[ MDVSA-2014:083 ] mediawiki

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:083 http://www.mandriva.com/en/support/security/ Package : mediawiki Date : May 8, 2014 Affected: Business Server 1.0 Problem Description: Updated mediawiki packages fix security vulnerabilities: Login CSRF...

DEBIAN-CVE-2014-3207

Cross-site scripting XSS vulnerability in wserver.ml in SKS Keyserver before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to pks/lookup/undefined1...

Design/Logic Flaw

The runtime WS component in the server in EMC RSA Access Manager 6.1.3 before 6.1.3.39, 6.1.4 before 6.1.4.22, 6.2.0 before 6.2.0.11, and 6.2.1 before 6.2.1.03, when INFO logging is enabled, allows local users to discover cleartext passwords by reading log files...

CVE-2014-0646

CVE-2014-0646 affects EMC RSA Access Manager Server components where, when INFO logging is enabled, local users can read log files to discover cleartext passwords. Affected versions include RSA Access Manager 6.1.3 before 6.1.3.39, 6.1.4 before 6.1.4.22, 6.2.0 before 6.2.0.11, and 6.2.1 before 6....

CVE-2014-0857

CVE-2014-0857 affects IBM WebSphere Application Server (WAS) Administrative Console. Affected versions: WAS 8.x before 8.0.0.9 and 8.5.x before 8.5.5.2. Description: remote authenticated users can obtain sensitive information via a crafted request due to improper handling of requests in the Admin...

CVE-2014-3129

The Java Server Pages in the Software Lifecycle Manager SLM in SAP NetWeaver allows remote attackers to obtain sensitive information via a crafted request, related to SAP Solution Manager 7.1...

CVE-2014-2853

Cross-site scripting XSS vulnerability in includes/actions/InfoAction.php in MediaWiki before 1.21.9 and 1.22.x before 1.22.6 allows remote attackers to inject arbitrary web script or HTML via the sort key in an info action...

CVE-2014-0778 Progea Movicon SCADA Exposure of Sensitive Information to an Unauthorized Actor

TCPUploader module listens on Port 10651/TCP for incoming connections. Exploitation of this vulnerability could allow a remote unauthenticated user access to release OS version information. While this is a minor vulnerability, it represents a method for further network reconnaissance...

Localize: Path Disclosure (Info Disclosure) in http://www.localize.io

Hello, I found a information disclosure vulnerability. How to reproduce: GET : http://www.localize.io/ POST : signinusername=test&signinpassword=test The info from page is Warning: trim expects parameter 1 to be string, array given in...

Design/Logic Flaw

JBoss Fuse did not enable encrypted passwords by default in its usage of Apache Zookeeper. This permitted sensitive information disclosure via logging to local users. Note: this description has been updated; previous text mistakenly identified the source of the flaw as Zookeeper. Previous text:...

DEBIAN-CVE-2014-2706

Race condition in the mac80211 subsystem in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service system crash via network traffic that improperly interacts with the WLANSTAPSSTA state aka power-save mode, related to stainfo.c and tx.c...

Threat Outbreak Alert: Fake Employer Information Email Messages on April 11, 2014

Medium Alert ID: 33760 First Published: 2014 April 11 16:03 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain information for employers for the recipient. The text in the email message attempts to convince the recipient to...

IntegraXor账户信息泄漏漏洞

Bugtraq ID:66554 Ecava IntegraXor是一款使用HTML和SVG的人机接口产品。 Ecava IntegraXor存在未明错误，允许攻击者利用漏洞获取敏感账户信息。 0 IntegraXor 4.x Ecava IntegraXor 4.1 build 4410版本已修复该漏洞，建议用户下载使用： http://www.integraxor.com...

Nullsoft Winamp RIFF INFO Record Heap Buffer Overflow - Ver2 (CVE-2011-3834)

A buffer overflow vulnerability has been reported in Nullsoft Winamp. The vulnerability is due to a heap buffer overflow while handling a malformed AVI file. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

UBUNTU-CVE-2013-5951

Multiple cross-site scripting XSS vulnerabilities in eXtplorer 2.1.3, when used as a component for Joomla!, allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to 1 application.js.php in scripts/ or 2 admin.php, 3 copymove.php, 4 functions.php, 5 header.php, or 6...

Patch Management: SCCM Computer Info Initialization

Binary data sccmgetcomputerinfo.nbin...

CVE-2014-2024

Cross-site scripting XSS vulnerability in classes/controller/error.php in Open Classifieds 2 before 2.1.3 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to shared-apartments-rooms/...

MongoDB BSON Object Information Disclosure Vulnerability

MongoDB is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mongodb:mongodb"; if...

Microsoft Windows Kernel 'Win32k.sys' CVE-2014-0323 Local Information Disclosure Vulnerability

Description Microsoft Windows is prone to a local information-disclosure vulnerability. An attacker can leverage this issue to disclose kernel memory and obtain sensitive information that may aid in further attacks. Technologies Affected Avaya Aura Conferencing 6.0 SP1 Standard Avaya Aura...

D-link DSL-2640B Router Admin password change Information Disclosure - Ver2 (CVE-2010-1308)

An information disclosure vulnerability has been reported in La-souris-verte Com Svmap. Successful exploitation of this vulnerability would allow a remote attacker to obtain sensitive information...