USN-2494-1 file vulnerabilities

Francisco Alonso discovered that file incorrectly handled certain ELF files. An attacker could use this issue to cause file to crash, resulting in a denial of service. CVE-2014-3710 Thomas Jarosch discovered that file incorrectly handled certain ELF files. An attacker could use this issue to caus...

apache24 -- multiple vulnerabilities

Jim Jagielski reports: CVE-2015-3183 cve.mitre.org core: Fix chunk header parsing defect. Remove aprbrigadeflatten, buffering and duplicated code from the HTTPIN filter, parse chunks in a single pass with zero copy. Limit accepted chunk-size to 2^63-1 and be strict about chunk-ext authorized...

U-Mail邮件系统注入2(SQL Injections in MySQL LIMIT clause,无需登录，附获取用户密码脚本)

简要描述： SQL Injections in MySQL LIMIT clause，过滤不严，产生盲注，导致可以注射用户名与密码，无需登录 详细说明： 上次搜索只在client搜索，今天无意在fast目录下搜索了下，又发现了一处。 注：client的目录下的所有函数必须登录才可以执行，fast的目录无需登录可以执行部分存在的函数，但并不能查看邮件等等。 漏洞与上一个原理一样，但文件不同，此处访问权限设置不严格，可以任意用户访问，导致可以无需登录即可sql注入，limit无法使用sleep，用benchamark延时 漏洞文件/fast/oab/module/operates.php代码...

U-Mail邮件系统注入(SQL Injections in MySQL LIMIT clause案例)

简要描述： SQL Injections in MySQL LIMIT clause，恰巧该邮件系统这处存在缺陷，刚好来个案例展示，通过注入可以获取管理员密码 详细说明： 漏洞产生的原因，sql语句中的limit由用户可控，其处理不当因而导致了sql注入的产生 漏洞文件/client/oab/module/operates.php 代码为 if ACTION == "member-get" $deptid = gss $GET'deptid' ; $deptid = intval $deptid ;//此处不传入该变量 $keyword = gss $GET'keyword' ; $pa...

Privoxy < 3.0.22 Multiple Vulnerabilities

According to its self-identified version number, the Privoxy installed on the remote host is a version prior to 3.0.22. It is, therefore, affected by multiple vulnerabilities: - A denial of service vulnerability exists due to a memory leak when client connections are rejected when the socket limi...

SA-CONTRIB-2015-030 - Amazon AWS - Access bypass

Amazon AWS module provides integration with Amazon Web Services AWS. A malicious user could potentially guess an access token and trigger the creation of new backups by making a request to a specially-crafted URL. If the number of stored backups was limited, an attacker could exceed the limit by...

PT-2023-25554 · Monetdb +1 · Monetdb Server +1

Name of the Vulnerable Software and Affected Versions: MonetDB Server versions 11.45.17 through 11.46.0 Description: The issue in the log create delta component allows attackers to cause Denial of Service DoS via crafted SQL statements. Recommendations: For MonetDB Server versions 11.45.17 throug...

CVE-2015-1030

Memory leak in the rfc2553connectto function in jbsocket.c in Privoxy before 3.0.22 allows remote attackers to cause a denial of service memory consumption via a large number of requests that are rejected because the socket limit is reached...

vBulletin vBSSO Single Sign-On 1.4.14 - SQL Injection

vBulletin vBSSO Single Sign-On 1.4.14 - SQL Injection Exploit Title: vBulletin vBSSO Single Sign-On – = 1.4.15 This plugin is vulnerable to SQL injection at the /vbsso/avatar.php file in the fetchUserinfo function. It requires a big UNION ALL SELECT query and commenting out the LIMIT function of...

Updated file packages fix security vulnerabilities

Updated file packages fix security vulnerabilities: Alexander Cherepanov reported that using the file command on a specially-crafted ELF binary could lead to a denial of service due to uncontrolled resource consumption while processing ELF section headers CVE-2014-9620, CVE-2014-9621. As part of...

Oracle Solaris Third-Party Patch Update : nova (multiple_vulnerabilities_in_nova)

The remote Solaris system is missing necessary patches to address security updates : - The VMWare driver in OpenStack Compute Nova 2013.2 through 2013.2.2 does not properly put VMs into RESCUE status, which allows remote authenticated users to bypass the quota limit and cause a denial of service...

OracleVM 3.2 : ntp (OVMSA-2015-0001)

The remote OracleVM system is missing necessary patches to address critical security updates : - Remove default ntp servers in ntp.conf bug 14342986 - don't generate weak control key for resolver CVE-2014-9293 - don't generate weak MD5 keys in ntp-keygen CVE-2014-9294 - fix buffer overflows via...

PHPB2B某处sql注入#5

简要描述： PHPB2B某处sql注入5 详细说明： 官网下载的最新版本 PHPB2B某处sql注入 virtual-office/favor.php 25-45行 ifisset$POST'do' && isset$POST'id' //check limit $typeid = 1; $flimit = $pdb-GetOne$sql = "SELECT countid FROM $tbprefixfavorites WHERE typeid='".$typeid."' AND memberid=".$thememberid; if...

McAfee ePolicy Orchestrator Authenticated XXE Credential Exposure Exploit

This Metasploit module will exploit an authenticated XXE vulnerability to read the keystore.properties off of the filesystem. This properties file contains an encrypted password that is set during installation. What is interesting about this password is that it is set as the same password as the...

OracleVM 2.2 : ntp (OVMSA-2015-0002)

The remote OracleVM system is missing necessary patches to address critical security updates : - don't generate weak control key for resolver CVE-2014-9293 - don't generate weak MD5 keys in ntp-keygen CVE-2014-9294 - fix buffer overflows via specially-crafted packets CVE-2014-9295 - increase...

SuSE 11.3 Security Update : bind (SAT Patch Number 10100)

bind has been updated to version 9.9.6P1, fixing the following security issue : - A flaw in delegation handling could be exploited to put named into an infinite loop. This has been addressed by placing limits on the number of levels of recursion named will allow default 7, and the number of...

Updated privoxy package fixes security vulnerabilities

Updated privoxy packages fix security issues: A memory leak occurred in privoxy 3.0.21 compiled with IPv6 support when rejecting client connections due to the socket limit being reached. CID 66382 A use-after-free bug was found in privoxy 3.0.21 and two additional potential use-after-free issues...

CVE-2014-9401

CVE-2014-9401 affects the WordPress plugin “WP Limit Posts Automatically” (versions

CVE-2014-9401: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the WP Limit Posts Automatically plugin 0.7 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the lpapostletters parameter in the...

OracleVM 3.3 : bind (OVMSA-2014-0084)

The remote OracleVM system is missing necessary patches to address critical security updates : - Fix CVE-2014-8500 1171973 - Use /dev/urandom when generating rndc.key file 951255 - Remove bogus file from /usr/share/doc, introduced by fix for bug 1092035 - Add support for TLSA resource records...