7227 matches found
Microsoft Internet Explorer Shift JIS Encoded Characters Cross-Site Scripting Vulnerability
Description Microsoft Internet Explorer is prone to a cross-site scripting vulnerability. An attacker can exploit this issue to gain access to information in another domain or Internet Explorer zone. This may allow the attacker to obtain sensitive information that may aid in further attacks...
Design/Logic Flaw
IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 do not properly restrict file types and extensions, which allows remote authenticated users to bypass intended access restrictions via a crafted filename...
CVE-2013-2454
CVE-2013-2454 is reported in MiracleLinux 4 via the AXSA:2013-486:05 advisory. OpenJDK/OpenJRE 1.7.0-openjdk-1.7.0.25-2.3.10.3.AXS4 is affected, with an unspecified vulnerability in the JRE component’s JDBC path that can affect confidentiality and integrity (vector not detailed). The Nessus entry...
Design/Logic Flaw
REDCap before 5.0.4 and 5.1.x before 5.1.3 does not reject certain undocumented syntax within branching logic and calculations, which allows remote authenticated users to bypass intended access restrictions via 1 the Online Designer or 2 the Data Dictionary upload, as demonstrated by an eval call...
Cisco Nexus 1000V VSM/VEM Communication Encryption Bypass Vulnerability
Cryptographic issues in the Cisco Nexus 1000v could allow an unauthenticated, remote attacker to to inject traffic or eavesdrop on the communications between a Virtual Supervisor Module VSM and a Virtual Ethernet Module VEM. The issues are due to errors in the implementation of the cryptography...
DNS Amplification Attacks (UDP) - Active Check
A misconfigured Domain Name System DNS server can be exploited to participate in a Distributed Denial of Service DDoS attack. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...
PT-2013-1323 · Schneider Electric · Modicon M340 +2
Name of the Vulnerable Software and Affected Versions: Modicon M340 versions affected versions not specified Modicon Quantum versions affected versions not specified Modicon Premium versions affected versions not specified Description: The issue is related to errors in security mechanisms, which...
Serva32 2.1.0 TFTPD service buffer overflow vulnerability
Overview Serva32 2.1.0 TFTPD service contains a buffer overflow vulnerability. Description The Serva32 2.1.0 TFTPD service contains a buffer overflow vulnerability when parsing large read requests. When the application reads in a large buffer the application crashes. --- Impact An unauthenticated...
Microsoft .NET Framework XML Digital Signature CVE-2013-1336 Security Bypass Vulnerability
Description Microsoft .NET Framework is prone to a security-bypass vulnerability because it fails to properly validate the signature of a specially crafted XML file. Attackers can exploit this issue to bypass XML digital signature validation and spoof XML content by conducting man-in-the-middle...
CVE-2013-1940
X.Org X server before 1.13.4 and 1.4.x before 1.14.1 does not properly restrict access to input events when adding a new hot-plug device, which might allow physically proximate attackers to obtain sensitive information, as demonstrated by reading passwords from a tty...
CVE-2013-1919
Xen 4.2.x and 4.1.x does not properly restrict access to IRQs, which allows local stub domain clients to gain access to IRQs and cause a denial of service via vectors related to "passed-through IRQs or PCI devices."...
Access Restriction Bypass
Overview Affected versions of this package are vulnerable to Access Restriction Bypass. The safe-level feature in Ruby 1.8.7 allows context-dependent attackers to modify strings via the NameErrortos method when operating on Ruby objects. NOTE: this issue is due to an incomplete fix for...
PT-2014-1029 · Linux +4 · Linux Kernel +4
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions through 3.14.3 Description: The issue is related to errors in the implementation of access to shared resources in the Linux operating system. It allows for the exploitation of a race condition in the n tty write function...
389 security update
CentOS Errata and Security Advisory CESA-2013:0742 Updated 389-ds-base packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring...
Low: Red Hat Security Advisory: 389-ds-base security and bug fix update
Updated 389-ds-base packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...
PT-2013-61: Disclosure of sensitive information in Web Viewer for Samsung DVR
The specialists of the Positive Research center have detected "Disclosure of sensitive information" vulnerability associated with Absence of Password Hashing in Web Viewer for Samsung DVR. Users credentials logins and passwords are stored in plaintext at pages, not hashed or encrypted. This...
Microsoft Windows Active Directory CVE-2013-1282 Denial of Service Vulnerability
Description Microsoft Windows is prone to a denial-of-service vulnerability. Successful exploits may allow the attacker to cause the LDAP service to become non-responsive, resulting in denial-of-service conditions. Technologies Affected Avaya CallPilot 4.0 Avaya CallPilot 4.0.1 Avaya CallPilot 5....
PT-2013-3408 · Red Hat · Red Hat Subscription Asset Manager
Name of the Vulnerable Software and Affected Versions: Red Hat Subscription Asset Manager versions prior to 1.2.1 Description: A cross-site scripting XSS issue exists in the Notifications form, allowing remote attackers to inject arbitrary web script or HTML via the username field. This could...
