CVE-2012-5486

CVE-2012-5486 - HP: ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19 (used in Plone before 4.3 beta 1) allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character. Affected components: Zope 2 series up to 2.13.18; Plone deployments including the Plone before...

CVE-2012-5503

Plone contains a vulnerability in ftp.py where remote attackers can read hidden folder contents. Affected versions are Plone before 4.2.3 and 4.3 before beta 1. The description does not specify the exact vectors, root cause details, or practical exploitation steps, and no remediation is provided ...

CVE-2012-5507

AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation...

CVE-2012-5505

atat.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read private data structures via a request for a view without a name...

CVE-2012-5490

Cross-site scripting XSS vulnerability in kssdevel.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

luci, ricci security update

CentOS Errata and Security Advisory CESA-2014:1194 Updated conga packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVS...

php, php53 security update

CentOS Errata and Security Advisory CESA-2014:1326 Updated php53 and php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring...

file: incomplete fix for CVE-2012-1571 in cdf_read_property_info

It was found that the fix for CVE-2012-1571 was incomplete; the File Information fileinfo extension did not correctly parse certain Composite Document Format CDF files. A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted CDF file...

Moderate: Red Hat Security Advisory: php53 and php security update

Updated php53 and php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severi...

Hyper-V Changed Block Tracking Troubleshooting

Challenge Backup and/or Replication jobs report that changed block tracking is not working properly. Article Applicability This article is only relevant when Veeam Backup & Replication is used with the following Hyper-V versions. In these older versions of Hyper-V there was no native CBT function...

CVE-2012-6110

bcron-exec in bcron before 0.10 does not close file descriptors associated with temporary files when running a cron job, which allows local users to modify job files and send spam messages by accessing an open file descriptor...

CVE-2012-5619

The Sleuth Kit TSK 4.0.1 does not properly handle "." dotfile file system entries in FAT file systems and other file systems for which . is not a reserved name, which allows local users to hide activities it more difficult to conduct forensics activities, as demonstrated by Flame...

UBUNTU-CVE-2012-5621

lib/engine/components/opal/opal-call.cpp in ekiga before 4.0.0 allows remote attackers to cause a denial of service crash via an OPAL connection with a party name that contains invalid UTF-8 strings...

CVE-2012-5621

CVE-2012-5621 affects ekiga before 4.0.0 in the component opal-call.cpp. The issue arises when an OPAL connection includes a party name containing invalid UTF-8 strings, which can crash the application and cause a denial of service. The vulnerability is remote and can be triggered without user in...

CVE-2012-6107

Axis2/C (Apache Axis2 in C) has a hostname verification flaw: it does not verify that the server hostname matches the CN or subjectAltName in the X.509 certificate, enabling MITM with any valid certificate. The PT-2014-2368 entry notes affected software as Apache Axis2 (C language Web services en...

CVE-2012-6110

bcron-exec in bcron before 0.10 does not close file descriptors associated with temporary files when running a cron job, which allows local users to modify job files and send spam messages by accessing an open file descriptor...

CVE-2012-5619

Summary (CVE-2012-5619) The Sleuth Kit (TSK) 4.0.1 fails to properly handle "." (dotfile) entries on FAT and other non-reserved-name filesystems, enabling local attackers to obscure forensic activity (e.g., Flame’s demonstration). Connected documents corroborate this dotfile handling issue and it...

CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix

It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject's Common Name CN field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 5.2.0 security update

An update for Red Hat JBoss Enterprise Application Platform 5.2.0 that fixes two security issues is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give...

CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix

It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject's Common Name CN field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially...