Fedora 21 : drupal7-7.35-1.fc21 (2015-4340)

Upstream release notes: https://www.drupal.org/drupal-7.35-release-notes - Official security advisory: https://www.drupal.org/SA-CORE-2015-001 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to...

Drupal Core - Moderately Critical - Multiple Vulnerabilities - SA-CORE-2015-001

Access bypass Password reset URLs - Drupal 6 and 7 Password reset URLs can be forged under certain circumstances, allowing an attacker to gain access to another user's account without knowing the account's password. In Drupal 7, this vulnerability is mitigated by the fact that it can only be...

BSA-2015-001

Summary Security Advisory ID : BSA-2015-001 Component : N/A Revision : 5.0 N/A...

Security fix for the ALT Linux 8 package krb5 version 1.13-alt3

Feb. 8, 2015 Ivan A. Melnikov 1.13-alt3 - fix for MITKRB5-SA-2015-001 CVE-2014-5352, CVE-2014-9421, CVE-2014-9422, CVE-2014-9423...

Security fix for the ALT Linux 9 package krb5 version 1.13-alt3

Feb. 8, 2015 Ivan A. Melnikov 1.13-alt3 - fix for MITKRB5-SA-2015-001 CVE-2014-5352, CVE-2014-9421, CVE-2014-9422, CVE-2014-9423...

Security fix for the ALT Linux 7 package krb5 version 1.13-alt3

Feb. 8, 2015 Ivan A. Melnikov 1.13-alt3 - fix for MITKRB5-SA-2015-001 CVE-2014-5352, CVE-2014-9421, CVE-2014-9422, CVE-2014-9423...

Microsoft Application Compatibility Infrastructure Elevation of Privilege (MS15-001; CVE-2015-0002)

A privilege escalation vulnerability exists in Microsoft Windows Application Compatibility Cache. The vulnerability is due to a lack of validation of administrator privileges while running a specially crafted application. An authenticated attacker can exploit this issue by sending a specially...

OracleVM 3.3 : krb5 (OVMSA-2014-0034)

The remote OracleVM system is missing necessary patches to address critical security updates : - actually apply that last patch - incorporate fix for MITKRB5-SA-2014-001 CVE-2014-4345, 1128157 - ksu: when evaluating .k5users, don't throw away data from .k5users when we're not passed a command to...

Oracle Linux 6 : krb5 (ELSA-2014-1389)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1389 advisory. - incorporate fix for MITKRB5-SA-2014-001 CVE-2014-4345, 1128157 - gssapi: pull in upstream fix for a possible NULL dereference in spnego CVE-2014-4344...

krb5 security and bug fix update

1.10.3-33 - actually apply that last patch 1.10.3-32 - incorporate fix for MITKRB5-SA-2014-001 CVE-2014-4345, 1128157 1.10.3-31 - ksu: when evaluating .k5users, don't throw away data from .k5users when we're not passed a command to run, which implicitly means we're attempting to run the target...

Portable router storage 0 DAY vulnerability that hackers can steal the privacy-vulnerability warning-the black bar safety net

Tenda router 4G301 model the presence of memory-typeXSScross-site scripting vulnerability vulnerability number: RSV-2 0 1 4-0 0 1 River. Rising security experts, the vulnerability is currently no official patch, belonging to the 0 DAY vulnerability, an attacker can carefully construct a malicious...

MQAC.sys Arbitrary Write Privilege Escalation

A vulnerability within the MQAC.sys module allows an attacker to overwrite an arbitrary location in kernel memory. This module will elevate itself to SYSTEM, then inject the payload into another SYSTEM process. Module Options msf use exploit/windows/local/mqac/write msf undefinedwrite show action...

Serendipity 1.6 Backend XSS And SQLi Vulnerability

No description provided by source. Advisory: Serendipity 1.6 Backend Cross-Site Scripting and SQL-Injection vulnerability Advisory ID: KORAMIS-ADV2012-001 Contact: [email protected] Author: Stefan Schurtz Affected Software: Successfully tested on Serendipity 1.6 Vendor URL: http://www.s9y.org...

MS13-009 Microsoft Internet Explorer COALineDashStyleArray Integer Overflow

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core'...

Fedora 20 : python-simplejson-3.5.3-1.fc20 (2014-7715)

Fixes a potential security issue https://github.com/simplejson/simplejson/issues/98 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...

Yahoo!: TESTING FOR REFLECTED CROSS SITE SCRIPTING (OWASP‐DV‐001)

Thank you for your submission to the Yahoo Bug Bounty program. We were able to reproduce the issue you reported and have implemented appropriate fixes. We appreciate your adherence to responsible disclosure guidelines and look forward to your future participation in the program...

Fedora 19 : drupal7-7.26-1.fc19 (2014-0983)

Fix for SA-CORE-2014-001 : https://drupal.org/drupal-7.26-release-notes Latest upstream. https://drupal.org/drupal-7.25-release-notes Latest upstream. https://drupal.org/drupal-7.25-release-notes Note that Tenable Network Security has extracted the preceding description block directly from the...

Fedora 20 : drupal7-7.26-1.fc20 (2014-1015)

Fix for SA-CORE-2014-001 : https://drupal.org/drupal-7.26-release-notes Latest upstream. https://drupal.org/drupal-7.25-release-notes Latest upstream. https://drupal.org/drupal-7.25-release-notes Note that Tenable Network Security has extracted the preceding description block directly from the...

Fedora 19 : drupal7-entity-1.3-1.fc19 (2014-0508)

Updated to 1.3 1.3 - Release notes: https://drupal.org/node/2169589 - SA-CONTRIB-2014-001: https://drupal.org/node/2169595 - CVE-2014-1398, CVE-2014-1399, CVE-2014-1400 1.2 - Release notes: https://drupal.org/node/2065197 - SA-CONTRIB-2013-068: https://drupal.org/node/2065207 1.1 - Release notes:...

Debian Security Advisory DSA 2847-1 (drupal7 - several vulnerabilities)

Multiple vulnerabilities have been discovered in Drupal, a fully-featured content management framework. The Common Vulnerabilities and Exposures project identifies the following issues: CVE-2014-1475 Christian Mainka and Vladislav Mladenov reported a vulnerability in the OpenID module that allows...