Vimeo: CRITICAL full source code/config disclosure for Cameo

Hi! The server at https://ci.cameo.tv/ has directory listing on and seems to host quiet a few debian packages containing extremely sensitive information database paswords, API keys, you name it. One example is the config package containing 16 config files, even personal ones containing local...

Fedora 21 : fedup-0.9.0-2.fc21 (2014-14347)

This update works around a serious problem in Fedora 21 Beta which makes systems automatically shut down 15 minutes into the upgrade. Other improvements : - Adds --product=PRODUCT flag, required for upgrades to F21 - Uses host's config files in upgrade.img, which should fix various upgrade proble...

Fedora 20 : fedup-0.9.0-1.fc20 (2014-14027)

Adds --product=PRODUCT flag, required for upgrades to F21 - Uses host's config files in upgrade.img, which should fix various upgrade problems e.g. incorrect keyboard layout when unlocking disks due to missing vconsole.conf - Logging improvements: complete upgrade log should appear in system...

HttpCombiner ASP.NET Remote File Disclosure Vulnerability

HttpCombiner ASP.NET is prone to remote file disclosure vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ultra Electronics 7.2.0.19 / 7.4.0.7 SQL Injection / Direction Creation

Ultra Electronics / AEP Networks - SSL VPN Netilla / Series A / Ultra Protect Vulnerabilities http://www.osisecurity.com.au/advisories/ultra-aep-netilla-vulnerabilities Release Date: 02-Oct-2014 Software: Ultra Electronics - Series A...

CVE-2014-5339

CheckMK before 1.2.4p4 and 1.2.5 before 1.2.5i4 allows remote authenticated users to write checkmk config files .mk files to arbitrary locations via vectors related to row selections...

CVE-2014-5339

CheckMK before 1.2.4p4 and 1.2.5 before 1.2.5i4 allows remote authenticated users to write checkmk config files .mk files to arbitrary locations via vectors related to row selections...

Code injection

CheckMK before 1.2.4p4 and 1.2.5 before 1.2.5i4 allows remote authenticated users to write checkmk config files .mk files to arbitrary locations via vectors related to row selections...

CVE-2014-5339

CheckMK before 1.2.4p4 and 1.2.5 before 1.2.5i4 allows remote authenticated users to write checkmk config files .mk files to arbitrary locations via vectors related to row selections...

CVE-2014-5339: Undefined Security Weakness

CheckMK before 1.2.4p4 and 1.2.5 before 1.2.5i4 allows remote authenticated users to write checkmk config files .mk files to arbitrary locations via vectors related to row selections...

PT-2014-6419

Name of the Vulnerable Software and Affected Versions Check MK versions prior to 1.2.4p4 Check MK version 1.2.5 prior to 1.2.5i4 Description The issue allows remote authenticated users to write check mk config files .mk files to arbitrary locations. This is related to vectors involving row...

Deutsche Telekom CERT Advisory [DTC-A-20140820-001] check_mk vulnerabilities

Deutsche Telekom CERT Advisory DTC-A-20140820-001 Summary: Several vulnerabilities were found in checkmk prior versions 1.2.4p4 and 1.2.5i4. The vulnerabilities are: 1 - Reflected Cross-Site Scripting XSS 2 - write access to config files .mk files 3 - arbitrary code execution Recommendations:...

openSUSE Security Update : kernel (openSUSE-SU-2013:1042-1)

The openSUSE 12.2 kernel was updated to fix security issue and other bugs. Security issues fixed: CVE-2013-2850: Incorrect strncpy usage in the network listening part of the iscsi target driver could have been used by remote attackers to crash the kernel or execute code. This required the iscsi...

Nagios Plugins <= 2.0.1 check_dhcp Arbitrary Option File Read

Exploit for linux platform in category local exploits I. VULNERABILITY ------------------------- checkdhcp - Nagios Plugins = 2.0.1 Arbitrary Option File Read II. BACKGROUND ------------------------- "Nagios is an open source computer system monitoring, network monitoring and infrastructure...

Weathermap 0.97C Local File Inclusion

============================================= WEBERA ALERT ADVISORY 01 - Discovered by: Anthony Dubuissez - Severity: high - CVE Request - 03/06/2013 - CVE Assign - 03/06/2013 - CVE Number - CVE-2013-3739 - Vendor notification - 03/06/2013 - Vendor reply - No reply - Public disclosure - 10/06/201...

D-Link DSL-320B Multiple Security Vulnerabilities (May 2013) - Active Check

D-Link DSL-320B devices are prone multiple security vulnerabilities. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only nb: Running against all DS...

[Panoptic] Automates the process of search and retrieval of content for common log and config files through LFI vulnerability

Panoptic is an open source penetration testing tool that automates the process of search and retrieval of content for common log and config files through LFI vulnerability. Official introductionary post can be found here. Also, you can find a sample run here. Help Menu Usage: panoptic.py --url...

TP-LINK TL-WR841N wireless router local file inclusion vulnerability

Overview The TP-LINK TL-WR841N wireless router contains a local file inclusion vulnerability which could allow an attacker to download critical configuration files off the device. Description CWE-829: Inclusion of Functionality from Untrusted Control SphereThe TP-LINK TL-WR841N wireless router...

Fedora 17 : redeclipse-1.2-12.fc17 (2012-11582)

A flaw was found in the way Red Eclipse handled config files. In cube2-engine games, game maps can be transmitted either from the server to a client, or from client to client. These maps include a config file mapname.cfg in 'cubescript' format, which allows for an attacker to send a malicious...

DEBIAN-CVE-2011-2709

libgssapi and libgssglue before 0.4 do not properly check privileges, which allows local users to load untrusted configuration files and execute arbitrary code via the GSSAPIMECHCONF environment variable, as demonstrated using mount.nfs...