2707 matches found
powerdns -- Label decompression bug can cause crashes or CPU spikes
The PowerDNS project reports: A bug was discovered in our label decompression code, making it possible for names to refer to themselves, thus causing a loop during decompression. On some platforms, this bug can be abused to cause crashes. On all platforms, this bug can be abused to cause...
CVE-2015-3353
Cross-site scripting XSS vulnerability in the Field Display Label module before 7.x-1.3 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via the alternate field label in content types settings...
Cross site scripting
Cross-site scripting XSS vulnerability in the Field Display Label module before 7.x-1.3 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via the alternate field label in content types settings...
CVE-2015-3353
CVE-2015-3353: XSS in Drupal Field Display Label module (7.x) prior to 7.x-1.3. Root cause: inadequate sanitization of the alternate field label in content types settings, allowing remote authenticated users to inject arbitrary script/HTML. Affected: Drupal 7.x-1.x before 7.x-1.3 (Field Display L...
CVE-2015-3353
Cross-site scripting XSS vulnerability in the Field Display Label module before 7.x-1.3 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via the alternate field label in content types settings...
Ember.js XSS Vulnerability With {{view "select"}} Options
In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, a change made to the implementation of the select view means that any user-supplied data bound to an option's label will not be escaped correctly. In applicatio...
IPv6 toolkit
A security assessment and troubleshooting tool for the IPv6 protocols The SI6 Networks’ IPv6 toolkit is a set of IPv6 security/trouble-shoting tools, that can send arbitrary IPv6-based packets. IPv6 toolkit: List of Tools addr6: An IPv6 address analysis and manipulation tool. flow6: A tool to...
util-linux: command injection
There is a command injection inside blkid. It uses caching files /dev/.blkid.tab or /run/blkid/blkid.tab to store info about the UUID, LABEL etc it finds on certain devices. However, it does not strip " character, so it can be confused to build variable names containing embedded shell metas, whic...
RHEL 7 : docker (RHSA-2015:0623)
Updated docker packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7 Extras. Red Hat Product Security has rated this update as having Low security impact. Common Vulnerability Scoring System CVSS base scores, which give...
USN-2471-1: GParted vulnerability
Wolfgang Ettlinger discovered that GParted incorrectly filtered shell metacharacters when running external commands. A local attacker could use this issue with a crafted filesystem label to run arbitrary commands as the administrator...
Drupal Field Display Label Module Cross-Site Scripting Vulnerability
Drupal is a free and open source content management system developed in PHP. A cross-site scripting vulnerability exists in the Drupal Field Display Label module because it fails to properly filter user-supplied input. An attacker may be able to exploit this vulnerability to execute arbitrary...
Scientific Linux Security Update : libvirt on SL7.x x86_64 (20150105)
It was found that when the VIRDOMAINXMLMIGRATABLE flag was used, the QEMU driver implementation of the virDomainGetXMLDesc function could bypass the restrictions of the VIRDOMAINXMLSECURE flag. A remote attacker able to establish a read-only connection to libvirtd could use this flaw to leak...
CentOS 7 : libvirt (CESA-2015:0008)
Updated libvirt packages that fix one security issue and three bugs are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
DNS Label Compression Recursion Denial of Service - Ver2 (CVE-2007-1030)
A denial-of-service vulnerability has been reported in Niels Provos Libevent. Successful exploitation of this vulnerability would allow a remote attacker to create a denial of service condition on the affected system...
DEBIAN-CVE-2014-7208
GParted before 0.15.0 allows local users to execute arbitrary commands with root privileges via shell metacharacters in a crafted filesystem label...
CVE-2014-7208
GParted before 0.15.0 allows local users to execute arbitrary commands with root privileges via shell metacharacters in a crafted filesystem label...
Command injection
GParted before 0.15.0 allows local users to execute arbitrary commands with root privileges via shell metacharacters in a crafted filesystem label...
CVE-2014-7208
GParted before 0.15.0 is affected by CVE-2014-7208. Local users can execute arbitrary commands with root privileges via shell metacharacters in a crafted filesystem label. The vulnerability is addressed in version 0.15.0 (and not in earlier releases). Affected component: GParted (partition editor...
