CVE-2010-2387

vicious-extensions/ve-misc.c in GNOME Display Manager gdm 2.20.x before 2.20.11, when GDM debug is enabled, logs the user password when it contains invalid UTF8 encoded characters, which might allow local users to gain privileges by reading the information from syslog logs...

CVE-2012-5638

The setuplogging function in log.h in SANLock uses world-writable permissions for /var/log/sanlock.log, which allows local users to overwrite the file content or bypass intended disk-quota restrictions via standard filesystem write operations...

Review : Hacking S3crets - beginners guide to practical hacking

Most of People are curious to become Hackers, but they do not know where to start, If you are in the same situation, then "Hacking S3crets" Book will guide you through the basic and advanced steps of Hacking and will help you develop The Hacker Attitude. Author Sai Satish, and Co-Author K...

Cross site scripting

Cross-site scripting XSS vulnerability in the Hashcash module 6.x-2.x before 6.x-2.6 and 7.x-2.x before 7.x-2.2 for Drupal, when "Log failed hashcash" is enabled, allows remote attackers to inject arbitrary web script or HTML via an invalid token, which is not properly handled when administrators...

CVE-2012-4469

Cross-site scripting XSS vulnerability in the Hashcash module 6.x-2.x before 6.x-2.6 and 7.x-2.x before 7.x-2.2 for Drupal, when "Log failed hashcash" is enabled, allows remote attackers to inject arbitrary web script or HTML via an invalid token, which is not properly handled when administrators...

CVE-2012-4469

The CVE-2012-4469 issue affects Drupal with the Hashcash contributed module (6.x-2.x and 7.x-2.x branches). The vulnerability is a cross-site scripting (XSS) flaw that occurs when the site’s Hashcash setting “Log failed hashcash” is enabled and an invalid token is processed, allowing an attacker ...

CVE-2012-4469

Cross-site scripting XSS vulnerability in the Hashcash module 6.x-2.x before 6.x-2.6 and 7.x-2.x before 7.x-2.2 for Drupal, when "Log failed hashcash" is enabled, allows remote attackers to inject arbitrary web script or HTML via an invalid token, which is not properly handled when administrators...

Fedora 17 : openstack-glance-2012.1.2-2.fc17 (2012-18085)

Fix Glance Authentication bypass for image deletion - Update to stable/essex 2012.1.2 including... - Support zero-size image creation via the v1 API - Allow admins to share images regardless of owner - Log sensitive store info, rather than exposing over API - Fix the qpidheartbeat option to avoid...

[Spooftooph 0.5.2] Automated spoofing or cloning Bluetooth device

Spooftooph is designed to automate spoofing or cloning Bluetooth device Name, Class, and Address. Cloning this information effectively allows Bluetooth device to hide in plain site. Bluetooth scanning software will only list one of the devices if more than one device in range shares the same devi...

HP Intelligent Management Center UAM Buffer Overflow

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'HP Intelligent Management Center UAM...

CyanogenMod Fixes Flaw That Logged Users Unlock Codes

CyanogenMod, a popular open source firmware replacement for Android phones, has patched a hole in its code that was locally logging swipe gestures used to unlock phones. The problem, which stemmed from a line of code that was never intended for release, was fixed in an update posted for download ...

LAN Messenger 1.2.28 Cross Site Scripting

Title: ====== LAN Messenger v1.2.28 - Persistent Software Vulnerability Date: ===== 2012-05-16 References: =========== http://www.vulnerability-lab.com/getcontent.php?id= VL-ID: ===== 541 Common Vulnerability Scoring System: ==================================== 7.5 Introduction: ============= LAN...

Mandrake Linux Security Advisory : mod_php3 (MDKSA-2000:062)

PHP version 3 which ships with Linux-Mandrake are vulnerable to format string attacks due to logging functions that make improper use of the syslog and vsnprintf functions. This renders PHP3-enabled servers vulnerable to compromise by remote attackers. This attack is only effective on PHP...

PT-2012-1885 · Wikkawiki · Wikkawiki

Name of the Vulnerable Software and Affected Versions: WikkaWiki versions 1.3.1 through 1.3.2 Description: The issue allows remote attackers to write arbitrary PHP code to the spamlog path file via the User-Agent HTTP header in an addcomment request when the spam logging option is enabled. The...

HP Intelligent Management Center UAM Buffer Overflow

This module exploits a remote buffer overflow in HP Intelligent Management Center UAM. The vulnerability exists in the uam.exe component, when using sprint in a insecure way for logging purposes. The vulnerability can be triggered by sending a malformed packet to the 1811/UDP port. The module has...

Patch 1 Release Notes for Veeam Backup & Replication 6.1.0.181

More Recent Version Available Please find the latest version of Veeam Backup & Replication here: Veeam Downloads - Latest Version Challenge These are the issues resolved by the Patch 1 for Veeam Backup version 6.1.0.181. All patches are cumulative so each below fix is contained in this patch. Cau...

Scientific Linux Security Update : vixie-cron on SL5.x i386/x86_64 (20120221)

The vixie-cron package contains the Vixie version of cron. Cron is a standard UNIX daemon that runs specified programs at scheduled times. The vixie-cron package adds improved security and more powerful configuration options to the standard version of cron. A race condition was found in the way t...

Scientific Linux Security Update : java (jdk 1.6.0) on SL4.x, SL5.x i386/x86_64

CVE-2009-2409 deprecate MD2 in SSL cert validation Kaminsky CVE-2009-3873 OpenJDK JPEG Image Writer quantization problem 6862968 CVE-2009-3875 OpenJDK MessageDigest.isEqual introduces timing attack vulnerabilities 6863503 CVE-2009-3876 OpenJDK ASN.1/DER input stream parser denial of service 68649...

Scientific Linux Security Update : nfs-utils on SL5.x i386/x86_64 (20120221)

The nfs-utils package provides a daemon for the kernel Network File System NFS server, and related tools such as the mount.nfs, umount.nfs, and showmount programs. It was found that the mount.nfs tool did not handle certain errors correctly when updating the mtab mounted file systems table file. ...

Scientific Linux Security Update : openssh on SL5.x

Problem description : A flaw was found in the way the ssh server wrote account names to the audit subsystem. An attacker could inject strings containing parts of audit messages, which could possibly mislead or confuse audit log parsing tools. CVE-2007-3102 A flaw was found in the way the OpenSSH...