SPIP Cross-Site Request Forgery Vulnerability

SPIP is a free Web-based content publishing system. The system is primarily used for online collaboration. A cross-site request forgery vulnerability exists in SPIP versions 1.9.2-SPIP 3.0.7, which can be exploited by an attacker to perform unauthorized operations...

SPIP Directory Traversal Vulnerability

SPIP is a free Web-based content publishing system. The system is primarily used for online collaboration. A directory traversal vulnerability exists in SPIP versions 1.9.2-SPIP 3.0.7, which can be exploited by an attacker to steal cookie-based authentication and read arbitrary files, among other...

Magento 1.9.2 File Inclusion

------------------------------------------------------------------------------- Magento fault'datainvalid'; 113. 114. 115. $this-checkProductTypeExists$type; 116. $this-checkProductAttributeSet$set; 117. 118. / @var $product MageCatalogModelProduct / 119. $product = Mage::getModel'catalog/product...

DEBIAN-CVE-2015-3908

Ansible before 1.9.2 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

Ansible Bypass Security Restrictions Vulnerability

Ansible is a newly emerged operation and maintenance tool that is based on Python and combines the advantages of many old operation and maintenance tools to achieve batch operating system configuration, batch program deployment, batch running commands and other functions. A security vulnerability...

Ansible Security Bypass Vulnerability

Ansible is a newly emerged operation and maintenance tool that is based on Python and combines the advantages of many old operation and maintenance tools to achieve batch operating system configuration, batch program deployment, batch running commands and other functions. A security bypass...

FreeBSD : ansible -- multiple vulnerabilities (72fccfdf-2061-11e5-a4a5-002590263bf5)

Ansible, Inc. reports : Ensure that hostnames match certificate names when using HTTPS - resolved in Ansible 1.9.2 Improper symlink handling in zone, jail, and chroot connection plugins could lead to escape from confined environment - resolved in Ansible 1.9.2 %NASLMINLEVEL 70300 C Tenable Networ...

The vulnerability of the Red Hat Enterprise Linux operating system allows a remote attacker to compromise the confidentiality and integrity of protected information.

The vulnerability of the libsssautofs-1.9.2 package in the Red Hat Enterprise Linux operating system can lead to violations of confidentiality and integrity of protected information. This vulnerability can be exploited remotely by a malicious individual who has completed the authentication proces...

The vulnerability of the Red Hat Enterprise Linux operating system allows a remote attacker to compromise the confidentiality and integrity of protected information.

The vulnerability of the libipahbac-devel-1.9.2 package for the Red Hat Enterprise Linux operating system can lead to violations of confidentiality and integrity of protected information. This vulnerability can be exploited remotely by a malicious individual who has completed the authentication...

The vulnerability of the Red Hat Enterprise Linux operating system allows a remote attacker to compromise the confidentiality and integrity of protected information.

The vulnerability of the libipahbac-1.9.2 package for the Red Hat Enterprise Linux operating system can lead to violations of confidentiality and integrity of protected information. This vulnerability can be exploited remotely by a malicious individual who has completed the authentication process...

CVE-2014-7824

D-Bus 1.3.0 through 1.6.x before 1.6.26, 1.8.x before 1.8.10, and 1.9.x before 1.9.2 allows local users to cause a denial of service prevention of new connections and connection drop by queuing the maximum number of file descriptors. NOTE: this vulnerability exists because of an incomplete fix fo...

CVE-2014-7824

D-Bus 1.3.0 through 1.6.x before 1.6.26, 1.8.x before 1.8.10, and 1.9.x before 1.9.2 allows local users to cause a denial of service prevention of new connections and connection drop by queuing the maximum number of file descriptors. NOTE: this vulnerability exists because of an incomplete fix fo...

Spam Free Plugin 1.9.2 - Multiple Script Direct Request Path Disclosure

The Spam Free WordPress WordPress plugin was affected by a Multiple Script Direct Request Path Disclosure security vulnerability...

CVE-2014-4744

osTicket

TikiWiki 1.9 Tiki-view_forum_thread.PHP Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/15371/info TikiWiki is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary scrip...

Andromeda 1.9.2 's' Parameter Cross Site Scripting and Session Fixation Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/38735/info Andromeda is prone to a cross-site scripting vulnerability and a session-fixation vulnerability. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in...

[oss-security] CVE request for commons-beanutils: 'class' property is exposed, potentially leading to RCE

Hi All I have raised this twice with [email protected], on 30 April and June 3. I have received no response either time, therefore I am raising it on oss-security. CVE-2014-0114 describes a well-known issue in Apache Struts 1: "It was found that the Struts 1 ActionForm object allowed access to...

CVE-2013-0778

The ClusterIterator::NextCluster function in Mozilla Firefox before 19.0, Thunderbird before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code or cause a denial of service out-of-bounds read via unspecified vectors...

WordPress Spam Free 1.9.2 Filter Bypass

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 + Site : 1337day.com 0 1 + Support e-mail :...

CVE-2012-4216

Use-after-free vulnerability in the gfxFont::GetFontEntry function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code or cause a denial of servic...