6392 matches found
PT-2012-4635
Name of the Vulnerable Software and Affected Versions IBM WebSphere Commerce version 7.0 before 7.0.0.6 Description The issue allows remote attackers to cause a denial of service, resulting in resource consumption, when persistent sessions and personalization IDs are enabled. Recommendations For...
CVE-2012-3300: Undefined Security Weakness
IBM WebSphere Commerce 7.0 before 7.0.0.6, when persistent sessions and personalization IDs are enabled, allows remote attackers to cause a denial of service resource consumption via unspecified vectors...
CVE-2012-4655
The WebLaunch feature in Cisco Secure Desktop before 3.6.6020 does not properly validate binaries that are received by the downloader process, which allows remote attackers to execute arbitrary code via vectors involving 1 ActiveX or 2 Java components, aka Bug IDs CSCtz76128 and CSCtz78204...
Design/Logic Flaw
The WebLaunch feature in Cisco Secure Desktop before 3.6.6020 does not properly validate binaries that are received by the downloader process, which allows remote attackers to execute arbitrary code via vectors involving 1 ActiveX or 2 Java components, aka Bug IDs CSCtz76128 and CSCtz78204...
CVE-2012-4655
The WebLaunch feature in Cisco Secure Desktop before 3.6.6020 does not properly validate binaries that are received by the downloader process, which allows remote attackers to execute arbitrary code via vectors involving 1 ActiveX or 2 Java components, aka Bug IDs CSCtz76128 and CSCtz78204...
ocPoral CMS 8.x | Session Hijacking Vulnerability
OVERVIEW ocPoral CMS 8.x and lower versions are vulnerable to Session Hijacking flaw which could allow attackers to compromise administrator session. 2. PRODUCT DESCRIPTION ocPortal is the website Content Management System a CMS for building and maintaining a dynamic website. ocPortal's powerful...
Authentication flaw
Tridium Niagara AX Framework through 3.6 uses predictable values for 1 session IDs and 2 keys, which might allow remote attackers to bypass authentication via a brute-force attack...
CVE-2012-3024: Improper Authentication
Tridium Niagara AX Framework through 3.6 uses predictable values for 1 session IDs and 2 keys, which might allow remote attackers to bypass authentication via a brute-force attack...
PT-2012-4445 · Tridium · Tridium Niagara Ax Framework
Name of the Vulnerable Software and Affected Versions: Tridium Niagara AX Framework versions prior to 3.8 is not mentioned, however, it is mentioned that versions through 3.6 are affected. Therefore: Tridium Niagara AX Framework versions through 3.6 Description: The issue is related to the use of...
ICS-CERT Warns of Serious Flaws in Tridium Niagara Software
The DHS and ICS-CERT are warning users of some popular Tridium Niagara AX industrial control system software about a series of major vulnerabilities in the applications that are remotely exploitable and could be used to take over vulnerable systems. The bugs, discovered by researchers Billy Rios...
IBM WebSphere MQ File Transfer Edition Web Gateway CSRF
Exploit Author: Nir Valtman Description: Malicious user is able to add userspace, change permissions on existing userspace and add MQMD MQ Message Descriptor user IDs. All of the these vulnerabilities can be exploited using a CSRF Cross Site Request Forgery attack. Few days ago the CVE has been...
Design/Logic Flaw
Cisco NX-OS 4.2, 5.0, 5.1, and 5.2 on Nexus 7000 series switches, when the High Availability HA policy is configured for Reset, allows remote attackers to cause a denial of service device reset via a malformed Cisco Discovery Protocol CDP packet, aka Bug IDs CSCtk34535 and CSCtk19132...
Scientific Linux Security Update : bind on SL5.x, SL4.x, SL3.x i386/x86_64
A flaw was found in the way BIND generates outbound DNS query ids. If an attacker is able to acquire a finite set of query IDs, it becomes possible to accurately predict future query IDs. Future query ID prediction may allow an attacker to conduct a DNS cache poisoning attack, which can result in...
Scientific Linux Security Update : samba on SL5.x, SL4.x, SL3.x i386/x86_64
A buffer overflow flaw was found in the way Samba creates NetBIOS replies. If a Samba server is configured to run as a WINS server, a remote unauthenticated user could cause the Samba server to crash or execute arbitrary code. CVE-2007-5398 A heap based buffer overflow flaw was found in the way...
FreeBSD : bugzilla -- multiple vulnerabilities (58253655-d82c-11e1-907c-20cf30e32f6d)
A Bugzilla Security Advisory reports : The following security issues have been discovered in Bugzilla : Information Leak Versions: 4.1.1 to 4.2.1, 4.3.1 In HTML bugmails, all bug IDs and attachment IDs are linkified, and hovering these links displays a tooltip with the bug summary or the attachme...
bugzilla -- multiple vulnerabilities
A Bugzilla Security Advisory reports: The following security issues have been discovered in Bugzilla: Information Leak Versions: 4.1.1 to 4.2.1, 4.3.1 In HTML bugmails, all bug IDs and attachment IDs are linkified, and hovering these links displays a tooltip with the bug summary or the attachment...
CVE-2012-2760
modauthopenid before 0.7 for Apache uses world-readable permissions for /tmp/modauthopenid.db, which allows local users to obtain session ids...
CVE-2012-2760
modauthopenid before 0.7 for Apache uses world-readable permissions for /tmp/modauthopenid.db, which allows local users to obtain session ids...