CVE-2014-0106

CVE-2014-0106 affects Sudo up to version 1.8.5 where env_reset is disabled, and env_delete checks fail to properly sanitize environment variables. This allows local users with sudo permissions to bypass intended command restrictions via crafted environment variables. The vulnerability is tied to ...

Oracle Linux 5 : sudo (ELSA-2014-0266)

The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2014-0266 advisory. 1.7.2p1-29 - added patch for CVE-2014-0106: certain environment variables not sanitized when envreset is disabled Resolves: rhbz1072210 Tenable has extracted th...

Scientific Linux Security Update : sudo on SL5.x i386/x86_64 (20140310)

A flaw was found in the way sudo handled its blacklist of environment variables. When the 'envreset' option was disabled, a user permitted to run certain commands via sudo could use this flaw to run such a command with one of the blacklisted environment variables set, allowing them to run an...

CentOS 5 : sudo (CESA-2014:0266)

An updated sudo package that fixes one security issue is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

RHEL 5 : sudo (RHSA-2014:0266)

An updated sudo package that fixes one security issue is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

sudo security update

CentOS Errata and Security Advisory CESA-2014:0266 An updated sudo package that fixes one security issue is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base...

sudo security update

1.7.2p1-29 - added patch for CVE-2014-0106: certain environment variables not sanitized when envreset is disabled Resolves: rhbz1072210...

CVE-2012-0106

Technical details about CVE-2012-0106 are not publicly available in the provided documents. Monitor for updates from Oracle CPU advisories and vendor pages for affected products, vectors, and fixes.

Slackware Advisory SSA:2004-043-02 XFree86 security update

The remote host is missing an update as announced via advisory SSA:2004-043-02. OpenVAS Vulnerability Test $Id: esoftslkssa200404302.nasl 6598 2017-07-07 09:36:44Z cfischer $ Description: Auto-generated from the corresponding slackware advisory Authors: Thomas Reinke Copyright: Copyright c 2012...

Slackware: Security Advisory (SSA:2004-043-02)

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2010-0106

The on-demand scanning in Symantec AntiVirus 10.0.x and 10.1.x before MR9, AntiVirus 10.2.x, and Client Security 3.0.x and 3.1.x before MR9, when Tamper protection is disabled, allows remote attackers to cause a denial of service prevention of on-demand scanning via "specific events" that prevent...

CVE-2010-0106

CVE-2010-0106 affects Symantec AntiVirus 10.0.x/10.1.x before MR9, AntiVirus 10.2.x, and Client Security 3.0.x/3.1.x before MR9. When Tamper Protection is disabled, remote attackers could cause a denial of service by triggering events that prevent the user from reading unspecified resources and t...

Symantec Event Manipulation Potential Scan Bypass

SUMMARY On-demand scanning with Symantec AntiVirus can be bypassed by denying read access to user files. AFFECTED PRODUCTS Product | Version | Solutions ---|---|--- Symantec AntiVirus | 10.0.x | Upgrade to MR9 10.1.x Symantec AntiVirus | 10.2.x | Not Vulnerable Symantec Client Security | 3.0.x |...

CVE-2009-0106

CVE-2009-0106 is a SQL injection vulnerability in profile.php of PHPAuctions (PHPAuctionSystem). The flaw allows remote attackers to run arbitrary SQL commands through the user_id parameter, enabling potential data leakage or modification. The connected records also cite a related vulnerability (...

CVE-2009-0106

creationtimestamp| type| source ---|---|--- 2009-01-05 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/7672...

Gentoo Security Advisory GLSA 200601-09 (wine)

The remote host is missing updates announced in advisory GLSA 200601-09. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

FreeBSD Ports: linux_base

The remote host is missing an update to the system as announced in the referenced advisory. VID bf2e7483-d3fa-440d-8c6e-8f1f2f018818 OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

CVE-2008-0106

CVE-2008-0106 describes a buffer overflow in Microsoft SQL Server 2005 SP1/SP2 and SQL Server 2005 Express SP1/SP2 that could allow remote authenticated users to execute arbitrary code via a crafted insert statement. The connected KB article MS08-040 (KB941203) confirms Microsoft released a secur...

CVE-2007-0106

Cross-site scripting XSS vulnerability in the CSRF protection scheme in WordPress before 2.0.6 allows remote attackers to inject arbitrary web script or HTML via a CSRF attack with an invalid token and quote characters or HTML tags in URL variable names, which are not properly handled when...

CVE-2007-0106

CVE-2007-0106 affects WordPress up to version 2.0.5 (before 2.0.6). The issue is a Cross-site Scripting (XSS) vulnerability in the CSRF protection scheme, where an attacker can inject arbitrary script/HTML via a CSRF attack using an invalid token and quote characters or HTML tags in URL variable ...