rubygem-actionpack: directory traversal issue

A directory traversal flaw was found in the way Ruby on Rails handled wildcard segments in routes with implicit rendering. A remote attacker could use this flaw to retrieve arbitrary local files accessible to a Ruby on Rails application using the aforementioned routes via a specially crafted...

USN-2256-1 swift vulnerability

John Dickinson discovered that Swift did not properly quote the WWW-Authenticate header value. If a user were tricked into navigating to a malicious Swift URL, an attacker could conduct cross-site scripting attacks. With cross-site scripting vulnerabilities, if a user were tricked into viewing...

CVE-2014-3804

The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted 1 updatesysteminfodebianpackage, 2 ossectask, 3 setossimsetup adminip, 4 syncrserver, or 5 setossimsetup frameworkip request, a different vulnerability than CVE-2014-38...

Design/Logic Flaw

The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted 1 updatesysteminfodebianpackage, 2 ossectask, 3 setossimsetup adminip, 4 syncrserver, or 5 setossimsetup frameworkip request, a different vulnerability than CVE-2014-38...

tomcat7: RHEL-7 regression causing DoS

A certain tomcat7 package for Apache Tomcat 7 in Red Hat Enterprise Linux RHEL 7 allows remote attackers to cause a denial of service CPU consumption via a crafted request. NOTE: this vulnerability exists because of an unspecified regression...

DEBIAN-CVE-2014-3968

The HVMOPinjectmsi function in Xen 4.2.x, 4.3.x, and 4.4.x allows local guest HVM administrators to cause a denial of service host crash via a large number of crafted requests, which trigger an error messages to be logged...

Code injection

The HVMOPinjectmsi function in Xen 4.2.x, 4.3.x, and 4.4.x allows local guest HVM administrators to cause a denial of service host crash via a large number of crafted requests, which trigger an error messages to be logged...

UBUNTU-CVE-2014-3968

The HVMOPinjectmsi function in Xen 4.2.x, 4.3.x, and 4.4.x allows local guest HVM administrators to cause a denial of service host crash via a large number of crafted requests, which trigger an error messages to be logged...

CVE-2012-6141

The App::Context module 0.01 through 0.968 for Perl does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via a crafted request to 1 App::Session::Cookie or 2 App::Session::HTMLHidden, which is not properly handled when it is deserialized...

Red Hat CloudForms AgentController Directory Traversal (CVE-2013-2068)

A directory traversal vulnerability has been reported in Red Hat CloudForms. This vulnerability is due to improper sanitization of of the "filename" GET parameter passed to the "linuxpkgs" method of the AgentController. A remote unauthenticated attacker can exploit this vulnerability by sending...

InduSoft Web Studio Directory Traversal (CVE-2014-0780)

A directory traversal vulnerability has been reported in InduSoft Web Studio. The vulnerability is due to insufficient validation of certain requests while using the development web server. An unauthenticated attacker could exploit this vulnerability by sending crafted requests to the vulnerable...

FreeBSD bsnmpd GETBULK PDU Stack Buffer Overflow - ver 2 (CVE-2014-1452)

A remote code execution vulnerability exists in the FreeBSD. The vulnerability is caused due to improper handling of crafted GETBULK PDU requests. A remote, unauthenticated attacker can exploit these vulnerabilities to execute arbitrary code on the target system within the security context of...

Apache Tomcat Server Malicious Request Information Disclosure (CVE-2002-2006; CVE-2002-2007; CVE-2002-2008)

An Information disclosure vulnerability has been reported in Apache Tomcat servers. The vulnerability is due to an error in the way Apache Tomcat handles specially crafted page requests. A remote attacker can exploit this vulnerability by sending crafted requests which will result in Apache Tomca...

PYSEC-2014-60

The object manager implementation objectmanager.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly restrict access to internal methods, which allows remote attackers to obtain sensitive information via a crafted request...

PT-2014-3803 · Cisco · Cisco Asa

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software version 9.1.3 and earlier Description: A race condition in the Phone Proxy component allows remote attackers to bypass sec db authentication and provide certain pass-through services to untrusted...

FreeBSD bsnmpd GETBULK PDU Stack Buffer Overflow (CVE-2014-1452)

A remote code execution vulnerability exists in the FreeBSD. The vulnerability is caused due to improper handling of crafted GETBULK PDU requests. A remote,unauthenticated attacker can exploit these vulnerabilities to execute arbitrary code on the target system within the security context of bsnm...

haneWIN DNS Server Denial Of Service Vulnerability

This host is running haneWIN DNS server and is prone to denial of service vulnerability. OpenVAS Vulnerability Test $Id: gbhanewindnsserverdosvuln.nasl 6769 2017-07-20 09:56:33Z teissa $ haneWIN DNS Server Denial Of Service Vulnerability Authors: Antu Sanadi Copyright: Copyright c 2014 Greenbone...

haneWIN DNS Server Denial Of Service Vulnerability

haneWIN DNS server is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Apache Roller OGNL Injection Remote Code Execution (CVE-2013-4212)

A command execution vulnerability exists in Apache Roller due to a lack of sanitization on OGNL expressions passed to certain methods. This can lead to OGNL injection which can result in remote code execution. A remote unauthenticated attacker could exploit this vulnerability by sending crafted...

Design/Logic Flaw

actionpack/lib/actiondispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query...