Security fix for the ALT Linux 8 package samba-DC version 4.4.2-alt1

April 12, 2016 Andrey Cherepanov 4.4.2-alt1 - New version - Security fixes: - CVE-2015-5370 Multiple errors in DCE-RPC code - CVE-2016-2110 Man in the middle attacks possible with NTLMSSP - CVE-2016-2111 NETLOGON Spoofing Vulnerability - CVE-2016-2112 LDAP client and server don't enforce integrit...

samba3x security update

3.6.23-12.0.1 - Remove use-after-free talloctos inlined function problem John Haxby orabug 19973497 3.6.23-12 - related: 1322685 - Update CVE patchset 3.6.23-11 - related: 1322685 - Update CVE patchset 3.6.23-10 - resolves: 1322685 - Fix CVE-2015-5370 - resolves: 1322685 - Fix CVE-2016-2110 -...

Debian: Security Advisory (DSA-3548-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2015-2115

HP Capture and Route Software (HPCR) is affected by CVE-2015-2115, with vulnerable versions HPCR 1.3, HPCR 1.3 FP1, and HPCR 1.4. The issue enables remote information disclosure for authenticated users via unknown vectors. HP’s Security Bulletin HPSBPI03315 rev.1/rev.2 lists affected versions and...

OpenEMR 'validateUser.php' SQLi Vulnerability - Active Check

OpenEMR is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:open-emr:openemr";...

Adobe Shockwave Player <= 11.5.9.620 (APSB11-17) (Mac OS X)

The remote Mac OS X host contains a version of Adobe Shockwave Player that is 11.5.9.620 or earlier. It is, therefore, affected by multiple vulnerabilities : - Multiple memory corruption vulnerabilities affect the 'Dirapi.dll' component that can result in arbitrary code execution. CVE-2011-0317,...

Apache Struts includeParams Remote Code Execution

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3...

CVE-2014-2115

CVE-2014-2115 affects Cisco Emergency Responder (ER) CERUserServlet pages in ER 8.6 and earlier. The root cause is insufficient CSRF protections, enabling unauthenticated, remote attackers to abuse an authenticated user’s session to perform unauthorized actions. Impact is session hijacking via CS...

CVE-2014-2115

Multiple cross-site request forgery CSRF vulnerabilities in CERUserServlet pages in Cisco Emergency Responder ER 8.6 and earlier allow remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCun24250...

Security Advisory-Multiple Apache Struts2 Vulnerabilities in Huawei Products

Apache Struts2 is a second-generation and enterprise-ready Java web application framework based on the Model-View-Controller MVC architecture. This advisory describes four vulnerabilities of Apache Struts 2.0.0 - 2.3.15. Huawei products and applications using the above versions of Apache Struts a...

Apache Struts2 'URL' & 'Anchor' tags Arbitrary Java Method Execution Vulnerabilities

This host is running Apache Struts2 and is prone to arbitrary java method execution vulnerabilities. OpenVAS Vulnerability Test $Id: gbapachestruts2javamethodexecvuln.nasl 8373 2018-01-11 10:29:41Z cfischer $ Apache Struts2 'URL' & 'Anchor' tags Arbitrary Java Method Execution Vulnerabilities...

Apache Struts URL includeParams Attribute OGNL Code Injection

Added: 07/18/2013 CVE: CVE-2013-2115 BID: 60167 OSVDB: 93645 Background Apache Struts is an open-source web application framework for developing Java EE web applications. It uses and extends the Java Servlet API to encourage developers to adopt a model-view-controller MVC architecture. Problem...

Apache Struts URL includeParams Attribute OGNL Code Injection

Added: 07/18/2013 CVE: CVE-2013-2115 BID: 60167 OSVDB: 93645 Background Apache Struts is an open-source web application framework for developing Java EE web applications. It uses and extends the Java Servlet API to encourage developers to adopt a model-view-controller MVC architecture. Problem...

Apache Struts URL includeParams Attribute OGNL Code Injection

Added: 07/18/2013 CVE: CVE-2013-2115 BID: 60167 OSVDB: 93645 Background Apache Struts is an open-source web application framework for developing Java EE web applications. It uses and extends the Java Servlet API to encourage developers to adopt a model-view-controller MVC architecture. Problem...

CVE-2013-2115

Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the 1 URL or 2 A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966...

CVE-2013-2115

creationtimestamp| type| source ---|---|--- 2013-06-05 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/25980 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/strutsincludeparams.rb 2025-02-06 03:13:41+00:00| see...

Apache Struts URL and Anchor tag includeParams OGNL Command Execution (CVE-2013-1966; CVE-2013-2115)

The url/a tags resolve every parameter passed to them, allowing arbitrary OGNL expressions encoded into the URL to be evaluated bypassing both Struts and OGNL library protections. Successful exploitation will allow an attacker to execute arbitrary commands in the context of the server...

Apache Struts 'includeParams' 不完整修复安全绕过漏洞(CVE-2013-2115)

BUGTRAQ ID: 60167 CVECAN ID: CVE-2013-2115 Struts2 是第二代基于Model-View-Controller MVC模型的java企业级web应用框架。它是WebWork和Struts社区合并后的产物。 Apache Struts 2.0.0-2.3.14.1存在未彻底修复的安全措施绕过漏洞（CVE-2013-1966），攻击者可利用此漏洞以当前用户权限执行任意代码。此漏洞已经在Struts 2.3.14.2中修复。 0 Apache Group Struts2 2.0.0 - 2.3.14.1 厂商补丁： Apache ------...

CVE-2012-2115

CVE-2012-2115 affects OpenEMR (interface/login/validateUser.php) where SQL injection via the u parameter allows remote attackers to execute arbitrary SQL commands. Affected: OpenEMR 4.1.0 and possibly earlier. Root cause: unsafely constructed SQL from user input. Impact: partial confidentiality/i...

CVE-2011-2115

IML32.dll in Adobe Shockwave Player before 11.6.0.626 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted tSAC chunk, which triggers a heap-based buffer overflow, a different vulnerability than CVE-2011-2111 and CVE-2011-2116...