CVE-2014-2983

Drupal 6.x before 6.31 and 7.x before 7.27 does not properly isolate the cached data of different anonymous users, which allows remote anonymous users to obtain sensitive interim form input information in opportunistic situations via unspecified vectors...

Drupal 7.x < 7.27 Forms API Information Disclosure

The remote web server is running a version of Drupal that is 7.x prior to 7.27. It is, therefore, affected by an error related to the HTML form API and the caching of pages for different anonymous users, which could allow sensitive information to be disclosed. Note that Drupal core does not expos...

EMC Cloud Tiering Appliance (CTA)本地信息泄漏漏洞

Bugtraq ID:66937 CVE ID:CVE-2014-0645 EMC Cloud Tiering Appliance能够协助存储管理人员有效简单的管理以档案为单位的非结构性数据。 EMC Cloud Tiering Appliance把root, super, admin内置账户的默认密码使用DES加密算法存储，允许攻击者利用漏洞可恢复这些密码。 0 EMC Cloud Tiering Appliance CTA 10 EMC Cloud Tiering Appliance CTA 10 SP1 EMC Cloud Tiering Appliance CTA 9.x EMC...

Oracle Java SE 5.x, 6.x, 7.x, 8.x Multiple Vulnerabilities (cpuapr2014) - Windows

Oracle Java SE is prone to multiple vulnerabilities. Copyright C 2014 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

SA-CORE-2014-002 - Drupal core - Information Disclosure

Drupal's form API has built-in support for temporary storage of form state, for example user input. This is often used on multi-step forms, and is required on Ajax-enabled forms in order to allow the Ajax calls to access and update interim user input on the server. When pages are cached for...

SA-CONTRIB-2014-037 - BlueMasters - Cross Site Scripting

Bluemasters is a responsive layout theme for Drupal 7. The Bluemasters theme does not properly sanitize theme settings before they are used in the output of a page. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer themes". CVE identifie...

Open-Xchange Email自动配置信息泄漏漏洞

Bugtraq ID:66698 CVE ID:CVE-2014-2392 Open-Xchange Server是部分开源的项目，主要开发协同软件，例如电子邮件、日历等。 由于当使用email自动配置时应用程序通过一个GET请求参数传达某些信息，攻击者可以利用漏洞泄漏帐号密码。 0 Open-Xchange Server 7.x Open-Xchange 7.4.2-rev13, 7.4.1-rev11,或7.2.2-rev20版本已修复此漏洞，建议用户下载使用： http://www.open-xchange.com/home.html...

SA-CONTRIB-2014-038 - SimpleCorp theme - Cross Site Scripting

SimpleCorp theme is a free responsive Drupal theme. The SimpleCorp theme does not properly sanitize theme settings before they are used in the output of a page. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer themes". CVE identifiers...

ESA-2014-020: RSA Adaptive Authentication &#40;On-Premise&#41; Multiple Vulnerabilities

ESA-2014-020.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-020: RSA Adaptive Authentication On-Premise Multiple Vulnerabilities EMC Identifier: ESA-2014-020 CVE Identifier: CVE-2014-0637, CVE-2014-0638 Severity Rating: CVSS v2 Base Score: See below for individual scores Affected...

RSA Adaptive Authentication (On-Premise)跨站脚本漏洞

CVE ID:CVE-2014-0637 RSA Adaptive Authentication是一款多用于大型金融机构的集中的、多层的认证解决方案。 RSA Adaptive Authentication存在跨站脚本漏洞，允许攻击者构建恶意URI，诱使用户解析，可获得敏感Cookie，劫持会话或在客户端上进行恶意操作。 0 RSA Adaptive Authentication On-Premise 6.x RSA Adaptive Authentication On-Premise 7.x RSA Adaptive Authentication On-Premise 7.1 SP0...

Updated tomcat package fixes security vulnerabilities

Apache Tomcat 7.x before 7.0.50 processes chunked transfer coding without properly handling 1 a large total amount of chunked data or 2 whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data CVE-2013-4322...

Drupal Xapian模块安全绕过漏洞

Drupal是一套开放源码的内容管理平台。 由于在显示搜索结果时节点访问权限出现错误，攻击者可以利用漏洞泄漏其他受限制信息。 0 Drupal Xapian Module 6.x Drupal Xapian Module 7.x Drupal Xapian Module 6.x-2.2或7.x-1.2以修复此漏洞，建议用户下载使用： https://drupal.org/node/2221403...

Open-Xchange Server Email Subject脚本注入漏洞

CVE ID：CVE-2014-2077 Open-Xchange Server是部分开源的项目，主要开发协同软件，例如电子邮件、日历等。 通过email主题传递的输入在使用前没有正确过滤，攻击者可以利用漏洞当恶意数据被访问时，在受影响站点上下文的用户浏览器会话中执行任意HTML和脚本代码。 0 Open-Xchange Server 7.x Open-Xchange Server 7.4.1-rev10 or 7.4.2-rev8版本以修复此漏洞，建议用户下载使用： http://www.open-xchange.com/home.html...

McAfee Web Gateway任意文件泄漏漏洞

McAfee Email Gateway是一款全面的电子邮件安全解决方案。 该漏洞是由于处理请求时MWG网页过滤端口的错误，可被利用通过目录遍历序列来下载任意文件。 0 McAfee Web Gateway 7.x McAfee Web Gateway 7.4.1或7.3.2.6版本以修复此漏洞，建议用户下载使用： https://kc.mcafee.com/corporate/index?page=content&id=SB10063...

Drupal Webform Template模块安全绕过漏洞

Drupal是一套开放源码的内容管理平台。 该漏洞是由于当显示可能的节点来复制网页表单的配置文件时，应用程序没有正确验证权限, 攻击者可以利用漏洞泄漏其他受限制接点的某些信息。 0 Drupal Webform Template Module 7.x Drupal Webform Template Module 7.x-1.3版本以修复此漏洞，建议用户下载使用： https://drupal.org/node/2216607...

SA-CONTRIB-2014-029 - Mime Mail - Access Bypass

The MIME Mail module allows to send MIME-encoded e-mail messages with embedded images and attachments. By default the module only allows files to be embedded or attached that are located in the public files directory. The module doesn't sufficiently check the file location, considering similar...

CVE-2013-6730

IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x before 7.0.0.2 CF27, and 8.0.0.x before 8.0.0.1 CF10, when the wcm.path.traversal.security setting is enabled, allows remote attackers to bypass intended read restrictions on an item by accessing that item...

Drupal Open Omega模块访问绕过漏洞

Bugtraq ID:65822 Drupal是一套开放源码的内容管理平台。 当构建header和footer菜单时Drupal Open Omega不充分检查用户菜单访问，允许攻击者利用漏洞获取受限项的标题和路径信息。 0 Drupal Open Omega 7.x 厂商补丁： Drupal ----- Drupal Open Omega 7.x-1.1已经修复该漏洞，建议用户下载更新： http://drupal.org/project/openomega...

SA-CONTRIB-2014-022 - Slickgrid - Access bypass

The Slickgrid module is an implementation of the jQuery slickgrid plugin, a lightening fast JavaScript grid/spreadsheet. It defines a slickgrid view style, so all data can be output as an editable grid. The module doesn't check access sufficiently, allowing users to edit and change field values o...

CVE-2013-0346

Apache Tomcat 7.x uses world-readable permissions for the log directory and its files, which might allow local users to obtain sensitive information by reading a file. NOTE: One Tomcat distributor has stated "The tomcat log directory does not contain any sensitive information."...