Updated polkit package fixes security vulnerabilities

Local privilege escalation in polkit before 0.113 due to predictable authentication session cookie values CVE-2015-4625. Various memory corruption vulnerabilities in polkit before 0.113 in the use of the JavaScript interpreter, possibly leading to local privilege escalation CVE-2015-3256. Memory...

CVE-2013-4625

Cross-site scripting XSS vulnerability in files/installer.cleanup.php in the Duplicator plugin before 0.4.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the package parameter...

CVE-2013-4625

The CVE-2013-4625 entry concerns WordPress Duplicator Plugin (vulnerable up to 0.4.4, fixed in 0.4.5). The vulnerability is an XSS in files/installer.cleanup.php where the package parameter is insufficiently sanitized, allowing remote attackers to inject arbitrary script/HTML. Evidence from multi...

Cross-Site Scripting (XSS) in Duplicator WordPress Plugin

Advisory ID: HTB23162 Product: Duplicator WordPress Plugin Vendor: LifeInTheGrid Vulnerable Versions: 0.4.4 and probably prior Tested Version: 0.4.4 Vendor Notification: June 19, 2013 Vendor Patch: July 21, 2013 Public Disclosure: July 24, 2013 Vulnerability Type: Cross-Site Scripting CWE-79 CVE...

WordPress Duplicator 0.4.4 Cross Site Scripting

No description provided by source. Advisory ID: HTB23162 Product: Duplicator WordPress Plugin Vendor: LifeInTheGrid Vulnerable Versions: 0.4.4 and probably prior Tested Version: 0.4.4 Vendor Notification: June 19, 2013 Vendor Patch: July 21, 2013 Public Disclosure: July 24, 2013 Vulnerability Typ...

WordPress Duplicator 0.4.4 Cross Site Scripting

Advisory ID: HTB23162 Product: Duplicator WordPress Plugin Vendor: LifeInTheGrid Vulnerable Versions: 0.4.4 and probably prior Tested Version: 0.4.4 Vendor Notification: June 19, 2013 Vendor Patch: July 21, 2013 Public Disclosure: July 24, 2013 Vulnerability Type: Cross-Site Scripting CWE-79 CVE...

PHP < 5.2.0 Multiple Vulnerabilities

PHP is prone to multiple vulnerabilities. Copyright C 2012 NopSec Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or...

Debian Security Advisory DSA 2330-1 (simplesamlphp)

The remote host is missing an update to simplesamlphp announced via advisory DSA 2330-1. OpenVAS Vulnerability Test $Id: deb23301.nasl 8970 2018-02-27 15:16:18Z cfischer $ Description: Auto-generated from advisory DSA 2330-1 simplesamlphp Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft...

CVE-2010-4625

Affected software: MyBB (MyBulletinBoard) prior to version 1.4.12. Vulnerable component: portal page Latest Threads block that may read hidden threads. Root cause: mis-handling of a configuration where a visible forum contains hidden threads, enabling information disclosure. Impact: remote attack...

CVE-2009-4625

The CVE-2009-4625 entry concerns BF Survey Pro Free (com_bfsurvey_profree) for Joomla! where the updateOnePage action (table parameter) is vulnerable to SQL injection. Affected versions include 1.2.4 and other versions prior to 1.2.6. The vulnerability arises from improper validation of the table...

CVE-2009-4625

creationtimestamp| type| source ---|---|--- 2009-09-09 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/9601...

CVE-2008-4625

The CVE-2008-4625 issue concerns the WordPress plugin ShiftThis Newsletter (st_newsletter). A SQL injection exists in the stnl_iframe.php component, exploitable by remote attackers via the newsletter parameter. This aligns with multiple sources (WPVulndb entries for st_newsletter SQL injection an...

CVE-2008-4625

creationtimestamp| type| source ---|---|--- 2008-10-17 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/6777...

Ubuntu 5.04 / 5.10 / 6.06 LTS : php4, php5 vulnerabilities (USN-362-1)

The stripos function did not check for invalidly long or empty haystack strings. In an application that uses this function on arbitrary untrusted data this could be exploited to crash the PHP interpreter. CVE-2006-4485 An integer overflow was discovered in the PHP memory allocation handling. On...

CVE-2007-4625

Polipo prior to 1.0.2 is affected. It allows remote HTTP servers to cause a denial of service (daemon crash) by aborting the response to a POST request. No remediation details are provided in the supplied documents.

SUSE-SA:2006:059: php4,php5

The remote host is missing the patch for the advisory SUSE-SA:2006:059 php4,php5. The inirestore method could be exploited to reset options such as openbasedir when set via the web server config file to their default value set in php.ini CVE-2006-4625. Additionally php5 on all products as well as...

Mandrake Linux Security Advisory : php (MDKSA-2006:185)

PHP 4.x up to 4.4.4 and PHP 5 up to 5.1.6 allows local users to bypass certain Apache HTTP Server httpd.conf options, such as safemode and openbasedir, via the inirestore function, which resets the values to their php.ini Master Value defaults. CVE-2006-4625 A race condition in the symlink functi...

phpBypass.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 PHP 5.1.6 / 4.4.4 Critical phpadmin bypass by inirestore Author: Maksymilian Arciemowicz cXIb8O3 Date: - - Written: 05.09.2006 - - Public: 09.09.2006 SecurityAlert Id: 42 CVE: CVE-2006-4625 SecurityRisk: High Affected Software: PHP 5.1.6 / 4.4.4 = x...

CVE-2006-4625

PHP 4.x up to 4.4.4 and PHP 5 up to 5.1.6 allows local users to bypass certain Apache HTTP Server httpd.conf options, such as safemode and openbasedir, via the inirestore function, which resets the values to their php.ini Master Value defaults...

CVE-2006-4625

CVE-2006-4625 affects PHP 4.x up to 4.4.4 and PHP 5 up to 5.1.6. The root cause is the ini_restore function resetting values to php.ini Master Value defaults, allowing local users to bypass Apache httpd.conf protections such as safe_mode and open_basedir. The provided documents describe the vulne...