PT-2012-1176 · Libtiff +3 · Libtiff +3

Name of the Vulnerable Software and Affected Versions: LibTIFF versions prior to 4.0.3 Description: The issue is related to multiple vulnerabilities in the tiff package, which can lead to disruption of confidentiality, integrity, and availability of protected information. Exploitation of these...

CVE-2012-1154

modcluster 1.0.10 before 1.0.10 CP03 and 1.1.x before 1.1.4, as used in JBoss Enterprise Application Platform 5.1.2, when "ROOT" is set to excludedContexts, exposes the root context of the server, which allows remote attackers to bypass access restrictions and gain access to applications deployed...

[SECURITY] Fedora 17 Update: gitolite3-3.04-4.fc17

Gitolite allows a server to host many git repositories and provide access to many developers, without having to give them real userids on the server. The essential magic in doing this is ssh's pubkey access and the authorized keys file, and the inspiration was an older program called gitosis...

nginx "location" 受限制资源服务漏洞

CVE ID: CVE-2011-4963 nginx是一款使用非常广泛的高性能Web服务器。 nginx允许远程攻击者通过请求内的“.”或某些“$indexallocation”序列，绕过目标访问限制或访问受限文件。 0 Nginx 1.2.x 厂商补丁： Nginx ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://nginx.net/...

CVE-2012-3991

Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 do not properly restrict JSAPI access to the GetProperty function, which allows remote attackers to bypass the Same Origin Policy and possibly have...

Key Systems Electronic Key Lockers command injection and weak authentication vulnerabilities

OVERVIEW Key Systems Electronic Key Lockers contain a command injection vulnerability which may allow a remote unauthenticated attacker to inject commands into the electronic key locker. Key Systems Electronic Key Lockers also contains weak authentication which could allow an attacker...

CVE-2012-3991

Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 do not properly restrict JSAPI access to the GetProperty function, which allows remote attackers to bypass the Same Origin Policy and possibly have...

CVE-2012-1623

Affected software: Drupal with the Registration Codes contributed module (6.x) prior to 6.x-2.4. Vulnerability: The module does not restrict access to the registration code list, potentially allowing unauthorized users to view codes and bypass registration restrictions. Root cause: Insufficient a...

CVE-2012-1623

The Registration Codes module before 6.x-2.4 for Drupal does not restrict access to the registration code list, which might allow remote attackers to bypass intended registration restrictions...

Code injection

Drupal 7.x before 7.14 does not properly restrict access to nodes in a list when using a "contributed node access module," which allows remote authenticated users with the "Access the content overview page" permission to read all published nodes by accessing the admin/content page...

CVE-2012-2153

Drupal 7.x before 7.14 does not properly restrict access to nodes in a list when using a "contributed node access module," which allows remote authenticated users with the "Access the content overview page" permission to read all published nodes by accessing the admin/content page...

CVE-2012-1833

The CVE-2012-1833 entry affects VMware SpringSource Grails before 1.3.8 and Grails 2.x before 2.0.2. The root cause is improper data binding restrictions, which could allow remote attackers to bypass access controls and modify arbitrary object properties through a crafted request parameter. No ex...

Information disclosure

Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid MRG 2.0, does not properly restrict access to resources, which allows remote attackers to obtain sensitive information via unspecified vectors related to 1 "web pages," 2 "export functionality," and 3 "image viewin...

CVE-2012-2680

Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid MRG 2.0, does not properly restrict access to resources, which allows remote attackers to obtain sensitive information via unspecified vectors related to 1 "web pages," 2 "export functionality," and 3 "image viewin...

CVE-2012-3738

CVE-2012-3738 affects Apple iOS before 6, in the Passcode Lock Emergency Dialer. A logic issue allowed a physically proximate user to bypass access restrictions and initiate FaceTime calls via Voice Dialing, potentially exposing contact information. The issue is tied to the Emergency Dialer scree...

CVE-2012-3743

The System Logs implementation in Apple iOS before 6 does not restrict /var/log access by sandboxed apps, which allows remote attackers to obtain sensitive information via a crafted app that reads log files...

CVE-2012-4993

torrentfunctions.php in RivetTracker 1.03 and earlier does not properly restrict access, which allows remote attackers to have an unspecified impact...

CVE-2012-4993

torrentfunctions.php in RivetTracker 1.03 and earlier does not properly restrict access, which allows remote attackers to have an unspecified impact...

Design/Logic Flaw

course/reset.php in Moodle 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2 checks an update capability instead of a reset capability, which allows remote authenticated users to bypass intended access restrictions via a reset operation...

CoSoSys Endpoint Protector 4 appliance contains a predictable password for root-equivalent account vulnerability

Overview CoSoSys Endpoint Protector 4 appliance contains a predictable password for root-equivalent accounts. Description According to the CoSoSys's website the Endpoint Protector 4 appliance is a DLP product used to prevent users from taking unauthorized data outside the company or bringing...