Oracle Solaris Third-Party Patch Update : gimp (cve_2012_4245_arbitrary_code)

The remote Solaris system is missing necessary patches to address security updates : - The scriptfu network server in GIMP 2.6 does not require authentication, which allows remote attackers to execute arbitrary commands via the python-fu-eval command. CVE-2012-4245 %NASLMINLEVEL 70300 C Tenable...

Oracle Solaris Third-Party Patch Update : isc-dhcp (cve_2012_3955_denial_of)

The remote Solaris system is missing necessary patches to address security updates : - ISC DHCP 4.1.x before 4.1-ESV-R7 and 4.2.x before 4.2.4-P2 allows remote attackers to cause a denial of service daemon crash in opportunistic circumstances by establishing an IPv6 lease in an environment where...

Oracle Solaris Third-Party Patch Update : ekiga (cve_2012_5621_denial_of)

The remote Solaris system is missing necessary patches to address security updates. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the Oracle Third Party software advisories. include'deprecatednasllevel.inc';...

Oracle Solaris Third-Party Patch Update : python (multiple_vulnerabilities_in_python) (BEAST)

The remote Solaris system is missing necessary patches to address security updates : - The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained...

Oracle Solaris Third-Party Patch Update : tomcat (multiple_vulnerabilities_in_apache_tomcat4)

The remote Solaris system is missing necessary patches to address security updates : - Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data...

Oracle Solaris Third-Party Patch Update : libvorbis (cve_2012_0444_memory_corruption)

The remote Solaris system is missing necessary patches to address security updates : - Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 do not properly initialize nsChildView data structures, which allows remote attackers t...

Oracle Solaris Third-Party Patch Update : libdrm (cve_2012_0044_integer_overflow)

The remote Solaris system is missing necessary patches to address security updates. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the Oracle Third Party software advisories. include'deprecatednasllevel.inc';...

Oracle Solaris Third-Party Patch Update : wireshark (multiple_vulnerabilities_in_wireshark)

The remote Solaris system is missing necessary patches to address security updates : - epan/dissectors/packet-ansia.c in the ANSI A dissector in Wireshark 1.4.x before 1.4.12 and 1.6.x before 1.6.6 allows remote attackers to cause a denial of service NULL pointer dereference and application crash...

Oracle Solaris Third-Party Patch Update : ssh (cve_2010_5107_denial_of)

The remote Solaris system is missing necessary patches to address security updates : - The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing a TCP connection and completing a login, which makes it easier for remote attackers to cause a denial of service...

Oracle Solaris Third-Party Patch Update : apache (cve_2012_0021_improper_input)

The remote Solaris system is missing necessary patches to address security updates : - The logcookie function in modlogconfig.c in the modlogconfig module in the Apache HTTP Server 2.2.17 through 2.2.21, when a threaded MPM is used, does not properly handle a %C format string, which allows remote...

Oracle Solaris Third-Party Patch Update : wireshark (multiple_vulnerabilities_fixed_in_wireshark)

The remote Solaris system is missing necessary patches to address security updates : - Wireshark 1.8.x before 1.8.4 allows remote attackers to obtain sensitive hostname information by reading pcap-ng files. CVE-2012-6052 - epan/dissectors/packet-usb.c in the USB dissector in Wireshark 1.6.x befor...

Oracle Solaris Third-Party Patch Update : samba (cve_2012_2111_access_controls)

The remote Solaris system is missing necessary patches to address security updates : - The 1 CreateAccount, 2 OpenAccount, 3 AddAccountRights, and 4 RemoveAccountRights LSA RPC procedures in smbd in Samba 3.4.x before 3.4.17, 3.5.x before 3.5.15, and 3.6.x before 3.6.5 do not properly restrict...

Oracle Solaris Third-Party Patch Update : samba (cve_2012_6150_input_validation)

The remote Solaris system is missing necessary patches to address security updates : - The winbindnamelisttosidstringlist function in nsswitch/pamwinbind.c in Samba through 4.1.2 handles invalid requiremembershipof group names by accepting authentication by any user, which allows remote...

Oracle Solaris Third-Party Patch Update : net-snmp (multiple_vulnerabilities_in_net_snmp)

The remote Solaris system is missing necessary patches to address security updates : - Net-SNMP 5.7.1 and earlier, when AgentX is registering to handle a MIB and processing GETNEXT requests, allows remote attackers to cause a denial of service crash or infinite loop, CPU consumption, and hang by...

Oracle MySQL (Windows) - FILE Privilege Abuse (Metasploit)

Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Oracle MySQL for Microsoft Windows FILE Privilege Abuse', 'Description' = %q This module takes advantage of a file privilege misconfiguration problem specifically against Windows MySQL servers. Th...

F5 Networks BIG-IP : Libtiff vulnerabilities (SOL15863)

CVE-2012-1173 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from F5 Networks BIG-IP Solution SOL15863. The text description of this plugin is C F5 Networks. include"compat.inc"; if description scriptid80447; scriptversion"1.5";...

CVE-2012-6684

Cross-site scripting XSS vulnerability in the RedCloth library 4.2.9 for Ruby and earlier allows remote attackers to inject arbitrary web script or HTML via a javascript: URI...

CVE-2012-6684

Cross-site scripting XSS vulnerability in the RedCloth library 4.2.9 for Ruby and earlier allows remote attackers to inject arbitrary web script or HTML via a javascript: URI...

CVE-2012-6684

Cross-site scripting XSS vulnerability in the RedCloth library 4.2.9 for Ruby and earlier allows remote attackers to inject arbitrary web script or HTML via a javascript: URI...

CVE-2012-5853

The CVE-2012-5853 entry concerns the WordPress plugin cardoza-ajax-search (the AJAX Post Search) prior to version 1.3. An SQL injection affects the function the_search_function in cardoza_ajax_search.php, exploitable via the srch_txt parameter in the the_search_text action to wp-admin/admin-ajax....