SuSE 10 Security Update : Apache 2 (ZYPP Patch Number 6571)

This update of the Apache webserver fixes various security issues : - the option IncludesNOEXEC could be bypassed via .htaccess. CVE-2009-1195 - modproxy could run into an infinite loop when used as reverse proxy. CVE-2009-1890 - moddeflate continued to compress large files even after a network...

Authentication flaw

JoxTechnology Ajox Poll does not properly restrict access to admin/managepoll.php, which allows remote attackers to bypass authentication and gain administrative access via a direct request...

CVE-2009-3596

CVE-2009-3596 affects JoxTechnology Ajox Poll. The vulnerability is an access-control flaw where an attacker can bypass authentication and obtain administrative access by requesting admin/managepoll.php directly. The NVD entry lists a CVSS v2 base score of 7.5 (HIGH) with network vector and low a...

CVE-2009-3564

puppetmasterd in puppet 0.24.6 does not reset supplementary groups when it switches to a different user, which might allow local users to access restricted files...

openSUSE 10 Security Update : ruby (ruby-6339)

This ruby update improves return value checks for openssl function OCSPbasicverify CVE-2009-0642 which allowed an attacker to use revoked certificates. The entropy of DNS identifiers was increased CVE-2008-3905 to avaid spoofing attacks. The code for parsing XML data was vulnerable to a denial of...

SuSE 11 Security Update : ruby (SAT Patch Number 1073)

This ruby update improves return value checks for openssl function OCSPbasicverify CVE-2009-0642 which allowed an attacker to use revoked certificates. The entropy of DNS identifiers was increased CVE-2008-3905 to avaid spoofing attacks. The code for parsing XML data was vulnerable to a denial of...

SuSE9 Security Update : ruby (YOU Patch Number 12452)

This update for ruby fixes the following security issues : - Improve return value checks for OpenSSL function OCSPbasicverify to refuse usage of revoked certificates. CVE-2009-0642 - Increase entropy of DNS identifiers to avoid spoofing attacks. CVE-2008-3905 - Fix denial of service DoS...

CVE-2009-3251

include/utils/ListViewUtils.php in vtiger CRM before 5.1.0 allows remote authenticated users to bypass intended access restrictions and read the 1 visibility, 2 location, and 3 recurrence fields of a calendar via a custom view...

BRS Webweaver 1.33 - Scripts Access Restriction Bypass

BRS Webweaver 1.33 - Scripts Access Restriction Bypass Name : BSR Webweaver Version 1.33 /Scripts access restriction bypass vulnerbility Author : Usman Saeed Company : Xc0re Security Reasearch Group Date : 15/09/09 Homepage : http://www.xc0re.net Download Page :...

BRS Webweaver 1.33 /Scripts Access Restriction Bypass Vulnerability

Exploit for windows platform in category remote exploits =================================================================== BRS Webweaver 1.33 /Scripts Access Restriction Bypass Vulnerability =================================================================== Name : BSR Webweaver Version 1.33...

CVE-2009-3168

Mevin Productions Basic PHP Events Lister 2.0 does not properly restrict access to 1 admin/reset.php and 2 admin/useradd.php, which allows remote authenticated users to reset administrative passwords or add administrators via a direct request...

CVE-2008-7186

Coppermine Photo Gallery CPG 1.4.14 does not restrict access to update.php, which allows remote attackers to obtain sensitive information such as the database table prefix via a direct request. NOTE: this might be leveraged for attacks against CVE-2008-0504...

CVE-2008-7186

Coppermine Photo Gallery CPG 1.4.14 does not restrict access to update.php, which allows remote attackers to obtain sensitive information such as the database table prefix via a direct request. NOTE: this might be leveraged for attacks against CVE-2008-0504...

CVE-2009-3095

The modproxyftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server via vectors related to the embedding of these commands in the Authorization HTTP header, as demonstrated by a certain module in VulnDisco Pa...

CVE-2008-7155

NetRisk 1.9.7 is reported to misrestrict access to admin/change_submit.php, enabling remote attackers to change arbitrary user passwords via a direct request. This is documented in CVE-2008-7155 with a CVSS v2 base score of 7.5 (HIGH) and network attack vector. OpenVAS entries refer to a NetRisk ...

Server side request forgery (ssrf)

CuteFlow 2.10.3 and 2.11.0c does not properly restrict access to pages/edituser.php, which allows remote attackers to modify usernames and passwords via a direct request...

CVE-2009-2960

CVE-2009-2960 affects CuteFlow 2.10.3 and 2.11.0_c. The vulnerability is that pages/edituser.php is not properly restricted, allowing remote attackers to modify usernames and passwords via a direct request. The impact is aligned with partial confidentiality and partial integrity, as per CVSS metr...

Cuteflow 2.10.3 Security Bypass

It's possible edit the users including the admin account, bypassing the authentication through the address: http://localhost/cuteflow/pages/edituser.php?userid=1&language=pt&sortby=st rLastName&sortdir=ASC&start=1 The vulnerability is caused due to the application not properly restricting access ...

CVE-2008-7002

PHP 5.2.5 does not enforce a openbasedir and b safemodeexecdir restrictions for certain functions, which might allow local users to bypass intended access restrictions and call programs outside of the intended directory via the 1 exec, 2 system, 3 shellexec, 4 passthru, or 5 popen functions,...

SuSE Security Advisory SUSE-SA:2009:043 (java-1_5_0-sun,java-1_6_0-sun)

The remote host is missing updates announced in advisory SUSE-SA:2009:043. OpenVAS Vulnerability Test $Id: susesa2009043.nasl 6668 2017-07-11 13:34:29Z cfischer $ Description: Auto-generated from advisory SUSE-SA:2009:043 java-150-sun,java-160-sun Authors: Thomas Reinke Copyright: Copyright c 200...