RHEL 6 : rubygems (RHSA-2013:1441)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2013:1441 advisory. RubyGems is the Ruby standard for publishing and managing third-party libraries. It was found that RubyGems did not verify SSL connections...

Scientific Linux Security Update : rubygems on SL6.x (noarch) (20131017)

It was found that RubyGems did not verify SSL connections. This could lead to man-in-the-middle attacks. CVE-2012-2126 It was found that, when using RubyGems, the connection could be redirected from HTTPS to HTTP. This could lead to a user believing they are installing a gem via HTTPS, when the...

Moderate: Red Hat Security Advisory: rubygems security update

An updated rubygems package that fixes three security issues is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, ar...

MySQL 5.1 < 5.1.71 Server Optimizer Denial of Service

The version of MySQL 5.1 installed on the remote host is earlier than 5.1.71. It is, therefore, potentially affected by multiple denial of service vulnerabilities in the 'Server Optimizer' component. Note: Oracle has provided a workaround to address the issue for CVE-2012-2750. C Tenable Network...

Fedora Update for zabbix FEDORA-2013-18348

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for elinks FEDORA-2013-18347

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Apache Tomcat/JBoss EJBInvokerServlet / JMXInvokerServlet (RMI over HTTP) Marshalled Object Remote Code Execution - Active Check

Apache Tomcat/JBoss Application Server is prone to multiple remote code execution RCE vulnerabilities. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Juniper Networks Junos OS DNSSEC validation Denial of Service

Heavy DNSSEC validation load can cause assertion failure in Bind of Junos OS. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Fedora 18 : zabbix-2.0.8-3.fc18 (2013-18348)

New upstream version 2.0.8 - Patch for CVE-2013-5743 SQL injection vulnerability, ZBX-7091 - Patch for ZBX-6922 Failing host XML import - SQL speed-up patch for graphs ZBX-6804 - Require php-ldap and ZBX-6992 Service SQL - Create and configure a spooling directory for fping files outside of /tmp...

CVE-2012-4076

Cisco NX-OS allows local users to gain privileges and execute arbitrary commands via shell metacharacters in a command that calls the system library function, aka Bug IDs CSCtf23559 and CSCtf27780...

CVE-2012-4076

CVE-2012-4076 affects Cisco NX-OS with a local-privilege escalation via shell metacharacters in a call to the system() library function. The issue arises from improper input handling during command processing (Bug IDs CSCtf23559 and CSCtf27780). Public sources describe that an authenticated, loca...

CVE-2012-4097

CVE-2012-4097 affects Cisco NX-OS BGP: the BGP implementation does not properly filter segment types in AS paths, allowing remote attackers to trigger a denial of service (BGP service reset) via a malformed UPDATE message (Bug CSCtn13043). This is documented across multiple sources (NVD, Red Hat ...

CVE-2012-4099

Cisco NX-OS BGP implementation vulnerability CVE-2012-4099 allows remote attackers to trigger a denial of service (BGP service reset and resync) by sending a malformed UPDATE message due to improper AS-path filtering (Bug CSCtn13065). Affected component is the BGP/AS-path processing in NX-OS; imp...

CVE-2012-4077

Cisco NX-OS Software contains a vulnerability (CVE-2012-4077) due to improper filtering of parameters passed to the sed -e option. An authenticated, local attacker can exploit this to gain access to the bash shell and execute arbitrary commands with administrative privileges, effectively enabling...

CVE-2012-4121

Cisco NX-OS contains a local-privilege-escalation flaw in the Stream Editor (sed) usage via the r and w commands. The issue is tied to input-validation problems, enabling an authenticated, local attacker to read or modify arbitrary files on the device. Documents reference Bug IDs CSCts56559, CSCt...

CVE-2012-4105

The CVE-2012-4105 issue affects the Cisco UCS fabric interconnect; the vulnerability arises from improper filtering of user-supplied parameters in the debug hardware command, allowing an authenticated, local attacker to crash the FI (DoS) via crafted parameters (Bug ID CSCtq86468). Affected compo...

CVE-2012-4709

Invensys Wonderware InTouch HMI 2012 R2 and earlier are affected by CVE-2012-4709 due to unsafe XML external entity handling (XXE). An attacker could craft an XML document with an external entity and cause the application to read local or remote files, send HTTP requests to intranet resources, or...

CVE-2012-4107

The CVE-2012-4107 entry describes a privilege-escalation flaw in Cisco UCS fabric interconnects. Affected component: fabric interconnect of Cisco Unified Computing System. Root cause: improper filtering of user-supplied parameters to certain file-related commands allows a local attacker to gain e...

CVE-2012-4107

The fabric-interconnect component in Cisco Unified Computing System UCS allows local users to gain privileges and execute arbitrary commands via crafted parameters to a file-related command, aka Bug ID CSCtq86489...

CVE-2012-4108

The CVE-2012-4108 entry concerns Cisco Unified Computing System (UCS) fabric interconnect. The vulnerability arises from improper filtering of user-supplied parameters to a file-related command, enabling an authenticated, local attacker to gain privileges and execute arbitrary operating-system co...