CVE-2014-7860

The CVE-2014-7860 issue affects D-Link DNS-320L (pre-1.04b12) and DNS-327L (pre-1.03b04 Build0119). The web/web_file/fb_publish.php script fails to authenticate requests, enabling remote attackers to obtain arbitrary photos and publish them to a Facebook profile using a target album_id and access...

CVE-2014-7858

The CVE-2014-7858 entry concerns D-Link DNR-326 prior to 2.10 build 03, where the check_login authentication flow is flawed. The weakness allows remote attackers to bypass authentication by manipulating the username cookie parameter, enabling login without proper credentials. Documented impact is...

CVE-2014-7859

Stack-based buffer overflow in loginmgr.cgi in D-Link firmware DNR-320L and DNS-320LW before 1.04b08, DNR-322L before 2.10 build 03, DNR-326 before 2.10 build 03, and DNS-327L before 1.04b01 allows remote attackers to execute arbitrary code by crafting malformed "Host" and "Referer" header values...

CVE-2014-9637

CVE-2014-9637 affects GNU patch up to version 2.7.2 and earlier. The root cause is a crafted diff file triggering a denial of service via memory consumption and a segmentation fault. The vulnerability is cited across multiple advisories (EulerOS, Huawei EulerOS, OpenVAS/Nessus entries) as part of...

CVE-2014-7857

CVE-2014-7857 affects multiple D-Link NAS/DVR devices (DNS-320L, DNS-327L, DNR-326, DNS-320B, DNS-345, DNS-325, DNS-322L). The root issue is a weakness in the authentication flow: an attacker can bypass login by sending the cgi_set_wto command in the cmd parameter and forcing the spawned session ...

CVE-2014-7859

CVE-2014-7859 describes a stack-based buffer overflow in the login_mgr.cgi component of D-Link firmware across DNR-320L, DNS-320LW (pre-1.04b08), DNR-322L (pre-2.10 build 03), DNR-326 (pre-2.10 build 03), and DNS-327L (pre-1.04b01). An attacker can exploit malformed Host and Referer headers to re...

CVE-2014-9637

GNU patch 2.7.2 and earlier allows remote attackers to cause a denial of service memory consumption and segmentation fault via a crafted diff file...

CentOS 7 : pidgin (CESA-2017:1854)

An update for pidgin is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

CVE-2014-4616

Array index error in the scanstring function in the json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the rawdecode function...

CVE-2014-4616

Array index error in the scanstring function in the json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the rawdecode function...

CVE-2014-4616

CVE-2014-4616 affects Python’s json implementation: the scanstring function in the _json module (and in simplejson prior to 2.6.1) has an array index error that can be triggered by a negative idx in raw_decode. Affected: Python 2.7–3.5 and simplejson

kernel, perf, python security update

CentOS Errata and Security Advisory CESA-2017:1842 An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

CVE-2014-6189

The IBM Security Network Protection (XGS) family (models 3100/4100/5100/7100) is affected by CVE-2014-6189 due to a Cross-Site Scripting (XSS) flaw caused by improper validation of user-supplied input in the Web UI. The vulnerability can be exploited remotely by a attacker via a specially crafted...

Scientific Linux Security Update : git on SL7.x x86_64 (20170801)

Security Fixes : - It was found that the git-prompt.sh script shipped with git failed to correctly handle branch names containing special characters. A specially crafted git repository could use this flaw to execute arbitrary commands if a user working with the repository configured their shell t...

Scientific Linux Security Update : python on SL7.x x86_64 (20170801)

Security Fixes : - The Python standard library HTTP client modules such as httplib or urllib did not perform verification of TLS/SSL certificates when connecting to HTTPS servers. A man-in-the-middle attacker could use this flaw to hijack connections and eavesdrop or modify transferred data...

phpMyAdmin Bypass Restriction Vulnerability (PMASA-2014-7) - Windows

phpMyAdmin is prone to a bypass restriction vulnerability via remote authentication. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

phpMyAdmin Multiple XSS Vulnerabilities (PMASA-2014-8) - Linux

phpMyAdmin is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

phpMyAdmin XSS Vulnerability (PMASA-2014-10) - Linux

phpMyAdmin is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

phpMyAdmin Bypass Restriction Vulnerability (PMASA-2014-7) - Linux

phpMyAdmin is prone to a bypass restriction vulnerability via remote authentication. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

phpMyAdmin Multiple XSS Vulnerabilities (PMASA-2014-8) - Windows

phpMyAdmin is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...