SearchBlox 8.2 Cross Site Scripting

Advisory ID: HTB23256 Product: SearchBlox Vendor: SearchBlox Software, Inc. Vulnerable Versions: 8.2 and probably prior Tested Version: 8.2 Advisory Publication: April 22, 2015 without technical details Vendor Notification: April 22, 2015 Vendor Patch: May 26, 2015 Public Disclosure: June 17, 201...

Elasticsearch vulnerability CVE-2015-4165

Summary: Elasticsearch versions 1.0.0 - 1.5.2 are vulnerable to an engineered attack on other applications on the system. The snapshot API may be used indirectly to place snapshot metadata files into locations that are writeable by the user running the Elasticsearch process. It is possible to...

Fedora 21 : dovecot-2.2.16-2.fc21 (2015-7089)

fixes CVE-2015-3420: SSL/TLS handshake failures leading to a crash of the login process - dovecot updated to 2.2.16 - auth: Don't crash if master user login is attempted without any configured master=yes passdbs - Parsing UTF-8 text for mails could have caused broken results sometimes if bufferin...

Fedora 22 : dovecot-2.2.16-2.fc22 (2015-7156)

fixes CVE-2015-3420: SSL/TLS handshake failures leading to a crash of the login process - dovecot updated to 2.2.16 - auth: Don't crash if master user login is attempted without any configured master=yes passdbs - Parsing UTF-8 text for mails could have caused broken results sometimes if bufferin...

Vulnerabilities of the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality and accessibility of protected information

The multiple vulnerabilities in the lucene-solr package of the Debian GNU/Linux operating system may lead to breaches of the confidentiality and accessibility of protected information. These vulnerabilities can be exploited remotely...

Amazon Linux AMI : php-ZendFramework (ALAS-2014-460)

The 1 ZendLdap class in Zend before 1.12.9 and 2 Zend\Ldap component in Zend 2.x before 2.2.8 and 2.3.x before 2.3.3 allows remote attackers to bypass authentication via a password starting with a null byte, which triggers an unauthenticated bind. CVE-2014-8088 The 1.12.9, 2.2.8, and 2.3.3 releas...

Debian DSA-2963-1 : lucene-solr - security update

Multiple vulnerabilities were found in Solr, an open source enterprise search server based on Lucene, resulting in information disclosure or code execution. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...

Fedora 19 : dovecot-2.2.13-1.fc19 (2014-6331)

Fixed a DoS attack against imap/pop3-login processes. If SSL/TLS handshake was started but wasn't finished, the login process attempted to eventually forcibly disconnect the client, but failed to do it correctly. This could have left the connections hanging arond for a long time. Affected Dovecot...

[SECURITY] [DSA 2963-1] lucene-solr security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2963-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff June 17, 2014 http://www.debian.org/security/faq -...

Debian Security Advisory DSA 2963-1 (lucene-solr - security update)

Multiple vulnerabilities were found in Solr, an open source enterprise search server based on Lucene, resulting in information disclosure or code execution. OpenVAS Vulnerability Test $Id: deb2963.nasl 6637 2017-07-10 09:58:13Z teissa $ Auto-generated from advisory DSA 2963-1 using nvtgen 1.0...

DSA-2963-1 lucene-solr - security update

Bulletin has no description...

Debian: Security Advisory (DSA-2963-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 20 : dovecot-2.2.13-1.fc20 (2014-6338)

Fixed a DoS attack against imap/pop3-login processes. If SSL/TLS handshake was started but wasn't finished, the login process attempted to eventually forcibly disconnect the client, but failed to do it correctly. This could have left the connections hanging arond for a long time. Affected Dovecot...

CVE-2014-2921

The getObjectByToken function in Newsletter.php in the PimcoreToolNewsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing Lucene search data, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via...

Design/Logic Flaw

The getObjectByToken function in Newsletter.php in the PimcoreToolNewsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing Lucene search data, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via...

CVE-2014-2921

The getObjectByToken function in Newsletter.php in the PimcoreToolNewsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing Lucene search data, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via...

JVN#14876762: Apache Commons FileUpload vulnerable to denial-of-service (DoS)

Apache Commons FileUpload provided by Apache Software Foundation contains an issue in processing a multi-part request, which may cause the process to be in an infinite loop. As of 2014 February 12, an exploit tool to attack against this vulnerability has been confirmed. Impact Processing a...

Can force a Java heap space OOME when passing a high startIndex value in the URL

h4. Steps to reproduce Start Confluence 5.2.3 Navigating to the following URL: http:///dosearchsite.action?queryString=1&startIndex=268435455 or some other high startIndex value The browser will spin, and logs will eventually display an out-of-memory error code 2013-09-18 17:13:19,808 ERROR...

OpenKM Document Management System 5.1.7 Privilege Escalation

COMPASS SECURITY ADVISORY http://www.csnc.ch/ ID: COMPASS-2012-001 Product: OpenKM Document Management System 5.1.7 1 Vendor: OpenKM http://www.openkm.com/ Subject: Privilege Escalation, Improper Access Control Risk: High Effect: Remotely exploitable Author: Cyrill Brunschwiler...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the search feature in Polymita BPM-Suite and CollagePortal allow remote attackers to inject arbitrary web script or HTML via the 1 q and 2 luceneindexfieldvalue parameters. NOTE: the provenance of this information is unknown; the details are...