PT-2013-1370 · Zabbix +1 · Zabbix +1

Name of the Vulnerable Software and Affected Versions: Zabbix versions prior to 5.0 Description: The issue is related to the use of the MD5 algorithm for password hashing in Zabbix, which can be exploited by a remote attacker to gain access to confidential data. The passwords in the users table a...

Parallels Plesk Panel phppath/php vulnerability

Overview Parallels Plesk Panel versions 9.0 - 9.2.3 on Linux platforms are vulnerable to remote code execution. Description Parallels Plesk Panel versions 9.0 - 9.2.3 on Linux platforms may be exploited by a combination of CVE-2012-1823 and the Plesk phppath script alias usage. There have been...

C2 WebResource web interface XSS vulnerability

Overview The C2 WebResource web interface contains a XSS vulnerability. Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'The C2 WebResource web interface is vulnerable to XSS on the following URL and parameter:...

Apache Rave 0.11 < 0.20 - User Information Disclosure

CVE-2013-1814: Apache Rave exposes User over API Severity: Important Vendor: The Apache Software Foundation Versions Affected: Rave 0.11 to 0.20 Description: Rave returns the full user object, including the salted and hashed password, via the User RPC API. This endpoint is only available to...

PT-2013-1604 · Dnsmasq +3 · Dnsmasq +3

Name of the Vulnerable Software and Affected Versions: Dnsmasq versions prior to 2.63test1 Description: The issue allows remote attackers to cause a denial of service, specifically through traffic amplification, by sending a spoofed DNS query. This occurs when Dnsmasq is used with certain...

Fedora 16 : java-1.6.0-openjdk-1.6.0.0-69.1.11.6.fc16 (2013-1898)

Rewritten java-1.6.0-openjdk-java-access-bridge-security.patch - Updated to icedtea6 1.11.6 - Security fixes - S6563318, CVE-2013-0424: RMI data sanitization - S6664509, CVE-2013-0425: Add logging context - S6664528, CVE-2013-0426: Find log level matching its name or value given at construction...

Dell OpenManage Server Administrator version 7.1.0.1 DOM-based XSS vulnerability

Overview Dell OpenManage Server Administrator version 7.1.0.1 and earlier contains a DOM-based cross-site scripting vulnerability. Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'Dell OpenManage Server Administrator version 7.1.01 and earlier...

PT-2012-5165 · D Link · D-Link Dcs-932L

Name of the Vulnerable Software and Affected Versions: D-Link DCS-932L camera version 1.02 Description: The issue allows remote attackers to discover the password via a UDP broadcast packet. This can be demonstrated by running the D-Link Setup Wizard and reading the paramR"P" value...

ManageEngine AssetExplorer fails to properly sanitize XML asset data submission

Overview ManageEngine AssetExplorer version 5.6.0 build number 5610 and possibly older versions is vulnerable to multiple stored XSS vulnerabilities via XML asset data submission. Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'ManageEngine...

PT-2012-5484 · Pgbouncer · Pgbouncer

Name of the Vulnerable Software and Affected Versions: pgbouncer version 1.5.2 Description: The issue allows remote attackers to cause a denial of service, resulting in a daemon outage. This is achieved by sending a request with a long database name to the add database function in objects.c...

Esri ArcGIS server 10.1 contains a blind SQL injection vulnerability

Overview Esri's ArcGIS server version 10.1 contains a blind SQL injection vulnerability that allows remote attackers to execute a subset of SQL commands via a query operation where clause. Description The Esri ArcGIS server version 10.1 contains a blind SQL injection vulnerability CWE-89 for REST...

VeriCentre web application SQL injection vulnerability

Overview The VeriCentre web application contains a SQL injection vulnerability. Description CWE-89: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection'The VeriCentre web application contains a SQL injection vulnerability within the TerminalId, ModelName, and...

SolarWinds Orion IPAM web interface reflected xss vulnerability

Overview SolarWinds Orion IPAM web interface contains a reflected cross-site scripting vulnerability. Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'SolarWinds Orion IPAM web interface contains a reflected cross-site scripting vulnerability. ...

Cerberus FTP Server web interface cross-site request forgery vulnerability

Overview The Cerberus FTP Server web interface contains a cross-site request forgery vulnerability Description CWE-352: Cross-Site Request Forgery CSRF: The Cerberus FTP Server web interface is vulnerable to CSRF using the HTTP POST method in the :10000/usermanager/users/modify. The application h...

Webmin contains input validation vulnerabilities

Overview Webmin 1.580, and possibly earlier versions, has been reported to contain input validation vulnerabilities. Description The advisories from American Information Security Group report the following vulnerabilities.CWE-20: Improper Input Validation - CVE-2012-2981 "An input validation flaw...

PT-2012-5621 · Sangoma · Freepbx

Name of the Vulnerable Software and Affected Versions: FreePBX versions 2.9 and earlier Description: The issue allows remote attackers to execute arbitrary commands. This is achieved through the callmenum parameter in a 'c' action, specifically targeting the callme startcall function in...

PT-2012-1244 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 3.9 Description: The issue is related to the scsi ioctl function in the Linux kernel, which does not properly consider the SCSI device class during authorization of SCSI commands. This allows local users to bypa...

PT-2012-4693 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 3.4.5 Description: The issue is related to a heap-based buffer overflow in the udf load logicalvol function, which can be triggered by a crafted UDF filesystem. This can cause a denial of service, resulting in a...

PT-2012-1208 · Unixodbc +1 · Unixodbc +1

Name of the Vulnerable Software and Affected Versions: unixODBC versions 2.0.10, 2.3.1, and earlier Description: The issue is related to a buffer overflow in the SQLDriverConnect function, which can be triggered by a long string in the FILEDSN option, potentially allowing local users to cause a...

Database Open Access Information Disclosure Vulnerability

Various Database server might be prone to an information disclosure vulnerability if accessible to remote systems. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...