Drupal Facebook Pull Module Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Facebook Pull is one of the modules. A cross-site scripting vulnerability exists in the Drupal Facebook Pull module. This vulnerability can be exploited to execute arbitrary script code...

CVE-2016-9086

GitLab versions 8.9.x and above contain a critical security flaw in the "import/export project" feature of GitLab. Added in GitLab 8.9, this feature allows a user to export and then re-import their projects as tape archive files tar. All GitLab versions prior to 8.13.0 restricted this feature to...

CVE-2016-0361

IBM General Parallel File System GPFS 3.5 before 3.5.0.29 efix 6 and 4.1.1 before 4.1.1.4 efix 9, when the Spectrum Scale GUI is used with DB2 on Linux, UNIX and Windows, allows remote authenticated users to obtain sensitive information via unspecified vectors, as demonstrated by discovering ADMI...

Reusing connections with wrong client cert

libcurl did not consider client certificates when reusing TLS connections. libcurl supports reuse of established connections for subsequent requests. It does this by keeping a few previous connections "alive" in a connection pool so that a subsequent request that can use one of them instead of...

MGASA-2016-0174 Updated ntp packages fix security vulnerabilities

Updated ntp packages fix security vulnerabilities: It is possible to change the time of an ntpd client or deny service to an ntpd client by forcing it to change from basic client/server mode to interleaved symmetric mode. An attacker can spoof a packet from a legitimate ntpd server with an origin...

bind: responses with a malformed class attribute can trigger an assertion failure in db.c

A denial of service flaw was found in the way BIND processed certain records with malformed class attributes. A remote attacker could use this flaw to send a query to request a cached record with a malformed class attribute that would cause named functioning as an authoritative or recursive serve...

389-ds-base: password hashing bypassed when "nsslapd-unhashed-pw-switch" is set to off

It was found that when the nsslapd-unhashed-pw-switch 389 Directory Server configuration option was set to "off", it did not prevent the writing of unhashed passwords into the Changelog. This could potentially allow an authenticated user able to access the Changelog to read sensitive information...

PT-2015-3930 · Red Hat · Red Hat Cloudforms

Name of the Vulnerable Software and Affected Versions: Red Hat CloudForms 3.1 Management Engine CFME version 5.3 Description: The issue allows remote authenticated users to execute arbitrary SQL commands via a crafted REST API request to an SQL filter. This can be achieved by sending a malicious...

CVE-2014-5277

Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to...

CXF: UsernameTokens are sent in plaintext with a Symmetric EncryptBeforeSigning policy

It was discovered that UsernameTokens were sent in plain text by an Apache CXF client that used a Symmetric EncryptBeforeSigning password policy. A man-in-the-middle attacker could use this flaw to obtain the user name and password used by the client application using Apache CXF...

Updated postgresql packages fix multiple vulnerabilities

Updated postgresql packages fix security vulnerabilities: Granting a role without ADMIN OPTION is supposed to prevent the grantee from adding or removing members from the granted role, but this restriction was easily bypassed by doing SET ROLE first. The security impact is mostly that a role memb...

Heat: ReST API doesn't respect tenant scoping

The ReST API in OpenStack Orchestration API Heat before Havana 2013.2.1 and Icehouse before icehouse-2 allows remote authenticated users to bypass the tenant scoping restrictions via a modified tenantid in the request path...

MagpieRSS 0.72 - CDATA HTML Injection

source: https://www.securityfocus.com/bid/33044/info MagpieRSS is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code would run in the context of th...

PT-2007-3578 · Openssh +2 · Openssh +2

Name of the Vulnerable Software and Affected Versions: OpenSSH versions 4.6 and earlier Description: The issue allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY. This is because S/KEY displays a different response if the user account exist...

CVE-2006-5170

pamldap in nssldap on Red Hat Enterprise Linux 4, Fedora Core 3 and earlier, and possibly other distributions does not return an error condition when an LDAP directory server responds with a PasswordPolicyResponse control response, which causes the pamauthenticate function to return a success cod...

Browser responds to proxy auth request from non-proxy server (ssl/https) — Mozilla

If a proxy is configured the browser would respond to a 407 proxy auth request from any SSL-connected server rather than only responding to the configured proxy server. This could leak NTLM or SPNEGO credentials outside the organization...

Apache mod_disk_cache stores client authentication credentials on disk

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Summary: ======== moddiskcache stores all client authentication credentials for cached objects on disk. This means proxy authentication credentials as well as in certain RFC2616 defined cases standard authentication credentials. In case of Basic...

CVE-2003-1562

sshd in OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and using PAM keyboard-interactive authentication, does not insert a delay after a root login attempt with the correct password, which makes it easier for remote attackers to use timing differences to determine if the password...

Oracle 9iAS OWA_UTIL Stored Procedures Information Disclosure

Oracle 9iAS can provide access to the PL/SQL application OWAUTIL that provides web access to some stored procedures. These procedures, without authentication, can allow users to access sensitive information such as source code of applications, user credentials to other database servers and run...

[[ TH 026 Inc. ]] SA #3 - Shambala Server 4.5, Directory Traversal and DoS

Telhack 026 Inc. Security Advisory - 3 Name: Shambala Server 4.5 Impact: Major FTP Server vuln., Medium Web Server vuln. Date: June 30 / 2002 Daniel Nystrm a.k.a. excE [email protected] I N F O Shambala Server is a personal Web/FTP server for Win 9/NT. When the web server is started it also start...