1225 matches found
CVE-2015-5037
Cross-site request forgery CSRF vulnerability in IBM Connections 3.x before 3.0.1.1 CR3, 4.0 before CR4, 4.5 before CR5, and 5.0 before CR3 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences...
CVE-2015-5299
The shadowcopy2getshadowcopydata function in modules/vfsshadowcopy2.c in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 does not verify that the DIRECTORYLIST access right has been granted, which allows remote attackers to access snapshots by visiting a shadow copy...
CVE-2015-7529
sosreport in SoS 3.x allows local users to obtain sensitive information from sosreport files or gain privileges via a symlink attack on an archive file in a temporary directory, as demonstrated by sosreport-$hostname-$date.tar in /tmp/sosreport-$hostname-$date...
cckseblod 1.x Directory Traversal
comcckseblod aka seblod 1.x for Joomla 1.5 1.9.0 and all previous versions Directory Traversal Resolution: update to 1.9.1 Update notice: http://www.seblod.com/changelogs?sebchangelogproduct=cck1x Developer states that Seblod 3.x, the version compatible with Joomla 2.5 and 3, is not vulnerable...
CVE-2013-4739
The MSM camera driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center QuIC Android contributions for MSM devices and other products, allows attackers to obtain sensitive information from kernel stack memory via 1 a crafted MSMMCRIOCTLEVTGET ioctl call, related to...
CVE-2013-6122
goodixtool.c in the Goodix gt915 touchscreen driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center QuIC Android contributions for MSM devices and other products, does not properly synchronize updates to a global variable, which allows local users to bypass intended access...
Squid 3.x < 3.5.6 Multiple Vulnerabilities
Binary data 8951.prm...
Squid HTTP Range Request Handling DoS Vulnerability (SQUID-2014:2)
Squid is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:squid-cache:squid";...
[SECURITY] Fedora 22 Update: php-guzzle-Guzzle-3.9.3-5.fc22
Guzzle takes the pain out of sending HTTP requests and the redundancy out of creating web service clients. Guzzle is a framework that includes the tools needed to create a robust web service client, including: Service descriptions for defining the inputs and outputs of an API, resource iterators...
CakePHP 2.5.9, 2.6.11 & 2.7.2 Released
CakePHP 2.5.9, 2.6.11 & 2.7.2 Released The CakePHP core team is ready to announce the immediate availability of CakePHP 2.5.9, 2.6.11, and 2.7.2. These releases contain important security updates for applications using prefix routing. Security Issues There are two issues that can impact the...
CVE-2004-2777
GE Healthcare Centricity Image Vault 3.x has a password of 1 gemnet for the administrator account, 2 webadmin for the webadmin administrator account of the ASACA DVD library, 3 an empty value for the gemsservice account of the Ultrasound Database, and possibly 4 gemnet2002 for the gemnet2002...
CVE-2015-3226
CVE-2015-3226 is an XSS vulnerability in Active Support's JSON encoding (ActiveSupport::JSON.encode) where a Hash with user-controlled data is mishandled during JSON encoding, potentially injecting script/HTML when inserted into HTML. Affected are Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2...
CVE-2015-1840
CVE-2015-1840 describes a CSRF/XSS-style risk in Rails tooling: jquery_ujs.js and rails.js could cause a CSRF token to be transmitted to a different-domain server when a URL attribute contains a leading space. This bypasses the Same Origin Policy under supported Rails setups (Rails 3.x/4.x with j...
Joomla! 3.x < 3.4.2 Multiple Vulnerabilities
According to its self-reported version number, the Joomla! installation running on the remote web server is 3.x prior to 3.4.2. It is, therefore, affected by multiple vulnerabilities : - A cross-site request forgery XSRF vulnerability exists due to a failure to require explicit confirmation or a...
CVE-2015-0544
EMC Secure Remote Services Virtual Edition (ESRS VE) before 3.06 is affected by insufficient randomness in session cookie generation, enabling potential session hijacking. Affected versions include ESRS VE 3.02–3.04; EMC released 3.06 to address this issue. The vulnerability is documented as a hi...
F5 Enterprise Manager - ConfigSync IP Rsync full file system access vulnerability CVE-2014-2927
F5 Networks Enterprise Manager is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Squid 3.x < 3.2.9 / 3.3.x < 3.3.3 DoS
Binary data 8635.prm...
Unrestricted file upload
Unrestricted file upload vulnerability in goaudiostore.php in the audiostore Voice Files upload functionality in GoAutoDial GoAdmin CE 3.x before 3.3-1421902800 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct reque...
CVE-2015-2842
Unrestricted file upload vulnerability in goaudiostore.php in the audiostore Voice Files upload functionality in GoAutoDial GoAdmin CE 3.x before 3.3-1421902800 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct reque...