Microsoft Windows Media Player 11 ScriptCommand Multiple Information Disclosure Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/35335/info Microsoft Windows Media Player is prone to multiple information-disclosure vulnerabilities because it fails to properly restrict access to certain functionality when handling media files. An attacker can exploi...

Risks of Exposing the Intelligent Platform Management Interface (IPMI)

Multiple weaknesses exist in several server platforms employing IPMI. Exploitation of these vulnerabilities could allow an attacker to take control of the affected system or expose sensitive server information. Server administrators are encouraged to review US-CERT Alert TA13-207A and restrict IP...

Symantec Web Gateway contains SQL injection and cross-site scripting vulnerabilities

Overview Symantec Web Gateway 5.1.1.24, and possibly earlier versions, contains cross-site scripting and SQL injection vulnerabilities. Description CVE-2014-1652 -CWE-79: Improper Neutralization of Input During Web Page Generation Symantec Web Gateway 5.1.1.24, and possibly earlier versions,...

Cisco AsyncOS contains a reflected cross-site scripting (XSS) vulnerability

Overview Cisco AsyncOS contains a reflected cross-site scripting XSS vulnerability. Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' - CVE-2014-3289 Cisco AsyncOS, the underlying OS for the Cisco Email Security Appliance, Web Security Applianc...

Bizagi BPM Suite contains multiple vulnerabilities

Overview Bizagi BPM Suite contains a reflected cross-site scripting vulnerability and a SQL injection vulnerability. Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' - CVE-2014-2947According to Open-Sec consultant Mauricio Urizar, all versions...

Adobe Reader Mobile JavaScript Interface Java Code Execution (CVE-2014-0514)

A code execution vulnerability exists in Adobe Mobile Reader for Android. The vulnerability is due to a failure to restrict access to certain JavaScript interfaces. A remote unauthenticated attacker could exploit this vulnerability by enticing a target user to open a crafted document...

CVE-2014-1738

The rawcmdcopyout function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly restrict access to certain pointers during processing of an FDRAWCMD ioctl call, which allows local users to obtain sensitive information from kernel heap memory by leveraging write access to...

PT-2014-2087 · Blender +1 · Blender +1

Name of the Vulnerable Software and Affected Versions: Blender versions 2.5 through 2.63a Description: The undo save quit routine in the kernel in Blender allows local users to overwrite arbitrary files via a symlink attack on the quit.blend temporary file. This issue might be a regression of a...

PT-2014-4798 · Sonicwall · Sonicwall Network Security Appliance

Name of the Vulnerable Software and Affected Versions: SonicWall Network Security Appliance NSA 2400 Description: The issue is related to a cross-site scripting XSS vulnerability in the Dashboard Backend service, specifically in the stats/dashboard.jsp component. This vulnerability allows remote...

Aker Secure Mail Gateway reflected XSS vulnerability

Overview Aker Secure Mail Gateway 2.5.2 and previous versions contain a reflected cross-site scripting vulnerability. CWE-79 Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' - CVE-2013-6037Aker Secure Mail Gateway 2.5.2 and previous versions...

Foscam IP camera authentication bypass vulnerability

Overview The FI8910W Foscam IP camera running firmware version 11.37.2.54 fails to properly authenticate users. Description CWE-592: Authentication Bypass Issues - CVE-2014-1911The FI8910W Foscam IP camera running firmware version 11.37.2.54 contains a vulnerability which allows an unauthenticate...

PT-2014-2216 · Iproute2 · Iproute2

Name of the Vulnerable Software and Affected Versions: iproute2 versions prior to 3.3.0 Description: The issue allows local users to overwrite arbitrary files via a symlink attack on a temporary file used by certain scripts. This can be exploited through the configure script or the...

CVE-2013-2214

status.cgi in Nagios 4.0 before 4.0 beta4 and 3.x before 3.5.1 does not properly restrict access to certain users that are a contact for a service, which allows remote authenticated users to obtain sensitive information about hostnames via the servicegroup 1 overview, 2 summary, or 3 grid style i...

PT-2014-4252 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: Drupal versions 7.14 Description: A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the year parameter to the "eventcalander/" endpoint. This issue has been disputed by the Drupal Security Tea...

PT-2013-1028 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions through 3.12.5 Description: The issue allows local users to gain privileges via a large id value, specifically through an array index error in the kvm vm ioctl create vcpu function in the KVM subsystem. This can be...

Secure Mail Archive with Space Permissions

Mail Archives in a Space are currently not subject to any Read / View security context Permissions. They are visible to all space users. REQUEST: Apply Restrict Space Permissions to Mail Archive Same behavior as for Pages, restricting ability to search or view mail archive based on permissions. S...

Secure Mail Archive with Space Permissions

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Cloud. Using Confluence Server? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFSERVER-31944. panel Mail Archives in a Space are currently not subject to any Read / View security context Permissions. They are visib...

PT-2013-1143 · Apache · Apache Solr

Name of the Vulnerable Software and Affected Versions: Apache Solr versions prior to 4.3.1 Description: The issue is related to the DocumentAnalysisRequestHandler in Apache Solr, which does not properly use the EmptyEntityResolver. This allows remote attackers to have an unspecified impact via XM...

PT-2013-1076 · Pixman +4 · Pixman +4

Name of the Vulnerable Software and Affected Versions: pixman versions prior to 0.32.0 pixman version 0.22.0 Description: The issue is related to an integer underflow in the pixman trapezoid valid macro in pixman.h in Pixman, which can be exploited to cause a denial of service crash via a negativ...

Fedora 18 : glpi-0.83.9.1-4.fc18 (2013-16575)

Security improvement: restrict access to installation wizard from local server only. Remote access need to be explicitly allowed in configuration /etc/httpd/conf.d/glpi.conf. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisor...