Moderate: Red Hat Security Advisory: Red Hat OpenShift Enterprise 2.2 Release Advisory

Red Hat OpenShift Enterprise release 2.2, which fixes a security issue, several bugs and includes various enhancements, is now available. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed...

CVE-2013-4594

The Payment for Webform module 7.x-1.x before 7.x-1.5 for Drupal does not restrict access by anonymous users, which allows remote anonymous users to use the payment of other anonymous users when submitting a form that requires payment...

Design/Logic Flaw

The Payment for Webform module 7.x-1.x before 7.x-1.5 for Drupal does not restrict access by anonymous users, which allows remote anonymous users to use the payment of other anonymous users when submitting a form that requires payment...

CVE-2013-4594

The CVE-2013-4594 vulnerability affects the Drupal Payment for Webform module (7.x-1.x) prior to 7.x-1.5. It allows remote anonymous users to access/consume payments made by other anonymous users when submitting a form requiring payment due to insufficient access controls. Remediation: upgrade to...

CVE-2012-5696

Bulb Security Smartphone Pentest Framework SPF before 0.1.3 does not properly restrict access to frameworkgui/config, which allows remote attackers to obtain the plaintext database password via a direct request...

CVE-2014-3568

CVE-2014-3568 affects OpenSSL builds where no-ssl3 is not effectively enforced. OpenSSL versions affected: 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j. The issue allows remote attackers to bypass access restrictions by performing an SSL 3.0 handshake, related to s23_clnt.c and s23_srvr....

CVE-2014-0572

Adobe ColdFusion 9.0 before Update 13, 9.0.1 before Update 12, 9.0.2 before Update 7, 10 before Update 14, and 11 before Update 2 allows local users to bypass intended IP-based access restrictions via unspecified vectors...

CVE-2014-2044

Incomplete blacklist vulnerability in ajax/upload.php in ownCloud before 5.0, when running on Windows, allows remote authenticated users to bypass intended access restrictions, upload files with arbitrary names, and execute arbitrary code via an Alternate Data Stream ADS syntax in the filename...

CVE-2013-3066

Linksys EA6500 with firmware 1.1.28.147876 does not properly restrict access, which allows remote attackers to obtain sensitive information clients and router configuration via a request to /JNAP/...

CVE-2013-2586

XAMPP 1.8.1 does not properly restrict access to xampp/lang.php, which allows remote attackers to modify xampp/lang.tmp and execute cross-site scripting XSS attacks via the WriteIntoLocalDisk method...

CVE-2013-2586

CVE-2013-2586 affects XAMPP 1.8.1. The /xampp/lang.php page fails to restrict access, letting an unauthenticated user write to lang.tmp on local disk and trigger XSS via WriteIntoLocalDisk. Multiple sources (NVD/OpenVAS/Exploit-DB/Seebug) corroborate remote write access and local file modificatio...

CVE-2013-2586

XAMPP 1.8.1 does not properly restrict access to xampp/lang.php, which allows remote attackers to modify xampp/lang.tmp and execute cross-site scripting XSS attacks via the WriteIntoLocalDisk method...

CVE-2014-6043

ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 does not properly restrict access to the database browser, which allows remote authenticated users to obtain access to the database via a direct request to event/runQuery.do. Fixed in Build 10000...

CVE-2014-0554

CVE-2014-0554 affects Adobe Flash Player and AIR components. The initial entry states a bypass of intended access restrictions via unspecified vectors for: Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 (Windows/OS X) and before 11.2.202.406 (Linux); Flash AIR before 15.0.0.24...

PT-2014-5122 · Linux +5 · Linux Kernel +5

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 3.16.2 Description: The issue is related to an array index error in the logi dj raw event function in drivers/hid/hid-logitech-dj.c. This error allows physically proximate attackers to execute arbitrary code or...

CVE-2014-0877

IBM Cognos TM1 10.2.0.2 before IF1 and 10.2.2.0 before IF1 allows remote attackers to bypass intended access restrictions by visiting the Rights page and then following a generated link...

CVE-2014-5337

The WordPress Mobile Pack plugin before 2.0.2 for WordPress does not properly restrict access to password protected posts, which allows remote attackers to obtain sensitive information via an exportarticles action to export/content.php...

CVE-2014-3083

IBM WebSphere Application Server WAS 7.0.x before 7.0.0.35, 8.0.x before 8.0.0.10, and 8.5.x before 8.5.5.3 does not properly restrict resource access, which allows remote attackers to obtain sensitive information via unspecified vectors...

Design/Logic Flaw

The addFileRegistryAccount Virtual Member Manager VMM SPI Admin Task in IBM WebSphere Application Server WAS 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.3 does not properly create accounts, which allows remote attackers to bypass intended access restrictions via unspecified vectors...

MGASA-2014-0331 Updated kernel-tmb package fixes security vulnerabilities

Updated kernel-tmb provides upstream 3.10.51 kernel and fixes the following security issues: Array index error in the aioreadeventsring function in fs/aio.c in the Linux kernel through 3.15.1 allows local users to obtain sensitive information from kernel memory via a large head value CVE-2014-020...