CVE-2014-5353

The krb5ldapgetpasswordpolicyfromdn function in plugins/kdb/ldap/libkdbldap/ldappwdpolicy.c in MIT Kerberos 5 aka krb5 before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service daemon crash via a successful LDAP query with no results, as demonstrated by...

CVE-2014-5354

MIT Kerberos 5 (krb5) 1.12.x and 1.13.x before 1.13.1 is vulnerable when the KDC uses LDAP: ldap_principal2.c can NULL-deref if a keyless principal is added (e.g., kadmin -nokey), leading to a denial of service via daemon crash. The vulnerability requires authentication and arises from specific L...

CVE-2014-5354

plugins/kdb/ldap/libkdbldap/ldapprincipal2.c in MIT Kerberos 5 aka krb5 1.12.x and 1.13.x before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service NULL pointer dereference and daemon crash by creating a database entry for a keyless principal, as...

CVE-2014-5353

The krb5ldapgetpasswordpolicyfromdn function in plugins/kdb/ldap/libkdbldap/ldappwdpolicy.c in MIT Kerberos 5 aka krb5 before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service daemon crash via a successful LDAP query with no results, as demonstrated by...

CVE-2014-5354

plugins/kdb/ldap/libkdbldap/ldapprincipal2.c in MIT Kerberos 5 aka krb5 1.12.x and 1.13.x before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service NULL pointer dereference and daemon crash by creating a database entry for a keyless principal, as...

CVE-2014-5353

The krb5ldapgetpasswordpolicyfromdn function in plugins/kdb/ldap/libkdbldap/ldappwdpolicy.c in MIT Kerberos 5 aka krb5 before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service daemon crash via a successful LDAP query with no results, as demonstrated by...

CVE-2014-9245

Zenoss Core through 5 Beta 3 allows remote attackers to obtain sensitive information by attempting a product-rename action with an invalid new name and then reading a stack trace, as demonstrated by internal URL information, aka ZEN-15382...

Cross site scripting

Zenoss Core through 5 Beta 3 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service memory and CPU consumption via a crafted XML document containing a large number of nested entity references, aka ZEN-15414, a similar issue to...

CVE-2014-6259

Zenoss Core through 5 Beta 3 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service memory and CPU consumption via a crafted XML document containing a large number of nested entity references, aka ZEN-15414, a similar issue to...

CVE-2014-6261

Zenoss Core through 5 Beta 3 does not properly implement the Check For Updates feature, which allows remote attackers to execute arbitrary code by 1 spoofing the callhome server or 2 deploying a crafted web site that is visited during a login session, aka ZEN-12657...

CVE-2014-6257

Zenoss Core (through 5 Beta 3) contains a systemic authorization bypass (CVE-2014-6257) that lets remote attackers use a web-endpoint URL to invoke an object helper method, bypassing access restrictions. Affects Zenoss Core 4.x/5 Beta 3; no exploit details are provided in the sources. Remediation...

CVE-2014-6258

An unspecified endpoint in Zenoss Core through 5 Beta 3 allows remote attackers to cause a denial of service CPU consumption by triggering an arbitrary regular-expression match attempt, aka ZEN-15411...

CVE-2014-9245

CVE-2014-9245 affects Zenoss Core up to version 5 Beta 3. The vulnerability allows remote attackers to obtain sensitive information by performing a product-rename action with an invalid new name and then reading a stack trace that exposes internal URLs and other sensitive information. The availab...

CVE-2014-9245

Zenoss Core through 5 Beta 3 allows remote attackers to obtain sensitive information by attempting a product-rename action with an invalid new name and then reading a stack trace, as demonstrated by internal URL information, aka ZEN-15382...

Oracle Linux 5 : xorg-x11-server (ELSA-2014-1982)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1982 advisory. - CVE-2014-8091 denial of service due to unchecked malloc in client authentication 1168680 - CVE-2014-8092 integer overflow in X11 core protocol reques...

Oracle Linux 5 / 6 / 7 : bind (ELSA-2014-1984)

The remote Oracle Linux 5 / 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2014-1984 advisory. 32:9.9.4-14.0.1.el70.1 - Rebuild to fix libmysqlclient dependency 32:9.9.4-14.1 - Fix CVE-2014-8500 1171975 Tenable has extracted the preceding...

RHEL 5 : bind97 (RHSA-2014:1985)

"Updated bind97 packages that fix one security issue are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fr...

RHEL 6 : flash-plugin (RHSA-2014:1981)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2014:1981 advisory. The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. This update fixes multiple...

CentOS 5 : xorg-x11-server (CESA-2014:1982)

Updated xorg-x11-server packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

CentOS 5 : bind97 (CESA-2014:1985)

"Updated bind97 packages that fix one security issue are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fr...