Microsoft Windows Task Scheduler Privilege Escalation Vulnerability (2988948)

This host is missing an important security update according to Microsoft Bulletin MS14-054. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CentOS Update for jakarta-commons-httpclient CESA-2014:1166 centos7

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Update for Microsoft .NET Framework 4.5 and 4.5.1 on Windows 8 and Windows Server 2012 for x64-based Systems (KB2894855)

A security issue has been identified in a Microsoft software product that could affect your system. You can help protect your system by installing this update from Microsoft. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article...

Microsoft Windows Task Scheduler Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability. A local attacker may exploit this issue to execute arbitrary code with the Local system account. Successful exploits will result in the complete compromise of affected computers. Technologies Affected Microsoft...

RHEL 5 / 6 / 7 : Red Hat JBoss Enterprise Application Platform 6.3.0 (RHSA-2014:1162)

The remote Redhat Enterprise Linux 5 / 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:1162 advisory. Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. It was foun...

Null pointer dereference

The client in Novell GroupWise before 8.0.3 HP4, 2012 before SP3, and 2014 before SP1 on Windows allows remote attackers to execute arbitrary code or cause a denial of service invalid pointer dereference via unspecified vectors...

CVE-2012-6153

http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via...

CVE-2012-6153

http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via...

CVE-2012-6153

Apache Commons HttpClient before 4.2.3 fails to verify that the server hostname matches the domain name in the certificate’s CN/subjectAltName (AbstractVerifier.java), enabling MITM SSL spoofing. This is a follow-on to an incomplete fix for CVE-2012-5783; the issue has affected various Java deplo...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.0 security update

Updated Red Hat JBoss Enterprise Application Platform 6.3.0 packages that fix two security issues are now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores,...

CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix

It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject's Common Name CN field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially...

CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix

It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject's Common Name CN field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially...

CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix

It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject's Common Name CN field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially...

CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix

It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject's Common Name CN field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially...

CVE-2012-4234

Cross-site scripting XSS vulnerability in the group moderation screen in the control center control.php in Phorum before 5.2.19 allows remote attackers to inject arbitrary web script or HTML via the group parameter...

CVE-2012-4234

CVE-2012-4234 is an XSS vulnerability in Phorum prior to 5.2.19, exploitable via the group parameter in control.php. The root cause is insufficient sanitization of the group input, allowing arbitrary HTML/JavaScript to be returned to users. Public advisories (HTB23109) confirm the issue and indic...

CVE-2012-4768

CVE-2012-4768 is a Cross-Site Scripting vulnerability in the WordPress plugin Download Monitor prior to 3.3.5.9. The dlsearch parameter written to download pages can inject arbitrary JavaScript, potentially leading to session cookie theft, redirects, or malware delivery. Exploitation affects Word...

CVE-2012-4226

Multiple cross-site scripting XSS vulnerabilities in Quick Post Widget plugin 1.9.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 Title, 2 Content, or 3 New category field to wordpress/ or 4 query string to wordpress/...

CVE-2012-4226

CVE-2012-4226 concerns the WordPress Quick Post Widget plugin (version 1.9.1). The connected sources describe multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary web script or HTML via the Quick Post Widget fields (Title, Content, New category) or v...

Medium: file

Issue Overview: Integer overflow in the cdfreadpropertyinfo function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a denial of service application crash via a crafted CDF file. NOTE: this vulnerabili...