Debian DSA-1856-1 : mantis - information leak

It was discovered that the Debian Mantis package, a web-based bug tracking system, installed the database credentials in a file with world-readable permissions onto the local filesystem. This allows local users to acquire the credentials used to control the Mantis database. This updated package...

Design/Logic Flaw

Accellion Secure File Transfer Appliance before 80105 allows remote authenticated administrators to bypass the restricted shell and execute arbitrary commands via shell metacharacters to the ping command, as demonstrated by modifying the cli program...

CVE-2009-4648

Accellion Secure File Transfer Appliance before 80105 does not properly restrict access to sensitive commands and arguments that run with extra sudo privileges, which allows local administrators to gain privileges via 1 arbitrary arguments in the --filemove action in /usr/local/bin/admin.pl, or a...

CVE-2009-4644

Accellion Secure File Transfer Appliance before 80105 allows remote authenticated administrators to bypass the restricted shell and execute arbitrary commands via shell metacharacters to the ping command, as demonstrated by modifying the cli program...

CVE-2009-4648

CVE-2009-4648 affects Accellion Secure File Transfer Appliance before 8_0_105. Root cause: access to sensitive commands run with extra sudo privileges is not properly restricted in /usr/local/bin/admin.pl, enabling local administrators to escalate privileges. Vulnerability vectors include (1) arb...

Cisco Releases Multiple Security Advisories

Cisco has released three security advisories to address vulnerabilities. Security advisory, cisco-sa-20100217-fwsm, addresses a vulnerability in the Cisco Firewall Services Module FWSM for the Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers. Successful and repeated exploitation ...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in WebCalendar 1.2.0 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained solely...

CVE-2010-0638

Cross-site request forgery CSRF vulnerability in WebCalendar 1.2.0 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained solely...

CVE-2010-0637

Multiple cross-site request forgery CSRF vulnerabilities in WebCalendar 1.2.0, and other versions before 1.2.5, allow remote attackers to hijack the authentication of administrators for requests that 1 delete an event or 2 ban an IP address from posting via unknown vectors. NOTE: some of these...

Adobe Releases Security Bulletins for Acrobat, Reader, and Flash Player

Adobe has released two security bulletins to address vulnerabilities in Adobe Acrobat, Reader, and Flash Player. The first bulletin, APSB10-06, is a security update for Adobe Flash Player and Adobe AIR that addresses a critical vulnerability. Exploitation of these vulnerabilities may allow an...

CVE-2010-0560

Unspecified vulnerability in the BIOS in Intel Desktop Board DB, DG, DH, DP, and DQ Series allows local administrators to execute arbitrary code in System Management Mode SSM via unknown attack vectors...

CVE-2010-0560

CVE-2010-0560 : Intel Desktop Boards BIOS contains a local privilege-escalation flaw allowing a user with administrative rights to execute arbitrary code in System Management Mode (SSM). Affected are DB, DG, DH, DP, and DQ series boards. The vulnerability is caused by an unspecified issue in the ...

Confluence adminsistrators can still view a restricted page if the type in the URL or click on a link in an email

If I set page viewing restrictions on a wki page to one group of which I am a member, other users, including confluence adminsistrators, cannot see the page when navigating within the application. If they type in the URL of the restricted page or click on a link to the restricted page, then can...

Confluence adminsistrators can still view a restricted page if the type in the URL or click on a link in an email

If I set page viewing restrictions on a wki page to one group of which I am a member, other users, including confluence adminsistrators, cannot see the page when navigating within the application. If they type in the URL of the restricted page or click on a link to the restricted page, then can...

Microsoft Releases Security Advisory 980088

Microsoft has released Security Advisory 980088 to alert users of a vulnerability in Microsoft Internet Explorer. The advisory indicates that exploitation of this vulnerability may allow an attacker to harvest user credentials and other sensitive information by enticing users to visit a malicious...

Microsoft Confirms Unpatched Windows Kernel Flaw

One day after a Google security researcher releases code to expose a flaw that affects every release of the Windows NT kernel — from Windows NT 3.1 1993 up to and including Windows 7 2009 — Microsoft has released a security advisory to acknowledge the issue and warn of the risk of privilege...

Microsoft Releases Cumulative Security Update for Internet Explorer

Microsoft has released Security Bulletin MS10-002 as a Cumulative Security Update for Internet Explorer. This update addresses multiple vulnerabilities that when exploited, may allow an attacker to execute arbitrary code. US-CERT encourages users and administrators to review Microsoft Security...

Information disclosure in FreePBX 2.5.x

Exploit for unknown platform in category web applications ======================================= Information disclosure in FreePBX 2.5.x ======================================= Advisory Name: Information disclosure in FreePBX 2.5.x Internal Cybsec Advisory Id: 2010-0101 Vulnerability Class:...

HP OpenView Network Node Manager nnmRptConfig.exe CGI Template Buffer Overflow

Added: 01/09/2010 CVE: CVE-2009-3848 BID: 37296 OSVDB: 60926 Background HP OpenView Network Node Manager is network availability and performance management software. Problem A stack buffer overflow vulnerability allows remote attackers to execute arbitrary commands by requesting the...

CVE-2009-4563

Cross-site request forgery CSRF vulnerability in zp-core/admin-options.php in Zenphoto 1.2.5 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via the 0-adminpass and 0-adminpass2 parameters in a saveoptions action...