PT-2013-3603 · No Company Name Mentioned In The Text · Suds

Name of the Vulnerable Software and Affected Versions: Suds version 0.4 Description: The issue in Suds allows local users to potentially redirect SOAP queries and have other unspecified impact via a symlink attack on a cache file with a predictable name in /tmp/suds/. This occurs when the tempdir...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2012-2003)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-2003 advisory. - fs xfs: Fix possible memory corruption in xfsreadlink Carlos Maiolino CVE-2011-4077 - crypto: ghash - Avoid null pointer dereference if no key is...

F-Secure E-mail and Server Security FSDBCom ActiveX Control GetCommand Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of F-Secure E-mail and Server Security. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...

WHMCS <= 4.5.2 SQLi Vulnerability

WHMCS is prone to an SQL injection SQLi vulnerability. Copyright C 2013 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you ca...

Cisco Clean Access Manager filter SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Cisco Clean Access Manager. Authentication is not required to exploit this vulnerability. The specific flaw is in the handling of filter URL parameters when constructing SQL database queries. By...

Cisco Clean Access Manager sortColumn SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Cisco Clean Access Manager. Authentication is not required to exploit this vulnerability. The specific flaw is in the handling of sortColumn URL parameters when constructing SQL database queries. B...

CVE-2013-0233

Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass...

DEBIAN-CVE-2013-0233

Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass...

Type confusion

Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass...

UBUNTU-CVE-2013-0233

Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass...

CVE-2013-0233

Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass...

Mandriva Linux Security Advisory : dnsmasq (MDVSA-2013:072)

Updated dnsmasq packages fix security vulnerabilities : When dnsmasq before 2.63 is used in conjunctions with certain configurations of libvirtd, network packets from prohibited networks e.g. packets that should not be passed in may be sent to the dnsmasq application and processed. This can resul...

Microsoft DNS Server Validation Spoofing (MS09-008) - High Confidence (CVE-2009-0234)

A weakness exists in Microsoft DNS server implementation. The problem is caused by improper handling of negative results for DNS ANY queries. Remote attackers could exploit this vulnerability by sending numerous ANY queries to the target server, followed by malicious responses to the same server...

Fedora Update for mongodb FEDORA-2013-4531

Check for the Version of mongodb OpenVAS Vulnerability Test Fedora Update for mongodb FEDORA-2013-4531 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

[SECURITY] Fedora 18 Update: mongodb-2.2.3-4.fc18

Mongo from "humongous" is a high-performance, open source, schema-free document-oriented database. MongoDB is written in C++ and offers the follow ing features: Collection oriented storage: easy storage of object/JSON-style data Dynamic queries Full index support, including on inner objects and...

rubygem-activerecord: attribute_dos Symbol DoS vulnerability

A flaw was found in the way Ruby on Rails handled hashes in certain queries. A remote attacker could use this flaw to perform a denial of service resource consumption attack by sending specially crafted queries that would result in the creation of Ruby symbols, which were never garbage collected...

WordPress Level Four Storefront Plugin SQL Injection Vulnerability

WordPress Level Four Storefront Plugin is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Cautious Optimism over Google DNSSEC Deployment

Google’s announcement that its Google Public DNS resolution service now supports DNSSEC is being applauded, but experts caution that despite Google’s high profile, this only puts a slight dent in a larger issue. “I think it’s great that Google is getting involved and supporting validation for...

CVE-2013-1854

The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols, which allows remote attackers to cause a denial of service via crafted input to a where method...

DEBIAN-CVE-2013-1854

The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols, which allows remote attackers to cause a denial of service via crafted input to a where method...