Buffer overflow

Buffer overflow in CHICKEN 4.9.0.x before 4.9.0.2, 4.9.x before 4.9.1, and before 5.0 allows attackers to have unspecified impact via a positive START argument to the "substring-index-ci procedures."...

CVE-2014-9651

Buffer overflow in CHICKEN 4.9.0.x before 4.9.0.2, 4.9.x before 4.9.1, and before 5.0 allows attackers to have unspecified impact via a positive START argument to the "substring-index-ci procedures."...

KLA10536 Multiple vulnerabilities in Citrix NetScaler

Multiple serious vulnerabilities have been found in Citrix NetScaler. Malicious users can exploit these vulnerabilities to execute or inject arbitrary code and conduct XSS attack. Below is a complete list of vulnerabilities 1. XSS vulnerability can be exploited remotely via a specially designed...

Fedora 22 : ettercap-0.8.2-1.fc22 (2015-4009)

0.8.2-Ferri Bug Fix !! Fixed some openssl deprecated functions usage !! Fixed log file ownership !! Fixed mixed output print !! Fixed dropprivs function usage !! Fixed nopromisc option usage. !! Fixed missing break in parser code. !! Improved redirect commands !! Fix truncated VLAN packet headers...

Fedora 20 : csync2-1.34-15.fc20 / duplicity-0.6.25-3.fc20 / librsync-1.0.0-1.fc20 / etc (2015-3366)

Changes in librsync 1.0.0 2015-01-23 ====================================== - SECURITY: CVE-2014-8242: librsync previously used a truncated MD4 'strong' check sum to match blocks. However, MD4 is not cryptographically strong. It's possible that an attacker who can control the contents of one part...

KLA10465 Multiple vulnerabilities in MyBB

Multiple serious vulnerabilities have been found in MyBB. Malicious users can exploit these vulnerabilities to obtain sensitive information or conduct cross site scrtipting. Below is a complete list of vulnerabilities 1. An unknown vulnerability can be exploited remotely via vectors related to...

KLA10463 Multiple vulnerabilities in Google Chrome

Multiple critical vulnerabilities have been found in Google Chrome. Malicious users can exploit these vulnerabilities to cause denial of service, bypass security restrictions or inject arbitrary code. Below is a complete list of vulnerabilities 1. Name conflict can be exploited remotely via a...

Hudson CI Detection (HTTP)

The script sends a HTTP request to the server and attempts to extract the version from the reply. SPDX-FileCopyrightText: 2015 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Jenkins CI Groovy Console accessible

Checks if the Jenkins CI Groovy Console is unprotected. SPDX-FileCopyrightText: 2015 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later CPE = "cpe:/a:jenkins:jenkins";...

Hudson CI Groovy Console accessible

Checks if the Hudson CI Groovy Console is unprotected. SPDX-FileCopyrightText: 2015 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later CPE = "cpe:/a:oracle:hudson";...

KLA10494 Multiple vulnerabilities in Fortinet FortiAuthenticator

Multiple serious vulnerabilities have been found in Fortinet FortiAuthenticator. Malicious users can exploit these vulnerabilities to gain privileges, obtain sensitive information, inject code and read arbitrary files. Below is a complete list of vulnerabilities 1. XSS vulnerability can be...

Jenkins-CI Login Utility

This module attempts to login to a Jenkins-CI instance using a specific user/pass. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasploit/framework/credentialcollection' require...

KLA10609 Multiple vulnerabilities in Microsoft Lync Server

Multiple serious vulnerabilities have been found in Microsoft Lync Server. Malicious users can exploit these vulnerabilities to inject arbitrary code or cause denial of service. Below is a complete list of vulnerabilities 1. XSS vulnerability can be exploited remotely via a specially designed URL...

SonarQube Jenkins Plugin - Plain Text Password

No description provided by source. 1. Advisory Information Title: SonarQube Jenkins Plugin - Plain Text Password Date published: 2013-12-05 Date of last update: 2013-12-05 Vendors contacted: SonarQube and Jenkins CI Discovered by: Christian Catalano Severity: High 2. Vulnerability Information CVE...

Jenkins 1.523 - Inject Persistent HTML Code

No description provided by source. 01. Advisory Information Title: Default markup formatter permits offsite-bound forms Date published : 2013-12-16 Date of last update: 2013-12-16 Vendors contacted : Jenkins CI v 1.523 Discovered by: Christian Catalano Severity: Low 02. Vulnerability Information...

openSUSE Security Update : wireshark (openSUSE-SU-2013:1295-1)

Wireshark was updated to 1.8.9 bnc831718 + vulnerabilities fixed : - The Bluetooth SDP dissector could go into a large loop CVE-2013-4927 wnpa-sec-2013-45 - The DIS dissector could go into a large loop CVE-2013-4929 wnpa-sec-2013-47 - The DVB-CI dissector could crash CVE-2013-4930 wnpa-sec-2013-4...

KLA10200 CI vulnerability in IBM

An XSS vulnerability was found in IBM products. By exploiting this vulnerability malicious users can inject web script. This vulnerability can be exploited remotely via a specially designed e-mail. Original advisories - Related products IBM-Notes IBM-Domino CVE list CVE-2014-0913 warning Solution...

[CVE-2013-5573] Jenkins v1.523 Default markup formatter permits offsite-bound forms

Advisory Information Title: Default markup formatter permits offsite-bound forms Date published : 2013-12-16 Date of last update: 2013-12-16 Vendors contacted : Jenkins CI v 1.523 Discovered by: Christian Catalano Severity: Low 02. Vulnerability Information CVE reference: CVE-2013-5573 CVSS v2...

[CVE-2013-5676] Plain Text Password In SonarQube Jenkins Plugin

Advisory Information Title: Default markup formatter permits offsite-bound forms Date published : 2013-12-16 Date of last update: 2013-12-16 Vendors contacted : Jenkins CI v 1.523 Discovered by: Christian Catalano Severity: Low 02. Vulnerability Information CVE reference: CVE-2013-5573 CVSS v2...

Jenkins CI 1.523 Persistent Script Insertion

Advisory Information Title: Default markup formatter permits offsite-bound forms Date published : 2013-12-16 Date of last update: 2013-12-16 Vendors contacted : Jenkins CI v 1.523 Discovered by: Christian Catalano Severity: Low 02. Vulnerability Information CVE reference: CVE-2013-5573 CVSS v2...