33554 matches found
DEBIAN-CVE-2014-4660
Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the "deb...
CVE-2014-4678
The safeeval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4657...
PYSEC-2020-203
The safeeval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4657...
Code injection
The safeeval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4657...
PYSEC-2020-203
The safeeval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4657...
CVE-2014-4678
The safeeval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4657...
CVE-2014-4678
The CVE-2014-4678 entry concerns Ansible’s safe_eval function. Version pre-1.6.4 fails to properly restrict the code subset, enabling remote attackers to execute arbitrary code via crafted instructions. This vulnerability is linked to an incomplete fix for CVE-2014-4657 and is described as a remo...
CVE-2014-4660
CVE-2014-4660 affects Ansible before 1.5.5. The issue arises because the build of filenames uses user and password fields from sources.list (deb http://user:pass@server:port/), which can let a local user disclose sensitive credentials through the presence of such a filename. The connected advisor...
CVE-2014-9617
Open redirect vulnerability in Netsweeper’s remotereporter/load_logfiles.php reported as CVE-2014-9617. Affected software: Netsweeper (notably 3.0.6 and versions prior to 4.0.5). The flaw allows remote attackers to redirect users to arbitrary websites via the url parameter, enabling phishing scen...
CVE-2014-9615
Netsweeper 4.0.4 is affected by a cross-site scripting (XSS) vulnerability via the url parameter to webadmin/deny/index.php. The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to script execution in the victim’s browser. The Nuclei template confirms this...
CVE-2014-9614
CVE-2014-9614 (Netsweeper) affects the Web Panel prior to version 4.0.5, where the branding account uses a default password of 'branding'. This allows remote attackers to access the system by targeting the webadmin/ interface. The NUCLEI template confirms the issue and describes impact as unautho...
CVE-2014-9612
SQL injection vulnerability in remotereporter/loadlogfiles.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to execute arbitrary SQL commands via the server parameter...
CVE-2014-9609
CVE-2014-9609 describes a directory traversal flaw in Netsweeper’s webadmin/reporter/view_server_log.php, exploitable via a .. in the log parameter under a stats action to list directory contents. Affected versions include Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2. Reme...
CVE-2014-9608
Cross-site scripting XSS vulnerability in webadmin/policy/grouptableajax.php/ in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO...
CVE-2014-9608
Netsweeper is affected by an XSS in webadmin/policy/group_table_ajax.php/ across multiple tracked versions: before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2. The issue stems from insufficient validation of client-side data via PATH_INFO, enabling remote attackers to inject arbitrary web ...
CVE-2014-9607
CVE-2014-9607 describes a cross-site scripting (XSS) vulnerability in Netsweeper’s remotereporter/load_logfiles.php used by version 4.0.3 and 4.0.4. The issue allows remote attackers to inject arbitrary web script or HTML via the url parameter, potentially executing code in the context of the tar...
CVE-2014-9606
Netsweeper CVE-2014-9606 involves multiple XSS vulnerabilities in Netsweeper releases: 3.1.10 and older 4.0.x (before 4.0.9) and 4.1.x (before 4.1.2). The XSS can be triggered by specially crafted inputs in five vectors: (1) server parameter to remotereporter/load_logfiles.php, (2) customctid to ...
[SECURITY] [DLA 2110-1] netty-3.9 security update
Package : netty-3.9 Version : 3.9.0.Final-1+deb8u1 CVE ID : CVE-2014-0193 CVE-2014-3488 CVE-2019-16869 CVE-2019-20444 CVE-2019-20445 CVE-2020-7238 Debian Bug : 746639 941266 950966 950967 Several vulnerabilities were discovered in Netty, a Java NIO client/server socket framework: CVE-2014-0193...
