3734 matches found
CVE-2014-0136
CVE-2014-0136 affects Red Hat CloudForms 3.0 Management Engine (CFME) 5.x, where the AgentController’s get and log methods allow remote attackers to insert arbitrary text into log files. The root cause is unsanitized user input written to log files from the AgentController, enabling arbitrary con...
EMC NetWorker Module for MEDITECH information leakage
Cleartext passwords in the log files...
Information disclosure
The EMC NetWorker Module for MEDITECH aka NMMEDI 3.0 build 87 through 90, when EMC RecoverPoint and Plink are used, stores cleartext RecoverPoint Appliance credentials in nsrmedisv.raw log files, which allows local users to obtain sensitive information by reading these files...
CVE-2014-4620
The EMC NetWorker Module for MEDITECH aka NMMEDI 3.0 build 87 through 90, when EMC RecoverPoint and Plink are used, stores cleartext RecoverPoint Appliance credentials in nsrmedisv.raw log files, which allows local users to obtain sensitive information by reading these files...
CVE-2014-5448
Zarafa 5.00 uses world-readable permissions for the files in the log directory, which allows local users to obtain sensitive information by reading the log files...
CVE-2014-5448
Zarafa 5.00 uses world-readable permissions for the files in the log directory, which allows local users to obtain sensitive information by reading the log files...
Joomla Re-Issues Security Update After Patches Glitch
Users of the Joomla content management system have been on a patching roller coaster the past 24 hours with one set of patches for critical vulnerabilities being pulled last night before being re-issued today. The Joomla update, bringing the CMS up to version 3.3.6, is a security update addressin...
[SECURITY] Fedora 20 Update: ksystemlog-4.14.1-1.fc20
This program is developed for beginner users, who don't know how to find information about their Linux system, and don't know where log files are. It is also of course designed for advanced users, who quickly want to under stand problems of their machine with a more powerful and graphical tool th...
Glype 1.4.9 - Cookie Injection Directory Traversal Local File Inclusion
Glype 1.4.9 - Cookie Injection Directory Traversal Local File Inclusion ------------------------------------------------------------------------ Glype proxy cookie jar path traversal allows code execution ------------------------------------------------------------------------ Securify, September...
EAP6: Plain text password logging during security audit
It was found that the security audit functionality logged request parameters in plain text. This may have caused passwords to be included in the audit log files when using BASIC or FORM-based authentication. A local attacker with access to audit log files could possibly use this flaw to obtain...
EAP6: Plain text password logging during security audit
It was found that the security audit functionality logged request parameters in plain text. This may have caused passwords to be included in the audit log files when using BASIC or FORM-based authentication. A local attacker with access to audit log files could possibly use this flaw to obtain...
PT-2014-6479
Name of the Vulnerable Software and Affected Versions Zarafa version 5.00 Description The issue allows local users to obtain sensitive information by reading the log files due to world-readable permissions for the files in the log directory. Recommendations For Zarafa version 5.00, consider...
Satellite: Spacewalk contains XSS in log file view
A stored cross-site scripting XSS flaw was found in the way spacewalk-java displayed log files. By sending a specially crafted request to Satellite, a remote attacker could embed HTML content into the log file, allowing them to inject malicious content into the web page that is used to view that...
Important: Red Hat Security Advisory: spacewalk-java security update
Updated spacewalk-java packages that fix one security issue are now available for Red Hat Satellite 5.4, 5.5, and 5.6. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating,...
WS-2014-0039
Ansible v1.4.0 to v1.7.2 are vulnerable to information disclosure of sensitive data in log files...
CVE-2014-5030
CUPS before 2.0 allows local users to read arbitrary files via a symlink attack on 1 index.html, 2 index.class, 3 index.pl, 4 index.php, 5 index.pyc, or 6 index.py...
Authentication flaw
Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777...
XMB Forum 1.6 Magic Lantern Log File Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/4722/info XMB Forum 1.6 Magic Lantern allows remote users to conduct activities in the forum while bypassing normal logging functions. This is accomplished by submitting an arbitrary string as the analized variable to...
visual tools dvr <= 3.0.6.16, vx series <= 4.2.19.2 - Multiple Vulnerabilities
No description provided by source. Exploit Title: Visual Tools DVR multiple vulnerabilities Date: 2012-10-15 Exploit Author: Andrea Fabrizi Vendor Homepage: http://www.visual-tools.com/ Version: VS Series = 3.0.6.16, VX Series = 4.2.19.2 Tested on: VS Series 3.0.6.16/VX Series 4.2.19.2 Visual Too...
Artmedic Newsletter 4.1 Log.PHP Remote Script Execution Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/18047/info Artmedic Newsletter is prone to a remote PHP code-execution vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this issue to creat...