Moderate: Red Hat Security Advisory: resteasy security update

An update for JBoss Enterprise Web Platform 5.1.2 that fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a...

[SECURITY] [DSA 2421-1] moodle security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2421-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff February 29, 2012 http://www.debian.org/security/faq -...

PT-2025-28648

Name of the Vulnerable Software and Affected Versions: Git versions prior to 2.43.7 Git versions prior to 2.44.4 Git versions prior to 2.45.4 Git versions prior to 2.46.4 Git versions prior to 2.47.3 Git versions prior to 2.48.2 Git versions prior to 2.49.1 Git versions prior to 2.50.1 Descriptio...

View PDF Macro in Office Connector makes http fetch from Adobe from https session

The View PDF macro within the Office Connector plugin provides the following http URL even for https sessions when a user's browser fails the Flash installed test. http://www.adobe.com/images/shared/downloadbuttons/getflashplayer.gif It's bad form to mix http urls in with secured https sessions a...

Debian DSA-2179-1 : dtc - SQL injection

Ansgar Burchardt discovered several vulnerabilities in DTC, a web control panel for admin and accounting hosting services. - CVE-2011-0434 The bwpermoth.php graph contains a SQL injection vulnerability. - CVE-2011-0435 Insufficient checks in bwpermonth.php can lead to bandwidth usage information...

DSA-2179-1 dtc - SQL injection

Bulletin has no description...

SuSE 10 Security Update : openslp (ZYPP Patch Number 7187)

The openslp daemon could run into an endless loop when receiving specially crafted packets CVE-2010-3609. This has been fixed. Additionally the following non-security bugs were fixed : - This openSLP update extends the net.slp.isDABackup mechanism introduced with the previous update by a new...

CVE-2010-3901

OpenConnect before 2.25 does not properly validate X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary AnyConnect SSL VPN servers via a crafted server certificate that 1 does not correspond to the server hostname or 2 is presented in circumstances involving a missing...

JC - Top 25 Movie Trailers module XSS Vulnerability

Exploit for php platform in category web applications =================================================== JC - Top 25 Movie Trailers module XSS Vulnerability =================================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'...

Ubuntu Update for sudo vulnerabilities USN-905-1

Ubuntu Update for Linux kernel vulnerabilities USN-905-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN9051.nasl 7965 2017-12-01 07:38:25Z santu $ Ubuntu Update for sudo vulnerabilities USN-905-1 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH,...

irc-ratbox -- multiple vulnerabilities

SecurityFocus reports: The first affects the /quote HELP module and allows a user to trigger an IRCD crash on some platforms. The second affects the /links processing module when the flattenlinks configuration option is not enabled...

CentOS 3 / 4 / 5 : php (CESA-2010:0040)

Updated php packages that fix several security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web...

PHP 5.3 - mail.log Configuration Option open_basedir Restriction Bypass

PHP 5.3 - mail.log Configuration Option openbasedir Restriction Bypass source: https://www.securityfocus.com/bid/36007/info PHP is prone to an 'openbasedir' restriction-bypass vulnerability because of a design error. Successful exploits could allow an attacker to write files in unauthorized...

PHP 5.3 - 'mail.log' Configuration Option 'open_basedir' Restriction Bypass

source: https://www.securityfocus.com/bid/36007/info PHP is prone to an 'openbasedir' restriction-bypass vulnerability because of a design error. Successful exploits could allow an attacker to write files in unauthorized locations. This vulnerability would be an issue in shared-hosting...

OP XAUTHORITY变量本地特权提升漏洞

BUGTRAQ ID: 30226 CNCAN ID：CNCAN-2008071606 OP是一款类似sudo的可替代程序。 OP处理XAUTHORITY变量存在缓冲区溢出，本地攻击者可以利用漏洞提升特权。 当OP使用--enable-xauth配置，并在op.conf中使用xauth配置选项，提交超长数据作为XAUTHORITY变量数据,可触发缓冲区溢出，以高权限执行任意代码，提升特权。 op 1.32 可参考如下安全补丁： http://swapoff.org/changeset/563...

CVE-2007-5962

Memory leak in a certain Red Hat patch, applied to vsftpd 2.0.5 on Red Hat Enterprise Linux RHEL 5 and Fedora 6 through 8, and on Foresight Linux and rPath appliances, allows remote attackers to cause a denial of service memory consumption via a large number of CWD commands, as demonstrated by an...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the user account creation feature in Exponent CMS 0.96.6-GA20071003 and earlier, when the Allow Registration? configuration option is enabled, allow remote attackers to inject arbitrary web script or HTML via the 1 username, 2 firstname, 3...

NetBSD PPP驱动远程溢出漏洞

NetBSD是一款免费开放源代码的UNIX性质的操作系统。 在处理从远程主机所接收到的连接控制协议LCP配置选项时，ppp4没有正确的验证选项长度，这可能导致在所分配的内核内存缓冲区以外读取或写入数据。 能够发送LCP报文的攻击者，包括ppp4连接的远端，可以导致内核忙碌、获得敏感信息或权限提升。 FreeBSD FreeBSD 6.x FreeBSD FreeBSD 5.5 FreeBSD FreeBSD 5.4 FreeBSD FreeBSD 5.3 FreeBSD FreeBSD 4.x NetBSD NetBSD 4.0Beta NetBSD NetBSD 3.1RC1 NetB...

DokuWiki fetch.php Multiple Parameter imconvert Function Arbitrary Command Execution

The remote host is running DokuWiki, an open source wiki application written in PHP. The installed version of DokuWiki fails to properly sanitize input to the 'w' and 'h' parameters of the 'lib/exe/fetch.php' script before using it to execute a command when resizing images. An unauthenticated...

[SA17105] eyeOS Script Insertion and Exposure of User Credentials

TITLE: eyeOS Script Insertion and Exposure of User Credentials SECUNIA ADVISORY ID: SA17105 VERIFY ADVISORY: http://secunia.com/advisories/17105/ CRITICAL: Less critical IMPACT: Cross Site Scripting, Exposure of sensitive information WHERE: From remote SOFTWARE: eyeOS 0.x...