CVE-2013-1423

1 contrib/gforge-3.0-cronjobs.patch, 2 cronjobs/homedirs.php, 3 deb-specific/fileforge.pl, 4 deb-specific/groupdumpupdate.pl, 5 deb-specific/sshdumpupdate.pl, 6 deb-specific/userdumpupdate.pl, 7 plugins/scmbzr/common/BzrPlugin.class.php, 8 plugins/scmcvs/common/CVSPlugin.class.php, 9...

Hardcoded credentials

1 contrib/gforge-3.0-cronjobs.patch, 2 cronjobs/homedirs.php, 3 deb-specific/fileforge.pl, 4 deb-specific/groupdumpupdate.pl, 5 deb-specific/sshdumpupdate.pl, 6 deb-specific/userdumpupdate.pl, 7 plugins/scmbzr/common/BzrPlugin.class.php, 8 plugins/scmcvs/common/CVSPlugin.class.php, 9...

CVE-2013-1423

FusionForge 5.0–5.2 contains privilege-escalation vulnerabilities allowing local users to change arbitrary file permissions, read sensitive data, and other impacts via symlink or hard-link attacks on privileged files. Affected components/files include patches and scripts across contrib/gforge-3.0...

CentOS Update for infiniband-diags CESA-2013:0509 centos6

Check for the Version of infiniband-diags OpenVAS Vulnerability Test CentOS Update for infiniband-diags CESA-2013:0509 centos6 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/o...

CentOS Update for ibutils CESA-2013:0509 centos6

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Design/Logic Flaw

script/katello-generate-passphrase in Katello 1.1 uses world-readable permissions for /etc/katello/secure/passphrase, which allows local users to obtain the passphrase by reading the file...

CVE-2012-5561

CVE-2012-5561 is confirmed in connected Red Hat advisory RHSA-2013:0547 for CloudForms System Engine 1.1.2. The issue arises from the script /usr/share/katello/script/katello-generate-passphrase setting world-readable permissions on /etc/katello/secure/passphrase, allowing a local attacker to rea...

CVE-2012-5561

script/katello-generate-passphrase in Katello 1.1 uses world-readable permissions for /etc/katello/secure/passphrase, which allows local users to obtain the passphrase by reading the file...

Apache Tomcat 'log/logdir'目录不安全文件权限漏洞

Bugtraq ID:58124 Apache Tomcat是一款开放源码的JSP应用服务器程序。 Apache Tomcat创建的log/logdir日志文件全局可读，本地攻击者可以利用漏洞获得敏感信息。 0 Apache Tomcat 厂商解决方案 目前没有详细解决方案提供： http://tomcat.apache.org...

Nginx 'access.log'不安全文件权限漏洞

BUGTRAQ ID: 58105 CVECAN ID: CVE-2013-0337 nginx是一款使用非常广泛的高性能Web服务器。 在Gentoo上，/var/log/nginx全局可访问，目录内的日志文件也是全局可读，这可允许未授权用户读取日志文件。 0 Igor Sysoev nginx 厂商补丁： Igor Sysoev ----------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://nginx.net/...

Configserver: Passwords from application blueprint stored plaintext in configserver.log

Aeolus Configuration Server, as used in Red Hat CloudForms Cloud Engine before 1.1.2, uses world-readable permissions for /var/log/aeolus-configserver/configserver.log, which allows local users to read plaintext passwords by reading the log file...

tuned: insecure permissions of tuned.pid

tuned 2.10.0 creates its PID file with insecure permissions which allows local users to kill arbitrary processes...

CVE-2012-5605

CVE-2012-5605 affects Red Hat CloudForms System Engine prior to version 1.1. The issue arises from grinder cache in /var/lib/pulp/cache/grinder/ using world-writable permissions, enabling local attackers to read or modify grinder cache files. The RHSA-2012:1543 advisory documents this vulnerabili...

CVE-2012-0961

Apt 0.8.16exp5ubuntu13.x before 0.8.16exp5ubuntu13.6, 0.8.16exp12ubuntu10.x before 0.8.16exp12ubuntu10.7, and 0.9.7.5ubuntu5.x before 0.9.7.5ubuntu5.2, as used in Ubuntu, uses world-readable permissions for /var/log/apt/term.log, which allows local users to obtain sensitive shell information by...

CVE-2012-5638

The setuplogging function in log.h in SANLock uses world-writable permissions for /var/log/sanlock.log, which allows local users to overwrite the file content or bypass intended disk-quota restrictions via standard filesystem write operations...

Centrify Deployment Manager 2.1.0.283 - Local Privilege Escalation

Centrify Deployment Manager 2.1.0.283 - Local Privilege Escalation Centrify Deployment Manager v2.1.0.283 local root 12/7/2012 Taking a little longer look at the software, I managed to win a race condition and get root with files in /tmp. Here is my analysis: root@h0g:/tmp ls -l /etc/shadow...

Microsoft Windows IIS FTP Service Information Disclosure Vulnerability (2761226)

This host is missing a moderate security update according to Microsoft Bulletin MS12-073. OpenVAS Vulnerability Test $Id: secpodms12-073.nasl 5346 2017-02-19 08:43:11Z cfi $ Microsoft Windows IIS FTP Service Information Disclosure Vulnerability 2761226 Authors: Rachana Shetty Copyright: Copyright...

Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : munin vulnerabilities (USN-1622-1)

It was discovered that the Munin qmailscan plugin incorrectly handled temporary files. A local attacker could use this issue to possibly overwrite arbitrary files. This issue only affected Ubuntu 10.04 LTS, Ubuntu 11.10, and Ubuntu 12.04 LTS. CVE-2012-2103 It was discovered that Munin incorrectly...

AMI: insecure default file permissions for /var/cache/jboss-ec2-eap

EC2 Amazon Machine Image AMI in JBoss Enterprise Application Platform EAP 5.1.2 uses 755 permissions for /var/cache/jboss-ec2-eap/, which allows local users to read sensitive information such as Amazon Web Services AWS credentials by reading files in the directory...

rhncfg: Insecure permissions used for /var/log/rhncfg-actions file

Red Hat Network RHN Configuration Client rhncfg-client in rhncfg before 5.10.27-8 uses weak permissions world-readable for /var/log/rhncfg-actions, which allows local users to obtain sensitive information about the rhncfg-client actions by reading the file...