Scientific Linux Security Update : postgresql and postgresql84 on SL5.x, SL6.x i386/x86_64 (20120913)

It was found that the optional PostgreSQL xml2 contrib module allowed local files and remote URLs to be read and written to with the privileges of the database server when parsing Extensible Stylesheet Language Transformations XSLT. An unprivileged database user could use this flaw to read and...

CVE-2012-4908

Google Chrome before 18.0.1025308 on Android allows remote attackers to bypass the Same Origin Policy and obtain access to local files via vectors involving a symlink...

Google Updates Chrome for Android, Fixes Several Vulnerabilities

Google has issued a security update for its Chrome operating system on Android devices, resolving seven medium-risk vulnerabilities and paying out a total of $3,500 in rewards to two researchers. On the Google Chrome Blog, software engineer Jay Civelli wrote that the update strengthens Chrome for...

Directory traversal

Directory traversal vulnerability in Open-Realty CMS 2.5.8 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the selectuserstemplate parameter to index.php...

CVE-2012-1112

Directory traversal vulnerability in Open-Realty CMS 2.5.8 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the selectuserstemplate parameter to index.php...

Directory traversal

Directory traversal vulnerability in exportcsv/exportcsvindex.php in Open Business Management OBM 2.4.0-rc13 and earlier allows remote authenticated users to include and execute arbitrary local files via a .. dot dot in the module parameter in an exportpage action...

WordPress Cloudsafe365 Plugin 'file' Parameter Remote File Disclosure Vulnerability

The Cloudsafe365 plugin for WordPress is prone to a file- disclosure vulnerability because it fails to properly sanitize user- supplied input. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

python-paste-script: Supplementary groups not dropped when started an application with "paster serve" as root

Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attackers to bypass intended file-access restrictions by leveraging a web application that uses the local filesystem...

Directory traversal

Directory traversal vulnerability in update/index.php in PluXml before 5.1.6 allows remote attackers to include and execute arbitrary local files via a ..%2F encoded dot dot slash in the defaultlang parameter...

CVE-2012-2208

Directory traversal vulnerability in upgrade.php in Piwigo before 2.3.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the language parameter...

Directory traversal

Directory traversal vulnerability in upgrade.php in Piwigo before 2.3.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the language parameter...

CVE-2012-2208

CVE-2012-2208 : Affected software is Piwigo up to version 2.3.3 (pre-2.3.4). Root cause is a directory traversal via the language parameter in upgrade.php, allowing remote attackers to include and execute arbitrary local PHP files. Impact: potential code execution through include() of crafted fil...

CVE-2012-4253

Multiple directory traversal vulnerabilities in MySQLDumper 1.24.4 allow remote attackers to read arbitrary files via a .. dot dot in the 1 language parameter to learn/cubemail/install.php or 2 f parameter learn/cubemail/filemanagement.php, or execute arbitrary local files via a .. dot dot in the...

Debian Security Advisory DSA 2505-1 (zendframework)

The remote host is missing an update to zendframework announced via advisory DSA 2505-1. OpenVAS Vulnerability Test $Id: deb25051.nasl 6612 2017-07-07 12:08:03Z cfischer $ Description: Auto-generated from advisory DSA 2505-1 zendframework Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft...

Mandriva Update for libreoffice MDVSA-2012:063 (libreoffice)

Check for the Version of libreoffice OpenVAS Vulnerability Test Mandriva Update for libreoffice MDVSA-2012:063 libreoffice Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or...

Scientific Linux Security Update : tomcat on SL5.x i386/x86_64

A cross-site scripting vulnerability was discovered in the HttpServletResponse.sendError method. A remote attacker could inject arbitrary web script or HTML via forged HTTP headers. CVE-2008-1232 An additional cross-site scripting vulnerability was discovered in the host manager application. A...

Scientific Linux Security Update : seamonkey on SL3.x, SL4.x i386/x86_64

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey. CVE-2009-1392, CVE-2009-1833, CVE-2009-1838, CVE-2009-1841 A flaw was found in the...

DSA-2505-1 zendframework - information disclosure

Bulletin has no description...

GLSA-201204-06 : PolicyKit: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201204-06 PolicyKit: Multiple vulnerabilities Multiple vulnerabilities have been found in PolicyKit: Error messages in the pkexec utility disclose the existence of local files CVE-2010-0750. The pkexec utility initially checks the...

Atlassian FishEye 2.5.8 / 2.6.8 / 2.7.12 XML Parsing Vulnerability

According to its self-reported version, the version of Atlassian FishEye running on the remote host is potentially affected by an XML parsing vulnerability. This vulnerability may allow an unauthenticated, remote attacker to perform a denial of service attack against FishEye. This vulnerability m...