Sql injection

SQL injection vulnerability in the checkuserpassword function in main/auth/profile.php in Chamilo LMS 1.9.6 and earlier, when using the non-encrypted passwords mode set at installation, allows remote authenticated users to execute arbitrary SQL commands via the "password0" parameter...

OpenJDK: insufficient escaping of window title string (Javadoc, 8016675)

Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and JavaFX 2.2.40 and earlier allows remote authenticated users to affect integrity via unknown vectors related to Javadoc...

kernel: dm: dm-snapshot data leak

Interpretation conflict in drivers/md/dm-snap-persistent.c in the Linux kernel through 3.11.6 allows remote authenticated users to obtain sensitive information or modify data via a crafted mapping to a snapshot block device...

Ubuntu 12.04 LTS : linux-lts-saucy vulnerabilities (USN-2042-1)

A flaw was discovered in the Linux kernel's dm snapshot facility. A remote authenticated user could exploit this flaw to obtain sensitive information or modify/corrupt data. CVE-2013-4299 Hannes Frederic Sowa discovered a flaw in the Linux kernel's UDP Fragmenttation Offload UFO. An unprivileged...

CVE-2012-6150

The winbindnamelisttosidstringlist function in nsswitch/pamwinbind.c in Samba through 4.1.2 handles invalid requiremembershipof group names by accepting authentication by any user, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by...

CVE-2013-4524

Directory traversal vulnerability in repository/filesystem/lib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 allows remote authenticated users to read arbitrary files via a .. dot dot in a path...

CVE-2013-4485

389 Directory Server 1.2.11.15 aka Red Hat Directory Server before 8.2.11-14 allows remote authenticated users to cause a denial of service crash via multiple @ characters in a GER attribute list in a search request...

CVE-2013-4485

389 Directory Server 1.2.11.15 aka Red Hat Directory Server before 8.2.11-14 allows remote authenticated users to cause a denial of service crash via multiple @ characters in a GER attribute list in a search request...

Code injection

Cisco IOS XE 3.8S.2 and earlier does not properly use a DHCP pool during assignment of an IP address, which allows remote authenticated users to cause a denial of service device reload via an AAA packet that triggers an address requirement, aka Bug ID CSCuh04949...

PT-2013-1033 · Oracle +5 · Mysql Server +5

Name of the Vulnerable Software and Affected Versions: Oracle MySQL versions 5.1.71 and earlier Oracle MySQL versions 5.5.33 and earlier Oracle MySQL versions 5.6.13 and earlier Description: The issue is related to the MySQL Server component in Oracle MySQL, specifically the Optimizer subcomponen...

CVE-2013-5730

Multiple cross-site request forgery CSRF vulnerabilities in D-Link DSL-2740B Gateway with firmware EU1.00 allow remote attackers to hijack the authentication of administrators for requests that 1 enable or disable Wireless MAC Address Filters via a wlFltMode action to wlmacflt.cmd, 2 enable or...

CVE-2013-4843

Unspecified vulnerability in HP Integrated Lights-Out 4 iLO4 with firmware before 1.32 allows remote authenticated users to obtain sensitive information via unknown vectors...

Directory traversal

Directory traversal vulnerability in the license-upload interface in the Enterprise License Manager ELM component in Cisco Unified Communications Manager 9.11 and earlier allows remote authenticated users to create arbitrary files via a crafted path, aka Bug ID CSCui58222...

CVE-2013-5418

Cross-site scripting XSS vulnerability in the Administrative console in IBM WebSphere Application Server WAS 7.0 before 7.0.0.31, 8.0 before 8.0.0.8, and 8.5 before 8.5.5.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2013-3406

The CVE-2013-3406 issue affects Cisco Services Portal’s Cisco Intelligent Automation for Cloud component (9.4(1)). The vulnerability, tracked as Bug CSCug65687, allows remote authenticated users to read arbitrary files via crafted requests due to insufficient server-side input validation in the "...

CVE-2013-3406

The "Files Available for Download" implementation in the Cisco Intelligent Automation for Cloud component in Cisco Services Portal 9.41 allows remote authenticated users to read arbitrary files via a crafted request, aka Bug ID CSCug65687...

CVE-2013-4843

HP Integrated Lights-Out 4 (iLO4) vulnerability CVE-2013-4843 affects firmware before 1.32. Remote authenticated users may disclose sensitive information via unknown vectors over the network; impact is information disclosure with no confidentiality/integrity changes stated. HP's security bulletin...

Code injection

The Enterprise Meeting Server in IBM Lotus Sametime 8.5.2 and 8.5.2.1 allows remote authenticated users to spoof the origin of chat messages, or compose anonymous chat messages, by leveraging meeting-attendance privileges...

CVE-2013-3045

IBM Lotus Sametime Enterprise Meeting Server versions 8.5.2 and 8.5.2.1 are described as vulnerable to remote-authenticated users who can share crafted links via the Library function. The available documents identify the affected product and feature but do not disclose the underlying root cause d...

CVE-2013-4050

IBM Domino Web Administrator (webadmin.nsf) on Domino 8.5.x and 9.0.x is affected by a Cross-Site Request Forgery (CSRF) vulnerability that allows a remote authenticated user to hijack the authentication of unspecified victims via unknown vectors. The initial sources do not provide a concrete exp...