libvirt security and bug fix update

0.10.2-18.0.1.el64.5 - Replace docs/et.png in tarball with blank image 0.10.2-18.el64.5 - daemon: Fix leak after listing volumes CVE-2013-1962 - Don't try to add non-existant devices to ACL rhbz958837 - Avoid spamming logs with cgroups warnings rhbz958837 - audit: Properly encode device path in...

CVE-2013-3238

phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3 allows remote authenticated users to execute arbitrary code via a /e\x00 sequence, which is not properly handled before making a pregreplace function call within the "Replace table prefix" feature...

CVE-2013-3238: Undefined Security Weakness

phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3 allows remote authenticated users to execute arbitrary code via a /e\x00 sequence, which is not properly handled before making a pregreplace function call within the "Replace table prefix" feature...

PT-2013-4244

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 3.5.x through 3.5.7 phpMyAdmin versions 4.x through 4.0.0-rc2 Description The issue allows remote authenticated users to execute arbitrary code via a /ex00 sequence. This sequence is not properly handled before making a pre...

User Authentication Vulnerability in Operational Management Function of Cosminexus

Overview The operational management function of Cosminexus does not properly require authentication for manipulation of an operational management portal, which allows remote attackers to delete and replace applications which other users attached. Impact A remote attacker could delete and replace...

MS IE Information Disclosure and Web Site Spoofing Vulnerabilities

This host is installed with Microsoft Internet Explorer and is prone to information disclosure and web site spoofing vulnerabilities. OpenVAS Vulnerability Test $Id: gbmsieinfodiscnspoofvuln.nasl 6104 2017-05-11 09:03:48Z teissa $ MS IE Information Disclosure and Web Site Spoofing Vulnerabilities...

Buffalo TeraStation Multiple Security Vulnerabilities (Jan 2013)

Buffalo TeraStation is prone to an arbitrary file download and an arbitrary command-injection vulnerability because it fails to sufficiently sanitize user-supplied data. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyrigh...

CVE-2013-0005

The WCF Replace function in the Open Data aka OData protocol implementation in Microsoft .NET Framework 3.5, 3.5 SP1, 3.5.1, and 4, and the Management OData IIS Extension on Windows Server 2012, allows remote attackers to cause a denial of service resource consumption and daemon restart via craft...

CVE-2013-0005

The WCF Replace function in the Open Data aka OData protocol implementation in Microsoft .NET Framework 3.5, 3.5 SP1, 3.5.1, and 4, and the Management OData IIS Extension on Windows Server 2012, allows remote attackers to cause a denial of service resource consumption and daemon restart via craft...

CVE-2013-0005: Improper Input Validation

The WCF Replace function in the Open Data aka OData protocol implementation in Microsoft .NET Framework 3.5, 3.5 SP1, 3.5.1, and 4, and the Management OData IIS Extension on Windows Server 2012, allows remote attackers to cause a denial of service resource consumption and daemon restart via craft...

Cisco DPC2420 Cross Site Scripting / File Disclosure

Cisco DPC2420 router is prone to a file disclosure and to a XSS vulnerability because it fails to sufficiently sanitize user supplied data. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

DEBIAN-CVE-2012-3512

Munin before 2.0.6 stores plugin state files that run as root in the same group-writable directory as non-root plugins, which allows local users to execute arbitrary code by replacing a state file, as demonstrated using the smart plugin...

PT-2012-5835

Name of the Vulnerable Software and Affected Versions vBSEO versions 3.5.0 through 3.6.0 and earlier Description The issue allows remote attackers to insert and execute arbitrary PHP code via "complex curly syntax" in the char repl parameter. This parameter is inserted into a regular expression...

PT-2012-3872

Name of the Vulnerable Software and Affected Versions IBM DB2 versions 9.1 before FP12 IBM DB2 versions 9.5 through FP9 IBM DB2 versions 9.7 through FP6 IBM DB2 versions 9.8 through FP5 IBM DB2 versions 10.1 Description A directory traversal issue exists in the SQLJ.DB2 INSTALL JAR stored...

CVE-2012-2194: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the SQLJ.DB2INSTALLJAR stored procedure in IBM DB2 9.1 before FP12, 9.5 through FP9, 9.7 through FP6, 9.8 through FP5, and 10.1 allows remote attackers to replace JAR files via unspecified vectors...

Mozilla: Use-after-free while replacing/inserting a node in a document (MFSA 2012-38)

Use-after-free vulnerability in the nsINode::ReplaceOrInsertBefore function in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10 might allow remote attackers to execute arbitrary code via...

Mozilla: Use-after-free while replacing/inserting a node in a document (MFSA 2012-38)

Use-after-free vulnerability in the nsINode::ReplaceOrInsertBefore function in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10 might allow remote attackers to execute arbitrary code via...

Joomla 'com_easyfaq' Component Multiple SQL Injection Vulnerabilities

This host is running Joomla EasyFAQ component and is prone to multiple sql injection vulnerabilities. OpenVAS Vulnerability Test $Id: secpodjoomlacomeasyfaqsqlinjvuln.nasl 5950 2017-04-13 09:02:06Z teissa $ Joomla 'comeasyfaq' Component Multiple SQL Injection Vulnerabilities Authors: Sooraj KS...

Drupal Activity 6.x XSS Proof Of Concept

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Exploit for bespoke: Install and enable the Activity and Flag modules Add a new Flag with an arbitrary name at ?q=admin/build/flags/add On the resulting page ?q=admin/build/flags/add/node/name enter "alert'xss';" for the flag Title View the rendered...

Windows Media Player Denial Of Service Vulnerability

This host is installed with Windows Media Player and is prone to denial of service vulnerability. OpenVAS Vulnerability Test $Id: secpodwinmediaplayerdosvuln.nasl 7019 2017-08-29 11:51:27Z teissa $ Windows Media Player Denial Of Service Vulnerability Authors: Madhuri D Copyright: Copyright c 2011...