Fedora 19 : puppet-3.4.2-1.fc19 (2014-0850)

Update to 3.4.2 to mitigate CVE-2013-4969 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVE...

Fedora 20 : puppet-3.4.2-1.fc20 (2014-0825)

Update to 3.4.2 to mitigate CVE-2013-4969 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVE...

Cross site scripting

Cross-site scripting XSS vulnerability in Drupal 6.x before 6.28 and 7.x before 7.19, when running with older versions of jQuery that are vulnerable to CVE-2011-4969, allows remote attackers to inject arbitrary web script or HTML via vectors involving unspecified Javascript functions that are use...

CVE-2013-0244

Cross-site scripting XSS vulnerability in Drupal 6.x before 6.28 and 7.x before 7.19, when running with older versions of jQuery that are vulnerable to CVE-2011-4969, allows remote attackers to inject arbitrary web script or HTML via vectors involving unspecified Javascript functions that are use...

CVE-2013-0244

Removed by vendor...

CVE-2013-0244

Technical details for CVE-2013-0244 (affected Drupal versions, vulnerable components, impact, and fix) are not publicly provided in the connected documents. Monitor for updates from vendor/security advisories.

CVE-2013-4969

CVE-2013-4969 affects Puppet before 3.3.3 and 3.4 before 3.4.1, and Puppet Enterprise before 2.8.4 and 3.1 before 3.1.1, allowing local users to overwrite arbitrary files via a symlink attack. Connected advisories indicate fixes with Puppet packages updated to 2.7.25 (e.g., Mageia MDVSA-2014:040 ...

Debian DSA-2831-1 : puppet - insecure temporary files

An unsafe use of temporary files was discovered in Puppet, a tool for centralized configuration management. An attacker can exploit this vulnerability and overwrite an arbitrary file in the system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in thi...

[SECURITY] [DSA 2831-1] puppet security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2831-1 [email protected] http://www.debian.org/security/ Luciano Bello December 31, 2013 http://www.debian.org/security/faq -...

Debian Security Advisory DSA 2831-1 (puppet - insecure temporary files)

An unsafe use of temporary files was discovered in Puppet, a tool for centralized configuration management. An attacker can exploit this vulnerability and overwrite an arbitrary file in the system. OpenVAS Vulnerability Test $Id: deb2831.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated fr...

Puppet/Puppet Enterprise不安全临时文件符号链接攻击漏洞

CVE ID:CVE-2013-4969 puppet是一款Linux、Unix、windows平台的集中配置管理系统。 Puppet和Puppet Enterprise使用不安全的临时文件，允许本地攻击者使用符号链接攻击覆盖系统任意文件。 0 Puppet 3.3.2 Puppet 3.4.0 Puppet 2.8.3 Puppet 3.1.0 puppet 2.8.4和3.1.1， puppet 3.3.3和3.4.1已经修复该漏洞，建议用户下载更新： http://puppetlabs.com/...

JVN#28467717: Page Scroller vulnerable to cross-site scripting

Page Scroller from coliss is a script that uses jQuery. In addition to Page Scroller being avaliable just as a script, it is also available as a ZIP archive that includes jQuery and demo files. The jQuery included in the ZIP archive contains a known cross-site scripting vulnerability CVE-2011-496...

CVE-2011-4969

Cross-site scripting XSS vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag...

CVE-2011-4969

CVE-2011-4969 : XSS in jQuery prior to 1.6.3 when using location.hash to select elements. A remote attacker could inject arbitrary script/HTML into a page. Affected: jQuery versions before 1.6.3. Remediation: upgrade to 1.6.3 or later (patches/fixes cited by IBM and vendor advisories). Public ref...

[USN-1722-1] jQuery vulnerability

========================================================================== Ubuntu Security Notice USN-1722-1 February 13, 2013 jquery vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

CFR watering hole attack also target Capstone Turbine Corporation

Last week Council on Foreign Relations website was compromised and recently hit by a drive-by attack using a zero day Internet Explorer 6 vulnerability for Cyber Espionage attack, suspected by Chinese Hackers. Later Microsoft confirmed that Internet Explorer 6, 7, and 8 are vulnerable to remote...

CFR watering hole attack also target Capstone Turbine Corporation

Last week Council on Foreign Relations website was compromised and recently hit by a drive-by attack using a zero day Internet Explorer 6 vulnerability for Cyber Espionage attack, suspected by Chinese Hackers. Later Microsoft confirmed that Internet Explorer 6, 7, and 8 are vulnerable to remote...

CVE-2012-4969

creationtimestamp| type| source ---|---|--- 2012-10-10 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/21840 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ieexeccommanduaf.rb 2020-10-09 16:56:09+00:00|...

Internet Explorer execCommand Use-After-Free (CVE-2012-4969)

A use-after-free vulnerability has been reported in Microsoft Internet Explorer...

Internet Explorer CMshtmlEd execCommand Use After Free

Added: 09/19/2012 CVE: CVE-2012-4969 BID: 55562 OSVDB: 85532 Background Internet Explorer is an HTML web browser which comes by default on Microsoft operating systems. Problem Internet Explorer does not properly clean up references to objects passed to the execCommand Javascript method. If...