CVE-2012-4549

CVE-2012-4549 affects JBoss EAP/JBoss EAP Platform (JBoss EAP/JBEAP) prior to 6.0.1. The processInvocation() function in org.jboss.as.ejb3.security.AuthorizationInterceptor incorrectly authorizes all EJB method invocations when the allowed-roles list is empty, bypassing access controls. Red Hat/J...

CVE-2012-2378

CVE-2012-2378 affects Apache CXF: versions 2.4.5–2.4.7, 2.5.1–2.5.3, and 2.6.x before 2.6.1. The issue is a flaw in enforcing WS-SecurityPolicy 1.1 SupportingToken child policies on the client side, allowing remote attackers to bypass the policies for AlgorithmSuite, SignedParts, SignedElements, ...

Ruby on Rails Active Record组件SQL注入漏洞(CVE-2012-6496)

CVE ID:CVE-2012-6496 Ruby on Rails是一款Web应用程序框架，构建在Ruby语言之上。 Ruby on Rails Active Record组件存在一个SQL注入漏洞，允许攻击者利用"findby"方法进行SQL注入攻击，可获得敏感信息或控制应用系统。 0 Ruby on Rails 3.0.x Ruby on Rails 3.1.x Ruby on Rails 3.2.x 厂商解决方案 Ruby on Rails 3.0.18，3.1.9和3.2.10已经修复此漏洞，建议用户下载使用： http://www.ruby-lang.org...

CVE-2012-5603

proxiescontroller.rb in Katello in Red Hat CloudForms before 1.1 does not properly check permissions, which allows remote authenticated users to read consumer certificates or change arbitrary users' settings via unspecified vectors related to the "consumer UUID" of a system...

CVE-2012-5581

Stack-based buffer overflow in tifdir.c in LibTIFF before 4.0.2 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted DOTRANGE tag in a TIFF image...

[SECURITY] [DSA 2597-1] rails security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2597-1 [email protected] http://www.debian.org/security/ Nico Golde January 04, 2013 http://www.debian.org/security/faq -...

CVE-2012-4555

CVE-2012-4555 affects Red Hat Certificate System (RHCS) pki-tps before version 8.1.3. The vulnerability arises from improper handling of interruptions during token format operations, allowing a remote attacker to cause a denial of service via a NULL pointer dereference, crashing the Apache httpd ...

CVE-2012-5605

CVE-2012-5605 affects Red Hat CloudForms System Engine prior to version 1.1. The issue arises from grinder cache in /var/lib/pulp/cache/grinder/ using world-writable permissions, enabling local attackers to read or modify grinder cache files. The RHSA-2012:1543 advisory documents this vulnerabili...

CVE-2012-4543

CVE-2012-4543 describes multiple XSS vulnerabilities in Red Hat Certificate System (RHCS) before 8.1.3. The flaws allow remote attackers to inject arbitrary web script or HTML via the (1) pageStart or (2) pageSize parameters to the displayCRL script, or (3) nonce variable to the profileProcess sc...

CVE-2012-0861

The CVE-2012-0861 issue affects Red Hat Enterprise Virtualization Manager (RHEV-M) prior to version 3.1. During host addition, the vds_installer downloads deployUtil.py and vds_bootstrap.py with curl -k, skipping SSL certificate validation. This MITM condition lets an attacker on the local networ...

CVE-2012-3538

CVE-2012-3538 affects Red Hat CloudForms (System Engine) 1.1 and is caused by Pulp logging administrative passwords to a world-readable log file (production.log). This local, file-based disclosure allows a user with access to the log to read administrative credentials and potentially take control...

CVE-2012-5581

CVE-2012-5581 : LibTIFF vulnerability—stack-based buffer overflow in tif_dir.c before 4.0.2 triggered by a crafted DOTRANGE tag in TIFF images. Affects LibTIFF versions prior to 4.0.2; can cause a crash and potentially allow code execution. Remediation: upgrade LibTIFF to 4.0.2 or newer. Notes: c...

CVE-2012-4574

CVE-2012-4574 affects Red Hat CloudForms with the Pulp component. The issue arises because the Pulp configuration file, pulp.conf, was installed with world-readable permissions, allowing local users to read the administrative password. The RHSA-2012:1543 update for CloudForms System Engine 1.1 fi...

CVE-2012-5516

The CVE-2012-5516 issue affects Red Hat Enterprise Virtualization Manager (RHEV-M) around version 3.1, where moving disks between storage domains fails to properly wipe-after-delete. The underlying effect is potential information disclosure from disks not securely deleted, exploitable by a local ...

CVE-2012-4556

CVE-2012-4556 affects Red Hat Certificate System (RHCS) under the token processing component pki-tps. The issue allows remote attackers to cause a denial-of-service by triggering an Apache httpd child process restart through certain unspecified empty search fields in a user certificate search que...

CVE-2012-2696

CVE-2012-2696 is a privilege-check flaw in the Red Hat Enterprise Virtualization Manager (RHEV-M) backend before 3.1. An authenticated attacker could issue queries against the RHEV-M SOAP or GWT APIs and read data they should not access, indicating an authorisation bypass in the back end. Connect...

CVE-2012-6329

The compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly handle backslashes and fully qualified method names during compilation of bracket notation, which allows context-dependent attackers to execute arbitrary commands via crafted input t...

CVE-2012-6330

The localization functionality in TWiki before 5.1.3, and Foswiki 1.0.x through 1.0.10 and 1.1.x through 1.1.6, allows remote attackers to cause a denial of service memory consumption via a large integer in a %MAKETEXT% macro...

CVE-2012-6329

CVE-2012-6329 affects the Perl Locale::Maketext Maketext.pm _compile function. The vulnerability arises from improper handling of backslashes and fully-qualified method names during bracket-notation compilation, allowing context-dependent attackers to execute arbitrary commands via crafted user-s...

CVE-2012-6348

CVE-2012-6348 affects Centrify Deployment Manager 2.1.0.283 (as distributed in Centrify Suite before 2012.5). Affected component is the use of insecure temporary files that can be targeted via symlink attacks: adcheckDMoutput and centrify.cmd.0. Local attackers can overwrite arbitrary files and, ...