Fedora 21 : freeipa-4.1.4-1.fc21 / slapi-nis-0.54.2-1.fc21 (2015-4747)

CVE-2015-1827: It was discovered that the IPA extdom Directory Server plug-in did not correctly perform memory reallocation when handling user account information. A request for a list of groups for a user that belongs to a large number of groups would cause a Directory Server to crash...

CVE-2015-0283

The slapi-nis plug-in before 0.54.2 does not properly reallocate memory when processing user accounts, which allows remote attackers to cause a denial of service infinite loop and CPU consumption via a request for a 1 group with a large number of members or 2 user that belongs to a large number o...

CVE-2015-0283

The slapi-nis plug-in before 0.54.2 does not properly reallocate memory when processing user accounts, which allows remote attackers to cause a denial of service infinite loop and CPU consumption via a request for a 1 group with a large number of members or 2 user that belongs to a large number o...

CVE-2015-1827

CVE-2015-1827 affects FreeIPA’s extdom plugin get_user_grouplist, where a memory reallocation error when processing users with many groups can crash the server. The issue is a memory corruption/DoS in get_user_grouplist() reported for FreeIPA builds before 4.1.4 (e.g., RHEL-7.2). A fix is availab...

CVE-2015-0283

The slapi-nis plug-in before 0.54.2 does not properly reallocate memory when processing user accounts, which allows remote attackers to cause a denial of service infinite loop and CPU consumption via a request for a 1 group with a large number of members or 2 user that belongs to a large number o...

Scientific Linux Security Update : ipa and slapi-nis on SL7.x x86_64 (20150326)

The ipa component provides centrally managed Identity, Policy, and Audit. The slapi-nis component provides NIS Server and Schema Compatibility plug- ins for Directory Server. It was discovered that the IPA extdom Directory Server plug-in did not correctly perform memory reallocation when handling...

PT-2015-4561 · 389 Directory Server +2 · Slapi-Nis Plug-In +2

Name of the Vulnerable Software and Affected Versions: slapi-nis plug-in versions prior to 0.54.2 Description: The issue allows remote attackers to cause a denial of service, resulting in an infinite loop and CPU consumption. This can be achieved by requesting a group with a large number of membe...

Debian DLA-40-1 : cacti security update

Multiple security issues cross-site scripting, missing input sanitizing and SQL injection have been discovered in Cacti, a web interface for graphing of monitoring systems. Furthermore, the fix for CVE-2014-4002 in the previous security update has been brought in-line with the upstream fix as it...

Scientific Linux Security Update : 389-ds-base on SL7.x x86_64 (20150305)

An information disclosure flaw was found in the way the 389 Directory Server stored information in the Changelog that is exposed via the 'cn=changelog' LDAP sub-tree. An unauthenticated user could in certain cases use this flaw to read data from the Changelog, which could include sensitive...

Google Analytics by Yoast stored XSS

OVERVIEW ========== Google Analytics by Yoast is a WordPress plug-in for monitoring website traffic. With approximately seven million downloads it’s one of the most popular WordPress plug-ins. A security vulnerability in the plug-in allows an unauthenticated attacker to store arbitrary HTML,...

Yoast Google Analytics Stored Cross Site Scripting

OVERVIEW ========== Google Analytics by Yoast is a WordPress plug-in for monitoring website traffic. With approximately seven million downloads it’s one of the most popular WordPress plug-ins. A security vulnerability in the plug-in allows an unauthenticated attacker to store arbitrary HTML,...

Taming the wild copy: Parallel Thread Corruption

Posted by Chris Evans, Winner of the occasional race Back in 2002, a very interesting vulnerability was found and fixed in the Apache web server. Relating to a bug in chunked encoding handing, the vulnerability caused a memcpy call with a negative length with the destination on the stack. Of...

389 security update

CentOS Errata and Security Advisory CESA-2015:0416 Updated 389-ds-base packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. Common...

RedHat Update for 389-ds-base RHSA-2015:0416-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Moderate: Red Hat Security Advisory: ipa security, bug fix, and enhancement update

Updated ipa packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give...

RHEL 7 : krb5 (RHSA-2015:0439)

Updated krb5 packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give...

WordPress Newsletter 2.6.x / 2.5.x Open Redirect

WordPress Newsletter Plug-in URL Redirection Open Redirect Security Vulnerabilities Exploit Title: WordPress Newsletter Plug-in /do.php &nr parameter URL Redirection Security Vulnerabilities Product: WordPress Newsletter Plug-in Vendor: Satollo.net Vulnerable Versions: 2.6. 2.5. Tested Version:...

I-O DATA DEVICE NP-BBRM Denial of Service Vulnerability

The I-O DATA DEVICE NP-BBRM is a router product from I-O DATA DEVICE Japan. A security vulnerability exists in the I-O DATA DEVICE NP-BBRM router. A remote attacker can exploit this vulnerability by sending UPnP requests to cause a denial of service SSDP reflection...

RHEL 5 / 6 : flash-plugin (RHSA-2015:0094)

An updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System CVSS base scores, which give detail...

NP-BBRM vulnerable in UPnP functionality

Overview NP-BBRM provided by I-O DATA DEVICE, INC. is a LAN router. NP-BBRM contains a vulnerability in the UPnP functionality. Impact The device may be used in a DDoS attack, as a SSDP reflector. Solution Disable UPnP Disable UPnP functionality from the management configuration in the settings...