openSUSE Security Update : viewvc (openSUSE-SU-2012:0831-1)

update to 1.1.15 bnc768680 : - security fix: complete authz support for remote SVN views CVE-2012-3356 - security fix: log msg leak in SVN revision view with unreadable copy source CVE-2012-3357 Additionally the following non-security issues have been addressed : - fix several instances of...

Kernel: net: information leak in recvmsg handler msg_name & msg_namelen logic

The mISDNsockrecvmsg function in drivers/isdn/mISDN/socket.c in the Linux kernel before 3.12.4 does not ensure that a certain length value is consistent with the size of an associated data structure, which allows local users to obtain sensitive information from kernel memory via a 1 recvfrom, 2...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Sophos Web Appliance before 3.7.8.2 allow remote attackers to inject arbitrary web script or HTML via the 1 xss parameter in an allow action to rss.php, 2 msg parameter to end-user/errdoc.php, 3 h parameter to end-user/ftpredirect.php, or 4...

PT-2014-3021

Name of the Vulnerable Software and Affected Versions Aker Secure Mail Gateway versions 2.5.2 and earlier Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the msg id parameter in the...

PT-2014-4022

Name of the Vulnerable Software and Affected Versions Telligent Evolution versions prior to 6.1.19.36103 Telligent Evolution versions 7.x prior to 7.1.12.36162 Telligent Evolution versions 7.5.x Telligent Evolution versions 7.6.x prior to 7.6.7.36651 Description A cross-site scripting XSS issue...

CVE-2014-1223: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in controlpanel/loading.aspx in Telligent Evolution before 6.1.19.36103, 7.x before 7.1.12.36162, 7.5.x, and 7.6.x before 7.6.7.36651 allows remote attackers to inject arbitrary web script or HTML via the msg parameter. NOTE: some of these details are obtain...

PT-2013-1217

Name of the Vulnerable Software and Affected Versions Quagga versions prior to 0.99.22.2 Quagga versions prior to 0.99.22.4 Description The issue is related to a stack-based buffer overflow in the new msg lsa change notify function within the OSPFD API. This can be exploited by remote attackers t...

PT-2013-4873

Name of the Vulnerable Software and Affected Versions YARD RADIUS version 1.1.2 Description The issue concerns multiple format string vulnerabilities that allow context-dependent attackers to cause a denial of service or possibly execute arbitrary code. This is achieved through format string...

PT-2013-4863

Name of the Vulnerable Software and Affected Versions SPICE versions prior to 0.12.4 Description The issue is related to the red channel pipes add type and red channel pipes add empty msg functions in server/red channel.c. These functions do not properly perform ring loops, which might allow remo...

Sql injection

Multiple SQL injection vulnerabilities in sign.php in tinyguestbook allow remote attackers to execute arbitrary SQL commands via the 1 name and 2 msg parameters. NOTE: some of these details are obtained from third party information...

CVE-2011-5199

Cross-site scripting XSS vulnerability in sign.php in tinyguestbook allows remote attackers to inject arbitrary web script or HTML via the msg parameter...

PT-2012-2178

Name of the Vulnerable Software and Affected Versions tinyguestbook affected versions not specified Description The issue concerns SQL injection vulnerabilities in the sign.php file of tinyguestbook. Remote attackers can execute arbitrary SQL commands by manipulating the name and msg parameters...

PT-2012-2176

Name of the Vulnerable Software and Affected Versions tinyguestbook affected versions not specified Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the msg parameter in the "sign.php" file...

CVE-2011-5201: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in sign.php in tinyguestbook allow remote attackers to execute arbitrary SQL commands via the 1 name and 2 msg parameters. NOTE: some of these details are obtained from third party information...

CVE-2011-5199: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in sign.php in tinyguestbook allows remote attackers to inject arbitrary web script or HTML via the msg parameter...

CVE-2012-1835

Multiple cross-site scripting XSS vulnerabilities in the All-in-One Event Calendar plugin 1.4 and 1.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 title parameter to app/view/agenda-widget-form.php; 2 args, 3 title, 4 beforetitle, or 5 aftertitle parameter...

Path traversal

The SVN revision view lib/vclib/svn/svnrepos.py in ViewVC before 1.1.15 does not properly handle log messages when a readable path is copied from an unreadable path, which allows remote attackers to obtain sensitive information, related to a "log msg leak."...

CVE-2012-3357

The SVN revision view lib/vclib/svn/svnrepos.py in ViewVC before 1.1.15 does not properly handle log messages when a readable path is copied from an unreadable path, which allows remote attackers to obtain sensitive information, related to a "log msg leak."...

CVE-2012-3357

The SVN revision view lib/vclib/svn/svnrepos.py in ViewVC before 1.1.15 does not properly handle log messages when a readable path is copied from an unreadable path, which allows remote attackers to obtain sensitive information, related to a "log msg leak."...

CVE-2012-3357

CVE-2012-3357 affects ViewVC prior to 1.1.15. The Subversion revision view mishandles log messages when a readable path is copied from an unreadable path, enabling remote disclosure of sensitive information. The issue arises in lib/vclib/svn/svn_repos.py due to improper handling of log messages a...