CVE-2012-5580

CVE-2012-5580 affects libproxy 0.3.1. The vulnerability exists in print_proxies (bin/proxy.c) where a format string flaw in a proxy name allows context-dependent attackers to trigger a crash (and possibly code execution) via format string specifiers. Exploitation scenarios mentioned include the h...

CVE-2012-5580

Format string vulnerability in the printproxies function in bin/proxy.c in libproxy 0.3.1 might allow context-dependent attackers to cause a denial of service crash and possibly execute arbitrary code via format string specifiers in a proxy name, as demonstrated using the httpproxy environment...

CVE-2012-1111

lightdm before 1.0.9 does not properly close file descriptors before opening a child process, which allows local users to write to the lightdm log or have other unspecified impact...

CVE-2012-1111

CVE-2012-1111 affects lightdm prior to 1.0.9. The issue is failure to properly close file descriptors before starting a child process, allowing local users to write to the lightdm log (and other unspecified impact). Remediation: upgrade to lightdm 1.0.9 or later (patches addressing this flaw). If...

SOL15741 - Apache Commons HttpClient vulnerability CVE-2012-6153

Recommended action None Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custom RSS feed to view new and updated documents SOL4602: Overview of the F5 security vulnerability response policy SOL4918: Overview of the F5 critical issue...

Microsoft EAP Implementation TLS Information Disclosure Vulnerability (2977292)

This host is missing an important security update according to Microsoft Security Advisory 2977292. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Scientific Linux Security Update : trousers on SL6.x i386/x86_64 (20141014)

A flaw was found in the way tcsd, the daemon that manages Trusted Computing resources, processed incoming TCP packets. A remote attacker could send a specially crafted TCP packet that, when processed by tcsd, could cause the daemon to crash. Note that by default tcsd accepts requests on localhost...

SOL15739 - BIND vulnerability CVE-2012-3868

Recommended Action None Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custom RSS feed to view new and updated documents. SOL4602: Overview of the F5 security vulnerability response policy SOL4918: Overview of the F5 critical issue...

CVE-2012-5242

Directory traversal vulnerability in functions/suggest.php in Banana Dance B.2.6 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the name parameter in a gettemplate action...

CVE-2012-5702

Multiple cross-site scripting XSS vulnerabilities in dotProject before 2.1.7 allow remote attackers to inject arbitrary web script or HTML via the 1 callback parameter in a colorselector action, 2 field parameter in a dateformat action, or 3 companyname parameter in an addedit action to index.php...

CVE-2012-5242

Banana Dance (Product: Banana Dance; Vendor: bananadance.org) is affected by CVE-2012-5242 and related issues in B.2.6 and earlier. The root causes include: PHP File Inclusion in functions/ajax.php/get_template flow and Directory Traversal via name parameter in get_template action; Improper Acces...

CVE-2012-5702

dotProject is affected by CVE-2012-5702 (XSS) in versions up to 2.1.6/2.1.x. The vulnerability arises from input sanitation errors in index.php when handling GET parameters: callback, field, company_name (2.1), and also date (2.4) in day_view. An attacker can inject arbitrary HTML/JavaScript that...

CVE-2012-5243

Banana Dance B.2.6 and earlier are affected by CVE-2012-5243 (Improper Access Control). An unauthenticated remote attacker can read arbitrary data from the database via /functions/suggest.php, enabling reading of sensitive information (bd_users table per PoC). The issue is part of a set of vulner...

CVE-2012-5242

Directory traversal vulnerability in functions/suggest.php in Banana Dance B.2.6 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the name parameter in a gettemplate action...

MS14-064 Microsoft Windows OLE Package Manager Code Execution

This module exploits a vulnerability found in Windows Object Linking and Embedding OLE allowing arbitrary code execution, publicly exploited in the wild as MS14-060 patch bypass. The Microsoft update tried to fix the vulnerability publicly known as "Sandworm". Platforms such as Windows Vista SP2...

CVE-2012-5696

This entry corresponds to CVE-2012-5696 in the Smartphone Pentest Framework (SPF). Documentation confirms SPF before 0.1.3 vulnerable to improper access control via the /frameworkgui/config path, allowing remote attackers to obtain the plaintext database password. The connected advisory details m...

CVE-2012-5695

CVE-2012-5695 describes CSRF vulnerabilities in Bulb Security SPF (Smartphone Pentest Framework) affecting versions 0.1.2–0.1.4. The issues allow an attacker to hijack administrator authentication to trigger requests that perform (1) shell metacharacter actions, (2) SQL injection, or (3) sending ...

CVE-2012-5694

CVE-2012-5694 concerns multiple SQL injection flaws in the Smartphone Pentest Framework (SPF) web GUI, specifically in the frameworkgui/ directory. The linked HTB23123 advisory enumerates affected scripts and parameters (attach2Agents.pl, attachMobileModem.pl, escalatePrivileges.pl, getContacts.p...

CVE-2012-5697

CVE-2012-5697 relates to the Smartphone Pentest Framework (SPF) web GUI in frameworkgui/, where the btinstall script sets world-writable permissions (777) on all files. This permits a local attacker to read sensitive files and potentially inject arbitrary Perl code via direct access to the files,...

CVE-2012-5701

Multiple SQL injection vulnerabilities in dotProject before 2.1.7 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 searchstring or 2 where parameter in a contacts action, 3 deptid parameter in a departments action, 4 projectid parameter in a project action, or...