bash: security and bugfix update (critical)

bash was updated to fix a critical security issue, a minor security issue and bugs: In some circumstances, the shell would evaluate shellcode in environment variables passed at startup time. This allowed code execution by local or remote attackers who could pass environment variables to bash...

openSUSE Security Update : bash (openSUSE-SU-2014:1226-1) (Shellshock)

bash was updated to fix a critical security issue, a minor security issue and bugs : In some circumstances, the shell would evaluate shellcode in environment variables passed at startup time. This allowed code execution by local or remote attackers who could pass environment variables to bash...

CVE-2014-5336

Monkey HTTP Server before 1.5.3, when the File Descriptor Table FDT is enabled and custom error messages are set, allows remote attackers to cause a denial of service file descriptor consumption via an HTTP request that triggers an error message...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in framework/common/webcommon/includes/messages.ftl in Apache OFBiz 11.04.01 before 11.04.05 and 12.04.01 before 12.04.04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in a 1...

CVE-2012-4241

Multiple cross-site scripting XSS vulnerabilities in Microcart 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO or 2 query string to admin/index.php or 3 firstname, 4 lastname, 5 cc, 6 exp, 7 cvv, 8 address1, 9 address2, 10 city, 11 state, 12 zip, 13 phone, or ...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Microcart 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO or 2 query string to admin/index.php or 3 firstname, 4 lastname, 5 cc, 6 exp, 7 cvv, 8 address1, 9 address2, 10 city, 11 state, 12 zip, 13 phone, or ...

CVE-2012-4241

Multiple cross-site scripting XSS vulnerabilities in Microcart 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO or 2 query string to admin/index.php or 3 firstname, 4 lastname, 5 cc, 6 exp, 7 cvv, 8 address1, 9 address2, 10 city, 11 state, 12 zip, 13 phone, or ...

MS14-049: Description of the security update for Windows Installer Service: August 12, 2014

None None...

CVE-2014-3550

Multiple cross-site scripting XSS vulnerabilities in admin/tool/task/scheduledtasks.php in Moodle 2.7.x before 2.7.1 allow remote attackers to inject arbitrary web script or HTML via vectors that trigger a crafted 1 error or 2 success message for a scheduled task...

Failed to load jet library

Challenge The following error occurs when attempting to perform a restore using Veeam Explorer for Exchange: "Failed to load jet library from C:\ProgramData\Veeam\Backup\ExchangeExplorer\ESE\V15\ese.dll" Solution To solve, upgrade to Internet Explorer 10+ as it contains the necessary Windows file...

Advantech WebAccess Remote Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication requirements on vulnerable installations of Advantech WebAccess. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ChkCookieNoRedir function. By providing arbitrary values to certai...

CVE-2014-4907

Cross-site scripting XSS vulnerability in share/pnp/application/views/kohanaerrorpage.php in PNP4Nagios before 0.6.22 allows remote attackers to inject arbitrary web script or HTML via a parameter that is not properly handled in an error message...

Cross site scripting

Cross-site scripting XSS vulnerability in share/pnp/application/views/kohanaerrorpage.php in PNP4Nagios before 0.6.22 allows remote attackers to inject arbitrary web script or HTML via a parameter that is not properly handled in an error message...

CVE-2014-4907

Cross-site scripting XSS vulnerability in share/pnp/application/views/kohanaerrorpage.php in PNP4Nagios before 0.6.22 allows remote attackers to inject arbitrary web script or HTML via a parameter that is not properly handled in an error message...

Factlink: XSS 01 on staging.fct.li

hey the error message generated can be used to escape out of a dynamically generated href link. The below will render in internet explorer without xss filter enabled of course. See the screenshot for an example. The response is: HTTP/1.1 504 Gateway Time-out Server: nginx/1.4.4 Date: Wed, 02 Jul...

BlueFace Falcon Web Server 2.0 Error Message Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5435/info Falcon Webserver does not sufficiently sanitize HTML tags from error message output. In particular, attackers may inject HTML into 301 and 404 error pages. It is possible to create a malicious link to the server...

Apache Tomcat 3.1 Path Revealing Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1531/info A vulnerability exists in the JSP portion of the Tomcat package, version 3.1, from the Apache Software Foundation. Upon hitting an nonexistent JSP file, too much information is presented by the server as part of...

Macromedia ColdFusion MX 6.0 Error Message Path Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7443/info A vulnerability has been reported for Macromedia ColdFusion MX that may reveal the physical path information to attackers. When certain malformed URL requests are received by the server, an error message is...

Microsoft IIS 5.0 IISAPI Extension Enumerate Root Web Server Directory Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/194/info A GET request that specifies a nonexistent file with an IISAPI-registered extension ie .pl, .idq will cause the IIS server to return an error message that includes the full path of the root web server directory...

Opera 7.0 Error Message History Disclosure Weakness

No description provided by source. source: http://www.securityfocus.com/bid/6759/info It has been reported that Opera fails to ensure that a remote site has proper authorization before executing some methods used to access error messages stored in the Opera console. This issue is further...