CVE-2014-9247

CVE-2014-9247 affects Zenoss Core up to 5 Beta 3, where remote authenticated users can enumerate sensitive data (user accounts, e-mail addresses, and roles) via the ZenUsers (User Manager) page. Root cause details are not provided in the initial description, and exploitation status or patch infor...

CVE-2014-9247

Zenoss Core through 5 Beta 3 allows remote authenticated users to obtain sensitive 1 user account, 2 e-mail address, and 3 role information by visiting the ZenUsers aka User Manager page, aka ZEN-15389...

[SECURITY] [DSA 3085-1] wordpress security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3085-1 [email protected] http://www.debian.org/security/ Yves-Alexis Perez December 03, 2014 http://www.debian.org/security/faq -...

MGASA-2014-0493 Updated wordpress package fixes security vulnerabilities

XSS in wptexturize via comments or posts, exploitable for unauthenticated users CVE-2014-9031. XSS in media playlists CVE-2014-9032. CSRF in the password reset process CVE-2014-9033. Denial of service for giant passwords. The phpass library by Solar Designer was used in both projects without...

Updated wordpress package fixes security vulnerabilities

XSS in wptexturize via comments or posts, exploitable for unauthenticated users CVE-2014-9031. XSS in media playlists CVE-2014-9032. CSRF in the password reset process CVE-2014-9033. Denial of service for giant passwords. The phpass library by Solar Designer was used in both projects without...

DEBIAN-CVE-2014-3756

The client in Mumble 1.2.x before 1.2.6 allows remote attackers to force the loading of an external file and cause a denial of service hang and resource consumption via a crafted string that is treated as rich-text by a Qt widget, as demonstrated by the 1 user or 2 channel name in a Qt dialog, 3...

CVE-2014-8578

Cross-site scripting XSS vulnerability in the Groups panel in OpenStack Dashboard Horizon before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-3475...

CVE-2014-3475

Cross-site scripting XSS vulnerability in the Users panel admin/users/ in OpenStack Dashboard Horizon before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than...

Cross site scripting

Cross-site scripting XSS vulnerability in the Users panel admin/users/ in OpenStack Dashboard Horizon before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than...

Cross site scripting

Cross-site scripting XSS vulnerability in the Groups panel in OpenStack Dashboard Horizon before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-3475...

CVE-2014-3475

Cross-site scripting XSS vulnerability in the Users panel admin/users/ in OpenStack Dashboard Horizon before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than...

openSUSE Security Update : perl-Email-Address (openSUSE-SU-2014:1328-1)

This update fixes a denial of service vulnerability when parsing an empty quoted string CVE-2014-0477 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2014-604. The text description of...

Mandriva Linux Security Advisory : bugzilla (MDVSA-2014:200)

Updated bugzilla packages fix security vulnerabilities : If a new comment was marked private to the insider group, and a flag was set in the same transaction, the comment would be visible to flag recipients even if they were not in the insider group CVE-2014-1571. An attacker creating a new...

[ MDVSA-2014:192 ] perl-Email-Address

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:192 http://www.mandriva.com/en/support/security/ Package : perl-Email-Address Date : October 1, 2014 Affected: Business Server 1.0 Problem Description: Updated perl-Email-Address package fixes security...

X (Formerly Twitter): Improper Verification of email address while saving Account Settings

Signup for Ads on twitter and navigate to "Account Settings" on ads.twitter.com/accounts Enter any email address and save Account Settings. Notice that the email address gets updated successfully. There is no verification email that is sent out to confirm that the email account updated actually...

Bugzilla Vulnerability Exposes Bug Collections

Hundreds of open source software projects that make use of Bugzilla, Mozilla’s bug-tracking software, anxiously await a patch for a vulnerability that exposes private bugs collected by the system. Mozilla is today expected to make available a patch for the vulnerability in its account creation...

Mandriva Linux Security Advisory : perl-Email-Address (MDVSA-2014:192)

Updated perl-Email-Address package fixes security vulnerability : The parse function in Email::Address module before 1.905 for Perl uses an inefficient regular expression, which allows remote attackers to cause a denial of service CPU consumption via an empty quoted string in an RFC 2822 address...

Fedora Update for perl-Email-Address FEDORA-2014-7610

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for perl-Email-Address FEDORA-2014-7613

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 20 : perl-Email-Address-1.905-1.fc20 (2014-7613)

Update to 1.905 to fix CVE-2014-0477. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL...