper handling of a certain array-element syntax by the...

CVE-2012-6563

engine/lib/access.php in Elgg before 1.8.5 does not properly clear cached access lists during plugin boot, which allows remote attackers to read private entities via unspecified vectors...

CVE-2012-6561

Cross-site scripting XSS vulnerability in engine/lib/views.php in Elgg before 1.8.5 allows remote attackers to inject arbitrary web script or HTML via the view parameter to index.php. NOTE: some of these details are obtained from third party information...

CVE-2012-6562

engine/lib/users.php in Elgg before 1.8.5 does not properly specify permissions for the useradd action, which allows remote attackers to create arbitrary accounts...

PT-2013-2017

Name of the Vulnerable Software and Affected Versions Elgg versions prior to 1.8.5 Description The issue arises from improper clearing of cached access lists during plugin boot in the engine/lib/access.php file. This allows remote attackers to read private entities via unspecified vectors...

CVE-2012-6562: Undefined Security Weakness

engine/lib/users.php in Elgg before 1.8.5 does not properly specify permissions for the useradd action, which allows remote attackers to create arbitrary accounts...

CVE-2012-6563: Undefined Security Weakness

engine/lib/access.php in Elgg before 1.8.5 does not properly clear cached access lists during plugin boot, which allows remote attackers to read private entities via unspecified vectors...

PT-2013-2016

Name of the Vulnerable Software and Affected Versions Elgg versions prior to 1.8.5 Description The issue is related to improper permission specification for the useradd action in the engine/lib/users.php file. This allows remote attackers to create arbitrary accounts. Recommendations For versions...

CVE-2012-6561: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in engine/lib/views.php in Elgg before 1.8.5 allows remote attackers to inject arbitrary web script or HTML via the view parameter to index.php. NOTE: some of these details are obtained from third party information...

Multiple SQL injection - ownCloud

ownCloud before 5.0.6 does not neutralize special elements that are passed to the SQL query in lib/db.php which therefore allows an authenticated attacker to execute arbitrary SQL commands. CVE-2013-2045 ownCloud before 5.0.6 and 4.5.11 does not neutralize special elements that are passed to the...

Server: Multiple SQL injection

ownCloud before 5.0.6 does not neutralize special elements that are passed to the SQL query in lib/db.php which therefore allows an authenticated attacker to execute arbitrary SQL commands. CVE-2013-2045 ownCloud before 5.0.6 and 4.5.11 does not neutralize special elements that are passed to the...

PT-2013-3477

Name of the Vulnerable Software and Affected Versions Karteek Docsplit karteek-docsplit gem version 0.5.4 Description The issue allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a PDF filename. This is due to a problem in the extract from ocr function in...

CVE-2013-1898: Improper Control of Generation of Code

lib/thumbshooter.rb in the Thumbshooter 0.1.5 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL...