kde-workspace -- privilege escalation

David Edmundson reports: KDE workspace configuration module for setting the date and time has a helper program which runs as root for performing actions. This is secured with polkit. This helper takes the name of the ntp utility to run as an argument. This allows a hacker to run any arbitrary...

openSUSE Security Update : wpa_supplicant (openSUSE-SU-2014:1314-1)

add 0001-Add-osexec-helper-to-run-external-programs.patch - add 0002-wpacli-Use-osexec-for-action-script-execution.pat ch - fixing CVE-2014-3686 bnc900611 trying to abuse the action scripts in wpacli %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

Validator: JSM bypass via ReflectionHelper

It was discovered that the implementation of org.hibernate.validator.util.ReflectionHelper together with the permissions required to run Hibernate Validator under the Java Security Manager could allow a malicious application deployed in the same application container to execute several actions wi...

CVE-2014-2886

GKSu 2.0.2, when sudo-mode is not enabled, uses " double quote characters in a gksu-run-helper argument, which allows attackers to execute arbitrary commands in certain situations involving an untrusted substring within this argument, as demonstrated by an untrusted filename encountered during...

UBUNTU-CVE-2014-2886

GKSu 2.0.2, when sudo-mode is not enabled, uses " double quote characters in a gksu-run-helper argument, which allows attackers to execute arbitrary commands in certain situations involving an untrusted substring within this argument, as demonstrated by an untrusted filename encountered during...

CVE-2014-2886

GKSu 2.0.2, when sudo-mode is not enabled, uses " double quote characters in a gksu-run-helper argument, which allows attackers to execute arbitrary commands in certain situations involving an untrusted substring within this argument, as demonstrated by an untrusted filename encountered during...

PT-2014-4946

Name of the Vulnerable Software and Affected Versions GKSu version 2.0.2 Description The issue allows attackers to execute arbitrary commands in certain situations when an untrusted substring is present within a gksu-run-helper argument. This can occur, for example, during the installation of a...

CVE-2014-2886: Undefined Security Weakness

GKSu 2.0.2, when sudo-mode is not enabled, uses " double quote characters in a gksu-run-helper argument, which allows attackers to execute arbitrary commands in certain situations involving an untrusted substring within this argument, as demonstrated by an untrusted filename encountered during...

SuSE 11.3 Security Update : procmail (SAT Patch Number 9689)

procmail was updated to fix a security issue in its formail helper. - When formail processed specially crafted e-mail headers a heap corruption could be triggered, which would lead to a crash of formail. CVE-2014-3618 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

CVE-2014-5582

The Ingress Intel Helper aka com.bb.ingressintel application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Ingress Intel Helper aka com.bb.ingressintel application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5582

The Ingress Intel Helper aka com.bb.ingressintel application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5582

CVE-2014-5582 (Ingress Intel Helper) affects the Android app (package com.bb.ingressintel) version 1.2. The root cause is failure to verify X.509 certificates when establishing SSL connections, enabling a man-in-the-middle attacker to spoof servers and access sensitive information via a crafted c...

PT-2014-6567

Name of the Vulnerable Software and Affected Versions Ingress Intel Helper aka com.bb.ingressintel version 1.2 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate because the application does not verify X.509...

CVE-2014-5582: Undefined Security Weakness

The Ingress Intel Helper aka com.bb.ingressintel application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

PHP Live Helper 2.0 Chat.PHP Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/17960/info PHP Live Helper is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrar...

Gnome-PTY-Helper UTMP Hostname Spoofing Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/15004/info 'gnome-pty-helper' is susceptible to a local UTMP hostname spoofing vulnerability. This issue is due to the failure of the application to properly validate user-supplied data prior to using it to update UTMP...

php live helper <= 2.0.1 - Multiple Vulnerabilities

No description provided by source. GulfTech Security Research August 16, 2008 Vendor : Turnkey Web Tools, Inc URL : http://www.turnkeywebtools.com Version : PHP Live Helper = 2.0.1 Risk : Multiple Vulnerabilities Description: PHP Live Helper is an online support system written in php that allows...

OS X Viscosity OpenVPN Client - Local Root Exploit

No description provided by source. !/bin/sh Viscatory zx2c4 After the hullabaloo from the Tunnelblick local root, savy Mac users began defending Viscosity, another OS X VPN client. They figured, since they spent money on Viscosity, surely it would be better designed than the free open-source...

PHP Live Helper <= 1.x (abs_path) Remote File Include Vulnerability

No description provided by source. --------------------------------------------------------------------------- PHP Live Helper =abspath Remote File Include Vulnerabilities --------------------------------------------------------------------------- Discovered By SnIpErSA Author : SnIpErSA Remote :...