CVE-2018-16152

In verifyemsapkcs1signature in gmprsapublickey.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation based on GMP does not reject excess data in the digestAlgorithm.parameters field during PKCS1 v1.5 signature verification. Consequently, a remote attacker can forge...

Design/Logic Flaw

In verifyemsapkcs1signature in gmprsapublickey.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation based on GMP does not reject excess data in the digestAlgorithm.parameters field during PKCS1 v1.5 signature verification. Consequently, a remote attacker can forge...

CVE-2018-16152

In verifyemsapkcs1signature in gmprsapublickey.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation based on GMP does not reject excess data in the digestAlgorithm.parameters field during PKCS1 v1.5 signature verification. Consequently, a remote attacker can forge...

MS14-044: Description of the security update for SQL Server 2014 (QFE): August 12, 2014

MS14-044: Description of the security update for SQL Server 2014 QFE: August 12, 2014 Introduction A security issue has been identified in Microsoft SQL Server 2014 that could allow an attacker to compromise your system and gain control over it. You can help protect your computer by installing th...

Security Bulletin: IBM DataPower Gateways is affected by a kernel vulnerability (CVE-2014-2523)

Summary IBM DataPower Gateways has addressed the following vulnerability: CVE-2014-2523 Vulnerability Details CVEID: CVE-2014-2523 DESCRIPTION: Linux Kernel could allow a remote attacker to execute arbitrary code on the system, caused by an error in the /netfilter/nfconntrackprotodccp.c file. By...

CVE-2018-16152

In verifyemsapkcs1signature in gmprsapublickey.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation based on GMP does not reject excess data in the digestAlgorithm.parameters field during PKCS1 v1.5 signature verification. Consequently, a remote attacker can forge...

Staubli Jacquard Industrial System JC6 Shellshock Vulnerability

Staubli Jacquard Industrial System JC6 suffers from a bash environment variable handling code injection vulnerability. Exploit Title: Staubli Jacquard Industrial System | GNU Bash Environment Variable Handling Code Injection Shellshock Exploit Author: t4rkd3vilz Vendor Homepage:...

Staubli Jacquard Industrial System JC6 Shellshock

Exploit Title: Staubli Jacquard Industrial System | GNU Bash Environment Variable Handling Code Injection Shellshock Date: 21.09.2018 Exploit Author: t4rkd3vilz Vendor Homepage: https://www.staubli.com Software Link: https://www.staubli.com/tr-tr/textile/textile-machinery-solutions/ Version:JC6...

CVE-2018-17051

K-Net Cisco Configuration Manager through 2014-11-19 has XSS via devices.php...

PowerDNS Security Advisory 2014-02: PowerDNS Recursor 3.6.1 and earlier can be made to provide bad service

PowerDNS Recursor before 3.6.2 does not limit delegation chaining, which allows remote attackers to cause a denial of service SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Important: Red Hat Security Advisory: Fuse 7.1 security update

An update is now available for Red Hat Fuse. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Support Assistant Team Server (CVE-2014-6457)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 1.7.0 that is used by IBM Support Assistant Team Server. These issues were disclosed as part of the IBM Java SDK updates in October 2014. One of these vulnerabilities affects the IBM Support...

Apache Roller 5.0.3 - XML External Entity Injection (File Disclosure)

Apache Roller 5.0.3 - XML External Entity Injection File Disclosure Exploit Title: Apache Roller 5.0.3 - XML External Entity Injection File Disclosure Google Dork: intext:"apache roller weblogger version vulnerableversionnumber" Date: 2018-09-05 Exploit Author: Marko Jokic Contact:...

Apache Roller 5.0.3 - XML External Entity Injection Exploit

Exploit for linux platform in category web applications Exploit Title: Apache Roller 5.0.3 - XML External Entity Injection File Disclosure Google Dork: intext:"apache roller weblogger version vulnerableversionnumber" Exploit Author: Marko Jokic Contact: http://twitter.com/MarkoJokic Vendor...

Apache Roller 5.0.3 - XML External Entity Injection (File Disclosure)

Exploit Title: Apache Roller 5.0.3 - XML External Entity Injection File Disclosure Google Dork: intext:"apache roller weblogger version vulnerableversionnumber" Date: 2018-09-05 Exploit Author: Marko Jokic Contact: http://twitter.com/MarkoJokic Vendor Homepage: http://roller.apache.org/ Software...

Apache Roller 5.0.3 XML Injection / File Disclosure

Exploit Title: Apache Roller 5.0.3 - XML External Entity Injection File Disclosure Google Dork: intext:"apache roller weblogger version vulnerableversionnumber" Date: 2018-09-05 Exploit Author: Marko Jokic Contact: http://twitter.com/MarkoJokic Vendor Homepage: http://roller.apache.org/ Software...

RHEL 7 : Red Hat JBoss Enterprise Application Platform 6.4.0 update (Important) (RHSA-2015:0848)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:0848 advisory. Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. It was found that a...

CVE-2014-6045

SQL injection vulnerability in phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to execute arbitrary SQL commands via vectors involving the restore function...

CVE-2014-6046

CVE-2014-6046 affects phpMyFAQ prior to 2.8.13. The root cause is lack of CSRF token validation, enabling CSRF to perform actions such as deleting active users, deleting/opening questions, activating users, publishing FAQs, managing Glossary/FAQ news, and adding/deleting comments or votes. The im...

CVE-2014-6047

CVE-2014-6047 affects phpMyFAQ prior to 2.8.13. The vulnerability exists in the download attachments path (phpmyfaq/attachment.php) due to incorrect permission checks, enabling remote authenticated users with some rights (e.g., add/delete attachments) to read arbitrary attachments they should not...