CVE-2014-5001

CVE-2014-5001 affects the Ruby gem kcapifony (version 2.1.6) via the file lib/ksymfony1.rb . The underlying issue is that the program places database user passwords on the command line for the tools mysqldump , pg_dump , mysql , and psql , which allows local users to obtain sensitive information ...

CVE-2014-5001

lib/ksymfony1.rb in the kcapifony gem 2.1.6 for Ruby places database user passwords on the 1 mysqldump, 2 pgdump, 3 mysql, and 4 psql command lines, which allows local users to obtain sensitive information by listing the processes...

CVE-2014-4998

test/tcdatabase.rb in the lean-ruport gem 0.3.8 for Ruby places the mysql user password on the mysqldump command line, which allows local users to obtain sensitive information by listing the process...

CVE-2014-4995

Vulnerability CVE-2014-4995 affects the VladTheEnterprising Ruby gem (version ~0.2); a race condition in lib/vlad/dba/mysql.rb allows local users to obtain the MySQL root password from a temporary file before it is removed. Related advisories describe insecure temporary file handling and potentia...

CVE-2014-4992

The CVE-2014-4992 issue affects the Cap-Strap gem for Ruby (version 0.1.5). The underlying flaw is that lib/cap-strap/helpers.rb places credentials on the useradd command line, making them observable in the process list by local users. This yields a local plaintext credential disclosure vulnerabi...

CVE-2014-4991

CVE-2014-4991 affects the Ruby gem codders-dataset (version 1.3.2.1). The vulnerability is in two files, lib/dataset/database/mysql.rb and lib/dataset/database/postgresql.rb, where credentials are placed on the mysqldump command line. This allows a local user to obtain sensitive information by li...

CVE-2014-4993

1 lib/backup/cli/utility.rb in the backup-agoddard gem 3.0.28 and 2 lib/backup/cli/utility.rb in the backupchecksum gem 3.0.23 for Ruby place credentials on the openssl command line, which allows local users to obtain sensitive information by listing the process...

CVE-2014-4993

CVE-2014-4993 affects the Ruby backups gems backup-agoddard (version 3.0.28) and backup_checksum (version 3.0.23). The vulnerability lies in lib/backup/cli/utility.rb, which places credentials on the openssl command line, allowing local users to obtain sensitive information by listing the process...

CVE-2014-1859

1 core/tests/testmemmap.py, 2 core/tests/testmultiarray.py, 3 f2py/f2py2e.py, and 4 lib/tests/testio.py in NumPy before 1.8.1 allow local users to write to arbitrary files via a symlink attack on a temporary file...

CVE-2014-3607

DefaultHostnameVerifier in Ldaptive formerly vt-ldap does not properly verify that the server hostname matches a domain name in the subject's Common Name CN field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2014-5509

clipedit in the Clipboard module for Perl allows local users to delete arbitrary files via a symlink attack on /tmp/clipedit$$...

DEBIAN-CVE-2014-3607

DefaultHostnameVerifier in Ldaptive formerly vt-ldap does not properly verify that the server hostname matches a domain name in the subject's Common Name CN field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2014-5071

SQL injection vulnerability in the checkPassword function in Symmetricom s350i 2.70.15 allows remote attackers to execute arbitrary SQL commands via vectors involving a username...

CVE-2014-3607

DefaultHostnameVerifier in Ldaptive formerly vt-ldap does not properly verify that the server hostname matches a domain name in the subject's Common Name CN field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2014-3607

DefaultHostnameVerifier in Ldaptive formerly vt-ldap does not properly verify that the server hostname matches a domain name in the subject's Common Name CN field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2014-3607

DefaultHostnameVerifier in Ldaptive formerly vt-ldap does not properly verify that the server hostname matches a domain name in the subject's Common Name CN field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2014-1859

CVE-2014-1859 affects NumPy up to version 1.8.1 and allows local users to write to arbitrary files via a symlink attack on a temporary file. The vulnerable components listed in the CVE entry are: core/tests/test_memmap.py, core/tests/test_multiarray.py, f2py/f2py2e.py, and lib/tests/test_io.py. T...

CVE-2014-5509

clipedit in the Clipboard module for Perl allows local users to delete arbitrary files via a symlink attack on /tmp/clipedit$$...

CVE-2014-5069

CVE-2014-5069 affects Microsemi Symmetricom s350i, specifically version 2.70.15. The vulnerability is a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via vectors involving system logs. Connected sources corroborate the product (s350i) and vers...

CVE-2014-7221

TeamSpeak Client 3.0.14 and earlier allows remote authenticated users to cause a denial of service buffer overflow and application crash by connecting to a channel with a different client instance, and placing crafted data in the Chat/Server tab containing img//http:// substrings...