LogIT 1.3/1.4 - Remote File Include Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/16932/info LogIT is prone to a remote file-include vulnerability. This issue is due to the application's failure to properly sanitize user-supplied input. Attackers may specify remotely hosted script files to be executed ...

CVE-2013-6737

CVE-2013-6737 affects IBM System Storage Storwize V7000 Unified 1.3.x and 1.4.x prior to 1.4.3.0, where a rare hardware fault (1691) can cause fragments of customer data to be dumped into a file. An authorized user may copy this file and read the data fragments, potentially compromising confident...

PT-2014-1921 · Freedesktop.Org +3 · D-Bus +3

Name of the Vulnerable Software and Affected Versions: D-Bus versions 1.2.x through 1.4.x D-Bus versions 1.6.x before 1.6.20 D-Bus versions 1.8.x before 1.8.10 Description: The issue allows local users to cause a denial of service or possibly conduct a side-channel attack via a D-Bus message to a...

SA-CONTRIB-2014-058 - Webserver Auth - Access Bypass

This module allows you to delegate user authentication to the web server. The module can be configured to automatically create users that have been authenticated by the web server. There was an issue where a configuration variable did not have consistent default values in the code meaning that in...

Rack: Multiple vulnerabilities

Background Rack is a modular Ruby web server interface. Description Multiple vulnerabilities have been discovered in Rack. Please review the CVE identifiers referenced below for details. Impact A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a...

DEBIAN-CVE-2014-3730

The django.util.http.issafeurl function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\djangoproject.com."...

CVE-2014-0089

Cross-site scripting XSS vulnerability in app/views/common/500.html.erb in Foreman 1.4.x before 1.4.2 allows remote authenticated users to inject arbitrary web script or HTML via the bookmark name when adding a bookmark...

Cross site scripting

Cross-site scripting XSS vulnerability in app/views/common/500.html.erb in Foreman 1.4.x before 1.4.2 allows remote authenticated users to inject arbitrary web script or HTML via the bookmark name when adding a bookmark...

CVE-2014-0089

CVE-2014-0089 is a cross-site scripting (XSS) vulnerability in Foreman 1.4.x prior to 1.4.2, exploitable by a remote authenticated user who can inject script/HTML via the bookmark name when adding a bookmark. The root cause is exposed in app/views/common/500.html.erb, enabling arbitrary script ex...

Drupal Mime Mail Module文件附件安全绕过漏洞

Bugtraq ID:65996 Drupal是一套开放源码的内容管理平台。 Drupal Mime Mail Module不正确校验附件文件路径，允许远程攻击者利用漏洞添加任意文件并获取敏感信息。 0 Drupal Mime Mail Module 6.x 厂商补丁： Drupal ----- Drupal Mime Mail Module 6.x-1.4已经修复该漏洞，建议用户下载更新： https://drupal.org/node/2211419...

CVE-2013-1070

Cross-site scripting XSS vulnerability in the API in Ubuntu Metal as a Service MaaS 1.2 and 1.4 allows remote attackers to inject arbitrary web script or HTML via the op parameter to nodes/...

CiMe Citas Médicas - Multiple Vulnerabilities

Exploit Title: Control de Citas 1.4 CIME - Multiple Vulnerabilities Date: 01/02/2014 Exploit Author: vinicius777 Contact: vinicius777 AT gmail / @vinicius777 Vendor Homepage: http://www.cgaredes.tk/ Software Link: http://sourceforge.net/projects/cime/files/latest/download?source=directory 1 SQL...

CVE-2013-4331

Light Display Manager aka LightDM 1.4.x before 1.4.3, 1.6.x before 1.6.2, and 1.7.x before 1.7.14 uses 0664 permissions for the temporary .Xauthority file, which allows local users to obtain sensitive information by reading the file...

CVE-2014-0027

The playwavefromsocket function in audio/auserver.c in Flite 1.4 allows local users to modify arbitrary files via a symlink attack on /tmp/awb.wav. NOTE: some of these details are obtained from third party information...

CVE-2014-0027

The playwavefromsocket function in audio/auserver.c in Flite 1.4 allows local users to modify arbitrary files via a symlink attack on /tmp/awb.wav. NOTE: some of these details are obtained from third party information...

CVE-2014-0027

The playwavefromsocket function in audio/auserver.c in Flite 1.4 allows local users to modify arbitrary files via a symlink attack on /tmp/awb.wav. NOTE: some of these details are obtained from third party information...

Information disclosure

The playwavefromsocket function in audio/auserver.c in Flite 1.4 allows local users to modify arbitrary files via a symlink attack on /tmp/awb.wav. NOTE: some of these details are obtained from third party information...

CVE-2014-0027

The playwavefromsocket function in audio/auserver.c in Flite 1.4 allows local users to modify arbitrary files via a symlink attack on /tmp/awb.wav. NOTE: some of these details are obtained from third party information...

CVE-2014-0027

The playwavefromsocket function in audio/auserver.c in Flite 1.4 allows local users to modify arbitrary files via a symlink attack on /tmp/awb.wav. NOTE: some of these details are obtained from third party information...

CVE-2014-0027

CVE-2014-0027 affects Flite 1.4. The vulnerability is in play_wave_from_socket (audio/auserver.c) allowing local users to modify arbitrary files via a symlink attack on /tmp/awb.wav. Root cause is insecure handling of /tmp/awb.wav leading to path-traversal via symlink. Impact per NVD: local acces...