CVE-2016-1908

The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues ...

CVE-2016-2058

Multiple cross-site scripting XSS vulnerabilities in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow 1 remote Xymon clients to inject arbitrary web script or HTML via a status-message, which is not properly handled in the "detailed status" page, or 2 remote authenticated users to inject arbitra...

DEBIAN-CVE-2016-2058

Multiple cross-site scripting XSS vulnerabilities in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow 1 remote Xymon clients to inject arbitrary web script or HTML via a status-message, which is not properly handled in the "detailed status" page, or 2 remote authenticated users to inject arbitra...

CVE-2016-2058

Multiple cross-site scripting XSS vulnerabilities in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow 1 remote Xymon clients to inject arbitrary web script or HTML via a status-message, which is not properly handled in the "detailed status" page, or 2 remote authenticated users to inject arbitra...

CVE-2016-2058

CVE-2016-2058 affects Xymon (formerly Hobbit) 4.1.x–4.3.x before 4.3.25. The vulnerability is twofold: (1) remote Xymon clients can inject arbitrary script/HTML via a status-message on the detailed status page, and (2) remote authenticated users can inject script/HTML via an acknowledgement messa...

CVE-2016-2058

Multiple cross-site scripting XSS vulnerabilities in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow 1 remote Xymon clients to inject arbitrary web script or HTML via a status-message, which is not properly handled in the "detailed status" page, or 2 remote authenticated users to inject arbitra...

CVE-2016-1908

The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues ...

[SECURITY] [DSA 3327-1] squid3 security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3327-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 03, 2015 https://www.debian.org/security/faq -...

DLA-286-1 squid3 - security update

Bulletin has no description...

GuppY 2.4 HTML Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/8717/info It has been reported that one of the scripts included with GuppY is vulnerable to an HTML injection attack. The script, postguest.php, does not perform input validation to prevent the inclusion of HTML/script...

Cobalt RaQ 2.0/3.0/4.0 XTR MultiFileUpload.php Authentication Bypass Vulnerability (1)

No description provided by source. source: http://www.securityfocus.com/bid/4252/info Cobalt RaQ is a server appliance for Internet-based services. It is distributed and maintained by Sun Microsystems. The 'MultiFileUpload.php' script is not sufficiently protected from outside access. While other...

FreeBSD 'nfsserver' Module 访问绕过漏洞(CVE-2013-4851)

Bugtraq ID:61484 CVE ID:CVE-2013-4851 FreeBSD是一款基于BSD的操作系统 FreeBSD存在安全漏洞，允许恶意用户绕过部分安全限制 问题是由于内核不正确使用客户端提供的验证凭据，可允许远程客户端绕过安全限制，获得对受限资源的未授权访问 0 FreeBSD 9.x 厂商解决方案 用户可参考如下厂商提供的安全公告获得补丁信息： http://security.freebsd.org/advisories/FreeBSD-SA-13:08.nfsserver.asc...

CVE-2012-3376

DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName, which might allow remote clients to read arbitrary blocks, write to blocks to which they only have read access, and...

Design/Logic Flaw

DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName, which might allow remote clients to read arbitrary blocks, write to blocks to which they only have read access, and...

CVE-2012-3376

CVE-2012-3376 affects Hadoop 2.0.0-alpha where DataNodes do not check BlockTokens for clients when Kerberos is enabled and a DataNode has registered multiple times for the same BlockPool. This can allow remote clients to read arbitrary blocks or write to blocks they only have read access to, amon...

Researcher Releases New Version of P0f Fingerprinting Tool

Security researcher Michal Zalewski has released a new version of a passive fingerprinting tool called P0f that has the ability to diagnose a wide range of components in an Internet connection, even uncovering clients that are trying to forge some part of their identity in the connection. P0f is ...

Disk-Pulse-Server

A vulnerability exists in the way Disk Pulse Server v2.2.34 process a remote clients "GetServerInfo" request. The vulnerability is caused due to a boundary error in libpal.dll when handling network messages and can be exploited to cause a stack-based buffer overflow via a specially crafted packet...

Disk Pulse Server Stack Remote Buffer Overflow Vulnerability

Disk Pulse Server is prone to remote stack buffer overflow vulnerability. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

TikiWiki jhot.php Script File Upload Security Bypass (CVE-2006-4602)

TikiWiki, also known as Tiki CMS/Groupware or simply Tiki, is a powerful wiki-based Content Management System CMS which allows users and/or groups of users to manage their data on-line via a web browser. TikiWiki provides numerous features, including Wiki-based Documentation, Groupware, Blogging...

Test HTTP dangerous methods

Misconfigured web servers allows remote clients to perform dangerous HTTP methods such as PUT and DELETE. SPDX-FileCopyrightText: 2000 Michel Arboi Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...