2924 matches found
CVE-2014-4958
Cross-site scripting XSS vulnerability in Telerik UI for ASP.NET AJAX RadEditor control 2014.1.403.35, 2009.3.1208.20, and other versions allows remote attackers to inject arbitrary web script or HTML via CSS expressions in style attributes...
Cross site scripting
Cross-site scripting XSS vulnerability in Telerik UI for ASP.NET AJAX RadEditor control 2014.1.403.35, 2009.3.1208.20, and other versions allows remote attackers to inject arbitrary web script or HTML via CSS expressions in style attributes...
RHEL 6 : katello-configure (RHSA-2014:1186)
An updated katello-configure package that fixes one security issue is now available for Red Hat Subscription Asset Manager. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...
elasticsearch: remote code execution flaw via dynamic scripting
It was discovered that the default configuration of Elasticsearch enabled dynamic scripting, allowing a remote attacker to execute arbitrary MVEL expressions and Java code via the source parameter passed to search...
elasticsearch: remote code execution flaw via dynamic scripting
It was discovered that the default configuration of Elasticsearch enabled dynamic scripting, allowing a remote attacker to execute arbitrary MVEL expressions and Java code via the source parameter passed to search...
SearchMyFiles v2.50 - Alternative to 'Search For Files And Folders' module of Windows + Duplicates Search
SearchMyFiles is an alternative to the standard "Search For Files And Folders" module of Windows. It allows you to easily search files in your system by wildcard, by last modified/created/last accessed time, by file attributes, by file content text or binary search, and by the file size...
Default configuration
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to search. NOTE: this only violates the vendor's intended security policy if the user does not run...
Apache Struts ParametersInterceptor Remote Code Execution
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3...
Mozilla Suite/Firefox JavaScript Lambda Replace Heap Memory Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/12988/info Mozilla Suite/Firefox are reported prone to a memory-disclosure vulnerability. This issue can allow a remote attacker to access arbitrary heap memory. Due to an error in the way 'replace' handles lambda...
Red Hat 8/9 Directory Server Crafted Search Pattern Denial of Service Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/30871/info Red Hat Directory Server is prone to a denial-of-service vulnerability because the server fails to handle specially crafted search patterns. An attacker can exploit this issue to consume CPU resources with one...
FreeIPS 1.0 Protected Service Denial of Service Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/10541/info It is reported that FreeIPS is susceptible to a denial of service vulnerability. FreeIPS scans TCP connections for particular strings, defined by regular expressions. If a packet matches the regular expression,...
DenyHosts: Denial of service
Background DenyHosts is a script intended to be run by Linux system administrators to help thwart SSH server attacks. Description DenyHosts does not properly define the regular expressions used when parsing SSH authentication logs. Impact A remote attacker could possibly cause a Denial of Service...
openSUSE Security Update : dhcp (openSUSE-2011-68)
Applied security fix for a DoS due to processing certain regular expressions, extracted from 4.2.3-P1 bnc735610, CVE-2011-4539 : - Add a check for a NULL pointer before calling the regexec function. Without out this check we could, under some circumstances, pass a NULL pointer to the regexec...
openSUSE Security Update : dhcp (openSUSE-SU-2011:1318-1)
Specially crafted requests could crash dhcpd if the server used regular expressions for matching CVE-2011-4539. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update dhcp-5532. The text description ...
openSUSE Security Update : dhcp (openSUSE-SU-2013:0619-1)
The ISC dhcp server was updated to fix a denial of service attack via regular expressions : - Removed regex.h check from configure in bind sources bnc811934, CVE-2013-2266. Make the bind export library build output visible. dhcp-4.2.4-P2-no-bind-regex-check.CVE-2013-2266.diff Also fixed : - Added...
Arbitrary Code Execution
Overview Affected versions of this package are vulnerable to Arbitrary Code Execution. $parse allowed arbitrary code execution via Angular expressions under some very specific conditions. The only applications affected by these vulnerabilities are those that match all of the following conditions:...
Batch site DNS zone transfer vulnerability detection-bash shell implemented-vulnerability warning-the black bar safety net
0x00 background The following illustration of eecs. cc author self-built a machine with a private root DNS server, and open the zone transfer permissions, so the results: the cc zone transfer success. The figure is just an experimental verification, the following article started! ! 2 0 1 4 0 5 1 ...
[SECURITY] CVE-2014-0111 Apache Syncope
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2014-0111: Remote code execution by an authenticated administrator Severity: Important Vendor: The Apache Software Foundation Versions Affected: Syncope 1.0.0 to 1.0.8 Syncope 1.1.0 to 1.1.6 Description: In the various places in which Apache Commo...
CVE-2014-0111
Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions, "derived schema definition," "user / role templates," and "account links of resource mappings."...
CVE-2014-0111
Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions, "derived schema definition," "user / role templates," and "account links of resource mappings."...