2856 matches found
DEBIAN-CVE-2014-2327
Cross-site request forgery CSRF vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that 1 modify binary files, 2 modify configurations, or 3 add arbitrary users...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that 1 modify binary files, 2 modify configurations, or 3 add arbitrary users...
CVE-2014-2327
Cross-site request forgery CSRF vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that 1 modify binary files, 2 modify configurations, or 3 add arbitrary users...
CVE-2014-2327
Cross-site request forgery CSRF vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that 1 modify binary files, 2 modify configurations, or 3 add arbitrary users...
CVE-2013-7363
CVE-2013-7363 concerns an unspecified vulnerability in the Diagnostics (SMD) agent of SAP Solution Manager . The connected sources describe that remote attackers can leverage vectors involving the P4 protocol to: (1) obtain sensitive information, (2) modify the configuration of applications, and ...
Scientific Linux Security Update : httpd on SL6.x i386/x86_64 (20140403)
It was found that the moddav module did not correctly strip leading white space from certain elements in a parsed XML. In certain httpd configurations that use the moddav module for example when using the moddavsvn module, a remote attacker could send a specially crafted DAV request that would...
Yahoo Encryption Slammed for Lack of Forward Secrecy, HSTS
Yahoo, as promised, rolled out HTTPs by default this week for its email service, bringing it in line with other Internet companies that have been securing users’ communication for years. But if Yahoo expected applause from security experts, it can think again. The response from those well-versed ...
IG Report Shows DHS Making Progress, But Still Has Room to Improve on Information Security
Although there are still a number of issues that need to be addressed with the Department of Homeland Security’s information security efforts, the department is improving in many areas and making strong progress toward implementing better security controls, a new report from the Inspector General...
nginx -- Request line parsing vulnerability
The nginx project reports: Ivan Fratric of the Google Security Team discovered a bug in nginx, which might allow an attacker to bypass security restrictions in certain configurations by using a specially crafted request, or might have potential other impact CVE-2013-4547...
Kernel: HID: LG: heap overflow flaw
The Human Interface Device HID subsystem in the Linux kernel through 3.11, when CONFIGLOGITECHFF, CONFIGLOGIG940FF, or CONFIGLOGIWHEELSFF is enabled, allows physically proximate attackers to cause a denial of service heap-based out-of-bounds write via a crafted device, related to 1...
HD Moore, Project Sonar Crowdsources Vulnerability Analysis
The state of embedded device security is poor, and there hasn’t been much in the way of discussion to the contrary. It’s well established that vendors skimp on security, selling for example, routers and other networking gear protected only by default passwords, or other critical devices engineere...
XSS in admin/ViewIssueFields.jspa
Reproduction: 1. Create custom fields with alert1 in name and/or description. 2. Go to 'Field Configurations' 3. Click 'Add Field Configuration', enter any text in 'Name' 4. Hit okay and wait for the page to refresh 5. Choose the config you just made - XSSed...
XSS in admin/ViewIssueFields.jspa
Reproduction: 1. Create custom fields with alert1 in name and/or description. 2. Go to 'Field Configurations' 3. Click 'Add Field Configuration', enter any text in 'Name' 4. Hit okay and wait for the page to refresh 5. Choose the config you just made - XSSed...
XSS in admin/ViewIssueFields.jspa
Reproduction: 1. Create custom fields with alert1 in name and/or description. 2. Go to 'Field Configurations' 3. Click 'Add Field Configuration', enter any text in 'Name' 4. Hit okay and wait for the page to refresh 5. Choose the config you just made - XSSed...
Oil, Energy Watering Hole Attacks Linked to DOL attack
A string of watering hole attacks targeting oil and energy companies dating back to May could be linked to similar attacks against the U.S. Department of Labor website. Researchers at Cisco discovered the compromised domains of 10 oil and energy companies worldwide, including hydroelectric plants...
[SECURITY] Fedora 19 Update: ghc-xmonad-contrib-0.11.2-1.fc19
Third party tiling algorithms, configurations and scripts to xmonad, a tiling window manager for X. For an introduction to building, configuring and using xmonad extensions, see "XMonad.Doc". In particular: "XMonad.Doc.Configuring", a guide to configuring xmonad "XMonad.Doc.Extending", using the...
[SECURITY] Fedora 18 Update: nodejs-config-chain-1.1.7-1.fc18
Use this module to load all your configurations...
Oracle Linux 5 : kernel (ELSA-2009-1670)
The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2009-1670 advisory. - nfs v4: fix setting lock on open file with no state Jeff Layton 533114 533115 CVE-2009-3726 - drm r128: check for init on all ioctls that require it...
CVE-2013-4686
The kernel in Juniper Junos 10.4 before 10.4R14, 11.4 before 11.4R8, 11.4X27 before 11.4X27.43, 12.1 before 12.1R6, 12.1X44 before 12.1X44-D20, 12.2 before 12.2R4, and 12.3 before 12.3R2, in certain VLAN configurations with unrestricted arp-resp and proxy-arp settings, allows remote attackers to...
Design/Logic Flaw
The kernel in Juniper Junos 10.4 before 10.4R14, 11.4 before 11.4R8, 11.4X27 before 11.4X27.43, 12.1 before 12.1R6, 12.1X44 before 12.1X44-D20, 12.2 before 12.2R4, and 12.3 before 12.3R2, in certain VLAN configurations with unrestricted arp-resp and proxy-arp settings, allows remote attackers to...