709 matches found
CVE-2015-1126
WebKit, as used in Apple iOS before 8.3 and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, does not properly handle the userinfo field in FTP URLs, which allows remote attackers to trigger incorrect resource access via unspecified vectors...
CVE-2015-1126
CVE-2015-1126 affects WebKit components used in Apple iOS prior to 8.3 and Apple Safari prior to 6.2.5, 7.x prior to 7.1.5, and 8.x prior to 8.0.5. The vulnerability arises from improper handling of the userinfo field in FTP URLs, enabling remote attackers to trigger incorrect resource access via...
Important: Red Hat Security Advisory: redhat-access-plugin-openstack security update
An updated redhat-access-plugin-openstack package that fixes one security issue is now available for Red Hat Enterprise Linux OpenStack Platform 6.0. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which...
Authentication flaw
Cisco Adaptive Security Appliance ASA Software 9.2.3 and earlier, when challenge-response authentication is used, does not properly select tunnel groups, which allows remote authenticated users to bypass intended resource-access restrictions via a crafted tunnel-group parameter, aka Bug ID...
CVE-2014-8023
Cisco Adaptive Security Appliance ASA Software 9.2.3 and earlier, when challenge-response authentication is used, does not properly select tunnel groups, which allows remote authenticated users to bypass intended resource-access restrictions via a crafted tunnel-group parameter, aka Bug ID...
Information disclosure
IBM WebSphere Application Server WAS 7.0.x before 7.0.0.35, 8.0.x before 8.0.0.10, and 8.5.x before 8.5.5.3 does not properly restrict resource access, which allows remote attackers to obtain sensitive information via unspecified vectors...
CVE-2014-3083
IBM WebSphere Application Server WAS 7.0.x before 7.0.0.35, 8.0.x before 8.0.0.10, and 8.5.x before 8.5.5.3 does not properly restrict resource access, which allows remote attackers to obtain sensitive information via unspecified vectors...
Design/Logic Flaw
EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote authenticated users to bypass intended restrictions on resource access via unspecified vectors...
CVE-2012-2672
Oracle Mojarra 2.1.7 does not properly "clean up" the FacesContext reference during startup, which allows local users to obtain context information an access resources from another WAR file by calling the FacesContext.getCurrentInstance function...
CVE-2011-1683
IBM WebSphere Application Server WAS 6.0.x through 6.0.2.43, 6.1.x before 6.1.0.37, and 7.0.x before 7.0.0.17 on z/OS, when a Local OS user registry or Federated Repository with RACF adapter is used, allows remote attackers to obtain unspecified application access via unknown vectors...
Mozilla SeaMonkey < 2.0.14 Multiple Vulnerabilities
Binary data 801324.prm...
CVE-2011-0322
Unspecified vulnerability in EMC RSA Access Manager Server 5.5.x, 6.0.x, and 6.1.x allows remote attackers to access resources via unknown vectors...
Mandriva Update for apache-mod_auth_shadow MDVSA-2010:081 (apache-mod_auth_shadow)
Check for the Version of apache-modauthshadow OpenVAS Vulnerability Test Mandriva Update for apache-modauthshadow MDVSA-2010:081 apache-modauthshadow Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you ca...
CVE-2007-6384
Unspecified vulnerability in the Image Converter functionality in BEA WebLogic Mobility Server 3.3, 3.5, and 3.6 through 3.6 SP1 allows remote attackers to obtain application file and resource access via unspecified vectors...
Design/Logic Flaw
Unspecified vulnerability in the Image Converter functionality in BEA WebLogic Mobility Server 3.3, 3.5, and 3.6 through 3.6 SP1 allows remote attackers to obtain application file and resource access via unspecified vectors...
CVE-2007-6384
Unspecified vulnerability in the Image Converter functionality in BEA WebLogic Mobility Server 3.3, 3.5, and 3.6 through 3.6 SP1 allows remote attackers to obtain application file and resource access via unspecified vectors...
PHP Hash_Update_File释放资源访问代码执行漏洞
PHP是一款广泛使用的WEB开发脚本语言。 PHP hashupdatefile存在设计错误，远程攻击者可能利用此漏洞获得对释放内存的访问并使用恶意数据覆盖而执行任意代码。 问题存在于GD函数中，在通过资源识别器获得资源数据后，可能用usercode来中断PHP函数，usercode就会会破坏资源，并获取与其内存相同位置来分配PHP字符串相同大小的空间作为释放资源。这个字符串可以用于建立特定构建的资源，以允许利用内部PHP函数，当恶意中断终止函数时，会继续使用替代资源数据。导致任意代码执行。 要获得需要的函数中断，通常需要放置对象到函数的某个参数中，这会在转化一个超长值时触发PHP错误。...
MOPB-28-2007:PHP hash_update_file() Already Freed Resource Access Vulnerability
Summary When the hashupdatefile function is called it first retrieves the resource data for further processing. It then reads data from the stream for hashing purposes. A malicious userspace stream hanfler can destroy the hash resource and replace it with a specially prepared fake resource that...
WebEOC privileges are based on client-side authorization
Overview WebEOC ties privileges and roles to client-side resources. If an attacker can access a resource directly, that attacker will be granted all the privileges associated with that resource. Description WebEOC is a web-based crisis information management application that provides functions to...
Microsoft Internet Explorer 6 - Local Resource Reference
Microsoft Internet Explorer 6 - Local Resource Reference source: https://www.securityfocus.com/bid/8886/info Microsoft Internet Explorer is prone to an issue that may allow for unauthorized access to local resources. Internet Explorer version 6 SP1 imposed restrictions to limit remote sites from...