CVE-2012-5486

CVE-2012-5486 - HP: ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19 (used in Plone before 4.3 beta 1) allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character. Affected components: Zope 2 series up to 2.13.18; Plone deployments including the Plone before...

CVE-2012-5505

atat.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read private data structures via a request for a view without a name...

CVE-2012-5503

Plone contains a vulnerability in ftp.py where remote attackers can read hidden folder contents. Affected versions are Plone before 4.2.3 and 4.3 before beta 1. The description does not specify the exact vectors, root cause details, or practical exploitation steps, and no remediation is provided ...

CVE-2012-5489

CVE-2012-5489 affects Zope’s App.Undo.UndoSupport.get_request_var_or_attr in Zope versions before 2.12.21 and 3.13.x before 2.13.11, used by Plone before 4.2.3 and 4.3 before beta 1. The root cause is insufficient access control on restricted attributes, allowing remote authenticated users to acc...

CVE-2012-6316

CVE-2012-6316 affects the TP-LINK TL-WR841N router (firmware up to 3.13.9 Build 120201 Rel.54965n and earlier). The vulnerability is a Stored XSS in the web interface, exploitable by remote-authenticated administrators through the parameters (1) username or (2) pwd to the page userRpm/NoipDdnsRpm...

CVE-2012-5490

Cross-site scripting XSS vulnerability in kssdevel.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-5494

Plone contains a Cross‑Site Scripting (XSS) vulnerability (CVE-2012-5494) in python_scripts.py, affecting Plone versions before 4.2.3 and before beta 1 of 4.3. The issue is related to translation handling ("{u,}translate") and allows remote attackers to inject arbitrary web script or HTML via uns...

luci, ricci security update

CentOS Errata and Security Advisory CESA-2014:1194 Updated conga packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVS...

php, php53 security update

CentOS Errata and Security Advisory CESA-2014:1326 Updated php53 and php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring...

file: incomplete fix for CVE-2012-1571 in cdf_read_property_info

It was found that the fix for CVE-2012-1571 was incomplete; the File Information fileinfo extension did not correctly parse certain Composite Document Format CDF files. A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted CDF file...

Moderate: Red Hat Security Advisory: php53 and php security update

Updated php53 and php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severi...

CVE-2012-6110

bcron-exec in bcron before 0.10 does not close file descriptors associated with temporary files when running a cron job, which allows local users to modify job files and send spam messages by accessing an open file descriptor...

CVE-2012-5619

The Sleuth Kit TSK 4.0.1 does not properly handle "." dotfile file system entries in FAT file systems and other file systems for which . is not a reserved name, which allows local users to hide activities it more difficult to conduct forensics activities, as demonstrated by Flame...

UBUNTU-CVE-2012-5621

lib/engine/components/opal/opal-call.cpp in ekiga before 4.0.0 allows remote attackers to cause a denial of service crash via an OPAL connection with a party name that contains invalid UTF-8 strings...

CVE-2012-5621

CVE-2012-5621 affects ekiga before 4.0.0 in the component opal-call.cpp. The issue arises when an OPAL connection includes a party name containing invalid UTF-8 strings, which can crash the application and cause a denial of service. The vulnerability is remote and can be triggered without user in...

CVE-2012-6110

bcron-exec in bcron before 0.10 does not close file descriptors associated with temporary files when running a cron job, which allows local users to modify job files and send spam messages by accessing an open file descriptor...

CVE-2012-5619

Summary (CVE-2012-5619) The Sleuth Kit (TSK) 4.0.1 fails to properly handle "." (dotfile) entries on FAT and other non-reserved-name filesystems, enabling local attackers to obscure forensic activity (e.g., Flame’s demonstration). Connected documents corroborate this dotfile handling issue and it...

CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix

It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject's Common Name CN field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially...

CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix

It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject's Common Name CN field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 5.2.0 security update

An update for Red Hat JBoss Enterprise Application Platform 5.2.0 that fixes two security issues is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give...