CVE-2015-1427

creationtimestamp| type| source ---|---|--- 2015-03-11 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/36337 2015-03-16 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/36415 2017-07-11 02:04:41+00:00| published-proof-of-concept| https://t.me/HackingPublicoficial/162...

ElasticSearch - Remote Code Execution

!/bin/python2 coding: utf-8 Author: Darren Martyn, Xiphos Research Ltd. Version: 20150309.1 Licence: WTFPL - wtfpl.net import json import requests import sys import readline readline.parseandbind'tab: complete' readline.parseandbind'set editing-mode vi' version = "20150309.1" def banner: print...

Elasticsearch vulnerability CVE-2015-1427

Summary: Elasticsearch versions 1.3.0-1.3.7 and 1.4.0-1.4.2 have vulnerabilities in the Groovy scripting engine. The vulnerabilities allow an attacker to construct Groovy scripts that escape the sandbox and execute shell commands as the user running the Elasticsearch Java VM. We have been assigne...

Immunity Canvas: ELASTICSEARCH_CVE_2015_1427

Name| elasticsearchCVE20151427 ---|--- CVE| CVE-2015-1427 Exploit Pack| CANVAS Description| elasticsearchCVE-2015-1427 Notes| CVE Name: CVE-2015-1427 VENDOR: elastic Notes: Elasticsearch versions 1.3.x before 1.3.8 and 1.4.x before 1.4.3 have dynamic scripting features enabled by default using...

CVE-2015-1427

CVE-2015-1427 concerns Elasticsearch’s Groovy scripting engine, where dynamic scripting was enabled by default in versions before 1.3.8 (and 1.4.x before 1.4.3). The root cause is a sandbox bypass in the Groovy sandbox that allows remote attackers to execute arbitrary shell commands via a crafted...

CVE-2015-1427

The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script...

Oracle Solaris Third-Party Patch Update : lighttpd (cve_2014_2469_denial_of)

The remote Solaris system is missing necessary patches to address security updates : - lighttpd before 1.4.26, and 1.5.x, allocates a buffer for each read operation that occurs for a request, which allows remote attackers to cause a denial of service memory consumption by breaking a request into...

Malware evasion Security Bypass - Ver2 (CVE-2012-1427)

A security bypass vulnerability has been reported in Cat Quick HealCat Quick Heal. An attacker could exploit this vulnerability via a POSIX TAR file with a 57696E5A6970 character sequence at a certain location. Successful exploitation of this vulnerability would allow remote attackers to bypass...

Oracle Linux 5 : fetchmail (ELSA-2009-1427)

The remote Oracle Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2009-1427 advisory. 6.3.6-1.1.el53.1 - Fix fetchmail various flaws CVE-2007-4565, CVE-2008-2711, CVE-2009-2666 Resolves: 516269 Tenable has extracted the preceding...

CVE-2013-1427

The configuration file for the FastCGI PHP support for lighttpd before 1.4.28 on Debian GNU/Linux creates a socket file with a predictable name in /tmp, which allows local users to hijack the PHP control socket and perform unauthorized actions such as forcing the use of a different version of PHP...

CVE-2013-1427

The configuration file for the FastCGI PHP support for lighttpd before 1.4.28 on Debian GNU/Linux creates a socket file with a predictable name in /tmp, which allows local users to hijack the PHP control socket and perform unauthorized actions such as forcing the use of a different version of PHP...

DEBIAN-CVE-2013-1427

The configuration file for the FastCGI PHP support for lighttpd before 1.4.28 on Debian GNU/Linux creates a socket file with a predictable name in /tmp, which allows local users to hijack the PHP control socket and perform unauthorized actions such as forcing the use of a different version of PHP...

CVE-2013-1427

CVE-2013-1427 affects lighttpd before 1.4.28 on Debian GNU/Linux. The FastCGI PHP support configuration creates a socket file in /tmp with a predictable name, enabling local users to hijack the PHP control socket and perform unauthorized actions such as forcing a different PHP version via a symli...

CVE-2012-1427

CVE-2012-1427 affects the TAR file parser in Quick Heal (Cat QuickHeal) 11.00, Norman Antivirus 6.06.12, and Sophos Anti-Virus 4.61.0. The vulnerability allows remote attackers to bypass malware detection by crafting a POSIX TAR file containing a specific character sequence (encoded as �... in th...

CentOS Update for fetchmail CESA-2009:1427 centos5 i386

Check for the Version of fetchmail OpenVAS Vulnerability Test CentOS Update for fetchmail CESA-2009:1427 centos5 i386 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify ...

CentOS Update for fetchmail CESA-2009:1427 centos5 i386

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

CVE-2011-1427

Kodak InSite 5.5.2 is affected by multiple cross-site scripting (XSS) vulnerabilities. The CVE entry notes three input vectors: (1) Language parameter to Pages/login.aspx, (2) HeaderWarning parameter to Troubleshooting/DiagnosticReport.asp, and (3) User-Agent header to troubleshooting/speedtest.a...

CVE-2011-1427

creationtimestamp| type| source ---|---|--- 2011-03-07 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/35411 2011-03-07 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/35412...

[security bulletin] HPSBUX02450 SSRT090141 rev1 - HP-UX ttrace(2), Local Denial of Service (DoS)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c01832652 Version: 1 HPSBUX02450 SSRT090141 rev1 - HP-UX ttrace2, Local Denial of Service DoS NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release...

CVE-2010-1427

CVE-2010-1427 is an XSS vulnerability in the MODx Evolution project, specifically affecting the SearchHighlight plugin prior to version 1.0.3. It allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to AjaxSearch. The NVD entry lists a CVSS v2 base score of 4...