Input validation

Drupal 6.x before 6.31 and 7.x before 7.27 does not properly isolate the cached data of different anonymous users, which allows remote anonymous users to obtain sensitive interim form input information in opportunistic situations via unspecified vectors...

CVE-2014-2983

Drupal 6.x before 6.31 and 7.x before 7.27 does not properly isolate the cached data of different anonymous users, which allows remote anonymous users to obtain sensitive interim form input information in opportunistic situations via unspecified vectors...

Debian: Security Advisory (DSA-2912-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle Linux 6 : qemu-kvm (ELSA-2014-0420)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0420 advisory. - kvm-qcow2-Check-backingfileoffset-CVE-2014-0144.patch bz1079452 bz1079453 - kvm-qcow2-Check-refcount-table-size-CVE-2014-0144.patch bz1079452 bz10794...

Drupal 6.x < 6.31 Forms API Information Disclosure

The remote web server is running a version of Drupal that is 6.x prior to 6.31. It is, therefore, affected by an error related to the HTML form API and the caching of pages for different anonymous users, which could allow sensitive information to be disclosed. Note that Drupal core does not expos...

Oracle Linux 6 : Unbreakable Enterprise kernel (ELSA-2014-3018)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2014-3018 advisory. 3.8.13-26.2.3.el6uek - net: ipv4: current groupinfo should be put after using. Wang, Xiaoming Orabug: 18603523 CVE-2014-2851 Tenable has extracted the preceding...

Oracle Java SE 5.x, 6.x, 7.x, 8.x Multiple Vulnerabilities (cpuapr2014) - Windows

Oracle Java SE is prone to multiple vulnerabilities. Copyright C 2014 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2014-3019)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2014-3019 advisory. 2.6.39-400.214.5 - net: ipv4: current groupinfo should be put after using. Wang, Xiaoming Orabug: 18603524 CVE-2014-2851 Tenable has extracted the preceding...

CentOS 6 : java-1.7.0-openjdk (CESA-2014:0406)

Updated java-1.7.0-openjdk packages that fix various security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Critical security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

CentOS 5 / 6 : java-1.6.0-openjdk (CESA-2014:0408)

Updated java-1.6.0-openjdk packages that fix various security issues and one bug are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give...

Debian: Security Advisory (DSA-2909-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle Linux 6 : java-1.7.0-openjdk (ELSA-2014-0406)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0406 advisory. 1.7.0.51-2.4.7.1.0.1.el65 - Update DISTRONAME in specfile 1.7.0.51-2.4.7.1.el6 - regenerated sources to fix TCK failure - Resolves: rhbz1085002...

SA-CORE-2014-002 - Drupal core - Information Disclosure

Drupal's form API has built-in support for temporary storage of form state, for example user input. This is often used on multi-step forms, and is required on Ajax-enabled forms in order to allow the Ajax calls to access and update interim user input on the server. When pages are cached for...

Design/Logic Flaw

Untrusted search path vulnerability in a certain Red Hat build script for the ibmssh executable in ibutils packages before ibutils-1.5.7-2.el6 in Red Hat Enterprise Linux RHEL 6 and ibutils-1.2-11.2.el5 in Red Hat Enterprise Linux RHEL 5 allows local users to gain privileges via a Trojan Horse...

CVE-2008-3277

Untrusted search path vulnerability in a certain Red Hat build script for the ibmssh executable in ibutils packages before ibutils-1.5.7-2.el6 in Red Hat Enterprise Linux RHEL 6 and ibutils-1.2-11.2.el5 in Red Hat Enterprise Linux RHEL 5 allows local users to gain privileges via a Trojan Horse...

CVE-2008-3277

CVE-2008-3277 describes an untrusted search path (RPATH) vulnerability in ibutils, specifically in the Red Hat build script for the ibmssh executable. The issue allows local privilege escalation via a Trojan Horse program in refix/lib/ due to an incorrect ELF header RPATH. Affected products/versi...

Stack overflow

Multiple stack-based buffer overflows on the ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00BFQ.6C0 allow man-in-the-middle attackers to execute arbitrary code via 1 a long temp attribute in a yweather:condition element in a forecastrss file that is processed by the checkWeather...

Hardcoded credentials

The ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00BFQ.6C0 has a hardcoded password of qweasdzxc for an unspecified account, which allows remote attackers to obtain index.asp login access via an HTTP request...

CVE-2014-0355

Multiple stack-based buffer overflows on the ZyXEL Wireless N300 NetUSB NBG-419N router with firmware 1.00BFQ.6C0 allow man-in-the-middle attackers to execute arbitrary code via 1 a long temp attribute in a yweather:condition element in a forecastrss file that is processed by the checkWeather...

Security fix for the ALT Linux 6 package adobe-flash-player version 3:11-alt28

3:11-alt28 built April 15, 2014 Sergey V Turchin in task 118325 --- April 15, 2014 Sergey V Turchin - new version - security fixes: CVE-2014-0506, CVE-2014-0507, CVE-2014-0508, CVE-2014-0509...