tnftp - 'savefile' Arbitrary Command Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'tnftp "savefile" Arbitrary Command Execution', 'Description' = %q This module exploits an arbitrary command execution vulnerability in tnftp's...

Moderate: Red Hat Security Advisory: liblouis security update

An update for liblouis is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

liblouis security update

2.5.2-11 - Resolves: CVE-2017-13738, CVE-2017-13740, CVE-2017-13741, CVE-2017-13742, CVE-2017-13743, CVE-2017-13744, CVE-2014-8184...

CVE-2014-0073

The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin org.apache.cordova.inappbrowser before 0.3.2 for iOS and the In-App-Browser plugin for iOS from Cordova 2.6.0 through 2.9.0 does not properly validate callback identifiers, which allows remote attackers to execute...

CVE-2014-0072

ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin org.apache.cordova.file-transfer before 0.4.2 for iOS and the File-Transfer plugin for iOS from Cordova 2.4.0 through 2.9.0 might allow remote attackers to spoof SSL servers by leveraging a default value of true for the...

CVE-2014-0072

CVE-2014-0072 affects the Apache Cordova File-Transfer stack on iOS. The File-Transfer plugin for iOS (Cordova 2.4.0–2.9.0) and the standalone File-Transfer plugin (org.apache.cordova.file-transfer) prior to 0.4.2 default the trustAllHosts option to true, allowing remote attackers to spoof SSL se...

CVE-2014-0072

ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin org.apache.cordova.file-transfer before 0.4.2 for iOS and the File-Transfer plugin for iOS from Cordova 2.4.0 through 2.9.0 might allow remote attackers to spoof SSL servers by leveraging a default value of true for the...

CVE-2014-0115

The CVE-2014-0115 entry describes a directory traversal vulnerability in the log viewer of Apache Storm 0.9.0.1. An attacker can use a .. sequence in the log file parameter to read arbitrary files, potentially exposing sensitive data. The connected sources reiterate this flaw (path traversal in A...

CVE-2014-3624

Apache Traffic Server 5.1.x before 5.1.1 allows remote attackers to bypass access restrictions by leveraging failure to properly tunnel remap requests using CONNECT...

CVE-2014-3624

Apache Traffic Server 5.1.x before 5.1.1 allows remote attackers to bypass access restrictions by leveraging failure to properly tunnel remap requests using CONNECT...

CVE-2014-3526

Apache Wicket is vulnerable to information disclosure in versions prior to 1.5.12, 6.x prior to 6.17.0, and 7.x prior to 7.0.0-M3. The issue allows remote attackers to obtain sensitive information via identifiers used for storing page markup during temporary user sessions. Connected sources confi...

CVE-2014-3624

CVE-2014-3624 affects Apache Traffic Server (ATS) 5.1.x before 5.1.1 . The issue is a failure to properly tunnel remap requests using CONNECT , allowing remote attackers to bypass access restrictions. Root cause described as improper handling of CONNECT tunneling for remap requests. Impact is byp...

CVE-2014-3579

XML external entity XXE vulnerability in Apache ActiveMQ Apollo 1.x before 1.7.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages...

CVE-2014-3600

XML external entity XXE vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages...

CVE-2014-3600

XML external entity XXE vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages...

CVE-2014-3579

XML external entity XXE vulnerability in Apache ActiveMQ Apollo 1.x before 1.7.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages...

CVE-2014-3600

CVE-2014-3600 is an XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x prior to 5.10.1. The issue allows remote consumers to trigger an XXE via an XPath-based selector when dequeuing XML messages, potentially exposing sensitive data. Public sources in the connected docs confirm Active...

CVE-2014-3579

CVE-2014-3579 is an XML External Entity (XXE) vulnerability in Apache ActiveMQ Apollo 1.x before 1.7.1. Described across multiple sources as allowing a remote attacker to obtain sensitive information by crafting XML data processed by the broker (via an XPath-based selector during dequeue). The pu...

CVE-2014-3600

XML external entity XXE vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages...

CVE-2014-2023

CVE-2014-2023 describes SQL injection in the Tapatalk plugin for vBulletin (versions 4.9.0 and earlier and 5.x up to 5.2.1). A remote attacker can trigger arbitrary SQL execution via crafted XML-RPC requests to mobiquo/functions/unsubscribe_forum.php or unsubscribe_topic.php. Affected product: Ta...