GNU Bash - Shellshock Environment Variable Command Injection

GNU Bash - Shellshock Environment Variable Command Injection Exploit Database Note: The following is an excerpt from: https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/ Like “real” programming languages, Bash has functions, though in a...

BurpSentintel - GUI Burp Plugin to ease discovering of security holes in web applications

A plugin for Burp Intercepting Proxy, to aid and ease the identification of vulnerabilities in web applications. Searching for vulnerabilities in web applications can be a tedious task. Most of the time consists of inserting magic chars into parameters, and looking for suspicious output. Sentinel...

PT-2014-7265 · Oracle +6 · Mysql Server +6

Name of the Vulnerable Software and Affected Versions: Oracle MySQL Server versions 5.5.38 and earlier Description: The issue allows remote authenticated users to affect availability via vectors related to SERVER:DDL. This means that authenticated users can potentially impact the system's...

RHEL 6 : condor (RHSA-2013:1172)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2013:1172 advisory. HTCondor is a specialized workload management system for compute-intensive jobs. It provides a job queuing mechanism, scheduling policy, priority...

Sun ONE Unified Development Server 5.0 Recursive Document Type Definition Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/6626/info It has been reported that problems with the handling of recursive document type definitions DTDs occur in Sun ONE Unified Development Server UDS. When a document is uploaded containing these types of constructs,...

Maligno - Penetration Testing Tool that Serves Metasploit Payloads

Maligno is an open source penetration testing tool that serves Metasploit payloads. It generates shellcode with msfvenom and transmits it over HTTP or HTTPS. The shellcode is encrypted with AES and encoded with Base64 prior to transmission. Changelog: Metasploit multi-host support, socks4a server...

Security vulnerability concepts and classification-vulnerability warning-the black bar safety net

Author: Wang column army This is a security vulnerability related to the science, introducing a security vulnerability concept, vulnerability in several dimensions of classification and examples show. Security vulnerability and related concepts This section describes what is a security...

Samba Root File System Access Security Bypass (CVE-2009-0022)

A security bypass vulnerability exists in Samba. The vulnerability is due to a design weakness when registry based share definition is enabled. A remote attacker may leverage this vulnerability to gain read-only access to the local file system in the security context of the Samba service...

CVE-2014-0111

Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions, "derived schema definition," "user / role templates," and "account links of resource mappings."...

CVE-2014-0111: Improper Control of Generation of Code

Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions, "derived schema definition," "user / role templates," and "account links of resource mappings."...

McAfee ePolicy Orchestrator XML External Entity (CVE-2014-2205)

An XML External Entity XXE vulnerability has been reported in McAfee ePolicy Orchestrator ePO. The vulnerability is due to a design weakness in the ePO Web Console component. A remote attacker can exploit this vulnerability by sending a maliciously crafted XML dashboard definition...

Oracle Demantra 12.2.1 - SQL Injection

Details: Application is vulnerable to SQL injection. Impact: An attacker with access to the vulnerable pages could manipulate the queries being sent to the database, potentially enabling them to: - Extract sensitive information, including but not limited to authentication credentials and personal...

[SECURITY] Fedora 18 Update: php-symfony2-Form-2.2.10-1.fc18

Form provides tools for defining forms, rendering and binding request data to related models. Furthermore it provides integration with the Validation component...

CVE-2013-4255

The policy definition evaluator in Condor 7.5.4, 8.0.0, and earlier does not properly handle attributes in a 1 PREEMPT, 2 SUSPEND, 3 CONTINUE, 4 WANTVACATE, or 5 KILL policy that evaluate to an Unconfigured, Undefined, or Error state, which allows remote authenticated users to cause a denial of...

CVE-2013-4255

The policy definition evaluator in Condor 7.5.4, 8.0.0, and earlier does not properly handle attributes in a 1 PREEMPT, 2 SUSPEND, 3 CONTINUE, 4 WANTVACATE, or 5 KILL policy that evaluate to an Unconfigured, Undefined, or Error state, which allows remote authenticated users to cause a denial of...

CVE-2013-4255

HTCondor vulnerability CVE-2013-4255 affects policy evaluation in Condor (7.5.4, 8.0.0 and earlier). If a job defines a policy attribute in CONTINUE, KILL, PREEMPT, SUSPEND, or related policies that evaluates to UNDEFINED/ERROR/Unconfigured, a remote authenticated user could cause condor_startd t...

PT-2013-1376

Name of the Vulnerable Software and Affected Versions Condor versions prior to 7.4.2 Description The policy definition evaluator does not properly handle attributes in a WANT SUSPEND policy that evaluate to an UNDEFINED state. This allows remote authenticated users to cause a denial of service...

CVE-2013-4255: Improper Input Validation

The policy definition evaluator in Condor 7.5.4, 8.0.0, and earlier does not properly handle attributes in a 1 PREEMPT, 2 SUSPEND, 3 CONTINUE, 4 WANTVACATE, or 5 KILL policy that evaluate to an Unconfigured, Undefined, or Error state, which allows remote authenticated users to cause a denial of...

PT-2013-4920

Name of the Vulnerable Software and Affected Versions Condor versions 7.5.4 and earlier, 8.0.0 Description The policy definition evaluator does not properly handle attributes in certain policies that evaluate to an Unconfigured, Undefined, or Error state. This allows remote authenticated users to...

CVE-2013-3735

The Zend Engine in PHP before 5.4.16 RC1, and 5.5.0 before RC2, does not properly determine whether a parser error occurred, which allows context-dependent attackers to cause a denial of service memory consumption and application crash via a crafted function definition, as demonstrated by an atta...