Apache Software Foundation Releases Security Updates

The Apache Foundation has released security updates to address vulnerabilities in Apache Tomcat. Exploitation of one of these vulnerabilities may cause a remote attacker to obtain sensitive information. Users and administrators are encouraged to review Apache.org CVE-2017-5648, CVE-2017-5650, and...

Fixed in Apache Tomcat 9.0.0.M18

Low: Information Disclosure CVE-2017-5648 While investigating bug 60718, it was noticed that some calls to application listeners did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to...

CVE-2015-5648

CVE-2015-5648 concerns phpRechnung where the vulnerable component is the list.php script. The affected product is phpRechnung, version prior to 1.6.5. The root cause is an SQL injection (CWE-89) in list.php that allows a remote authenticated user to execute arbitrary SQL commands via unspecified ...

Fedora 21 : libdigidoc-3.9.1.1191-1.fc21 (2014-14892)

New upstream release Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable...

CVE-2014-5648

CVE-2014-5648 affects the Android app “Chat, Flirt & Dating Heart JAUMO” (com.jaumo) at version 2.7.5. The vulnerability is that the app does not verify X.509 certificates when connecting to SSL servers, which enables a man-in-the-middle attacker to spoof servers and exfiltrate sensitive data via...

Mandriva Linux Security Advisory : libdigidoc (MDVSA-2013:225)

Updated libdigidoc packages fix security vulnerability : Fixed one critical bug in the DDOC parsing routines. By persuading a victim to open a specially crafted DDOC file, a remote attacker could exploit this vulnerability to overwrite arbitrary files on the system with the privileges of the vict...

CVE-2013-5648

Affected software: libdigidoc (library) 3.6.0.0 used by ID-software before 3.7.2; component: DigiDocSAXParser.c (handleStartDataFile); vulnerability type: absolute path traversal. Root cause: unvalidated filename beginning with / or \ in a DDOC file allows remote attackers to overwrite arbitrary ...

CVE-2013-5648

Absolute path traversal vulnerability in the handleStartDataFile function in DigiDocSAXParser.c in libdigidoc 3.6.0.0, as used in ID-software before 3.7.2 and other products, allows remote attackers to overwrite arbitrary files via a filename beginning with / slash or \ backslash in a DDOC file...

CVE-2008-5648

DeltaScripts PHP Shop 1.0 is vulnerable to SQL injection in admin/login.php via the admin_username parameter. The underlying issue is an unsafely handled input that allows remote attackers to modify the SQL executed by the application, enabling arbitrary SQL commands. This vulnerability is docume...

CVE-2008-5648

creationtimestamp| type| source ---|---|--- 2008-11-06 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/7025...

CVE-2007-5648

CVE-2007-5648 describes multiple cross-site scripting (XSS) vulnerabilities in rnote.php of rNote 0.9.7.5, enabling remote attackers to inject arbitrary script or HTML via the d or u parameters. The NVD entry assigns a medium base score (4.3) with network access and no authentication required, pa...

CVE-2006-5648

CVE-2006-5648 is a local kernel vulnerability affecting Ubuntu 6.10 on PowerPC, allowing local users to create unkillable processes via sys_get_robust_list and sys_set_robust_list; related entries note a PowerPC futex implementation issue and alignment-check fix that could cause a crash. The conn...