AIX 5.3 TL 12 : bos.net.tcp.client (U846347)

The remote host is missing AIX PTF U846347, which is related to the security of the package bos.net.tcp.client. Vulnerability which allows remote attackers to 1 register or 2 unregister RPC services, and consequently cause a denial of service or obtain sensitive information from interprocess...

Palo Alto Networks PAN-OS < 3.1.11 / 4.0.x < 4.0.8 / 4.1.x < 4.1.1 Command Injection

The remote host is running a version of Palo Alto Networks PAN-OS prior to 3.1.11 / 4.0.8 / 4.1.1. It is, therefore, affected by a command injection vulnerability that allows an authenticated user to inject arbitrary shell commands via the CLI. C Tenable Network Security, Inc. include"compat.inc"...

Palo Alto Networks PAN-OS 3.1.10 / 4.x < 4.0.5 Multiple Command Injections

The remote host is running a version of Palo Alto Networks PAN-OS prior to 3.1.10 / 4.0.5. It is, therefore, affected by multiple command injection vulnerabilities : - A vulnerability exists that allows an authenticated user to inject arbitrary shell commands via the CLI. CVE-2012-6591 /...

Palo Alto Networks PAN-OS < 3.1.10 / 4.x < 4.0.4 Multiple Command Injections

The remote host is running a version of Palo Alto Networks PAN-OS prior to 3.1.10 / 4.0.4. It is, therefore, affected by multiple command injection vulnerabilities : - A vulnerability exists that allows an unauthenticated user to inject commands as root on the device. CVE-2012-6593 /...

Palo Alto Networks PAN-OS < 4.0.9 / 4.1.x < 4.1.2 Multiple Command Injections

The remote host is running a version of Palo Alto Networks PAN-OS prior to 4.0.9 / 4.1.2. It is, therefore, affected by multiple command injection vulnerabilities : - A vulnerability exists that allows an authenticated user to inject arbitrary shell commands via the CLI. CVE-2012-6595 /...

Palo Alto Networks PAN-OS < 4.0.8 Multiple Vulnerabilities

The remote host is running a version of Palo Alto Networks PAN-OS prior to 4.0.8. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists due to overly verbose error messages. An attacker can exploit this vulnerability by sending specially crafted...

Moderate: Red Hat Security Advisory: mongodb security update

Updated mongodb packages that fix one security issue are now available for Red Hat Enterprise Linux OpenStack Platform 4.0. The Red Hat Security Response Team has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

CVE-2012-6637

Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier do not anchor the end of domain-name regular expressions, which allows remote attackers to bypass a whitelist protection mechanism via a domain name that contains an acceptable name as an initial substring...

Server side request forgery (ssrf)

Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly implement the WebView class, which allows remote attackers to execute arbitrary methods of Java objects or cause a denial of service reboot via a crafted web page, as demonstrated ...

CVE-2012-6636

CVE-2012-6636 corresponds to an Android WebView issue where WebView.addJavascriptInterface is not properly restricted, allowing crafted JavaScript to invoke Java object methods via Reflection and potentially achieve remote code execution on apps targeting API level 16 or earlier. Connected docs s...

CVE-2012-6637

Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier are affected by a flaw in the domain-name whitelist check: the end of domain-name regular expressions is not anchored, allowing a domain that contains an acceptable name as an initial substring to bypass the whitelist. This is a code/...

Microsoft Works File Converter Heap Overflow - Ver2 (CVE-2012-0177)

A buffer overflow vulnerability has been reported in Microsoft Works. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Symantec Web Gateway blocked.php Blind SQL Injection - Ver2 (CVE-2012-2574)

An SQL injection vulnerability has been reported in Symantec Web Gateway. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

Microsoft Remote Administration Protocol Server Name Buffer Overflow - Ver2 (CVE-2012-1853)

A buffer overflow vulnerability has been reported in the Remote Administration Protocol RAP implementation in the LanmanWorkstation service in Microsoft Windows XP SP3. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Oracle WebCenter Sites Multiple Vulnerabilities (October 2012 CPU)

The remote Oracle WebCenter Sites install is missing patches from the October 2012 CPU. As a result, it may be affected by multiple vulnerabilities : - A cross-site request forgery vulnerability exists that can be triggered by tricking a victim into clicking an image link on a specially crafted...

Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.10 : file vulnerabilities (USN-2123-1)

It was discovered that file incorrectly handled Composite Document files. An attacker could use this issue to cause file to crash, resulting in a denial of service. This issue only affected Ubuntu 10.04 LTS and Ubuntu 12.04 LTS. CVE-2012-1571 Bernd Melchers discovered that file incorrectly handle...

USN-2123-1: file vulnerabilities

It was discovered that file incorrectly handled Composite Document files. An attacker could use this issue to cause file to crash, resulting in a denial of service. This issue only affected Ubuntu 10.04 LTS and Ubuntu 12.04 LTS. CVE-2012-1571 Bernd Melchers discovered that file incorrectly handle...

CVE-2012-2134

CVE-2012-2134 affects bind-dyndb-ldap (LDAP back-end plug-in) in MiracleLinux 4 and similar builds. The vulnerability arises from improper handling of LDAP query errors in handle_connection_error, which can cause an infinite loop and hang of the named server when a non-alphabet character appears ...

Apache Tomcat 7.0.0 < 7.0.50 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 7.0.50. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat7.0.50security-7 advisory. - Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in...

Linux Kernel 'tcp_rcv_state_process()'函数拒绝服务漏洞

BUGTRAQ ID: 65654 CVECAN ID: CVE-2012-6638 Linux Kernel是Linux操作系统的内核。 Linux kernel 3.2.24之前版本net/ipv4/tcpinput.c内的tcprcvstateprocess函数在处理大量的SYN+FIN TCP数据包时，存在越界访问错误，远程攻击者可利用此漏洞造成拒绝服务。 0 Linux kernel 3.2.24 厂商补丁： Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.kernel.org/...