Esri ArcGIS server 10.1 contains a blind SQL injection vulnerability

Overview Esri's ArcGIS server version 10.1 contains a blind SQL injection vulnerability that allows remote attackers to execute a subset of SQL commands via a query operation where clause. Description The Esri ArcGIS server version 10.1 contains a blind SQL injection vulnerability CWE-89 for REST...

VeriCentre web application SQL injection vulnerability

Overview The VeriCentre web application contains a SQL injection vulnerability. Description CWE-89: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection'The VeriCentre web application contains a SQL injection vulnerability within the TerminalId, ModelName, and...

SolarWinds Orion IPAM web interface reflected xss vulnerability

Overview SolarWinds Orion IPAM web interface contains a reflected cross-site scripting vulnerability. Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'SolarWinds Orion IPAM web interface contains a reflected cross-site scripting vulnerability. ...

PT-2012-5456 · Intel +2 · Ibacm +2

Name of the Vulnerable Software and Affected Versions: ibacm version 1.0.7 Description: The issue allows local users to overwrite the ib acm daemon log or ibacm.port file due to world-writable permissions set by ibacm 1.0.7. Recommendations: For ibacm version 1.0.7, consider changing the file...

Fedora Update for gitolite3 FEDORA-2012-15731

Check for the Version of gitolite3 OpenVAS Vulnerability Test Fedora Update for gitolite3 FEDORA-2012-15731 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under t...

Cerberus FTP Server web interface cross-site request forgery vulnerability

Overview The Cerberus FTP Server web interface contains a cross-site request forgery vulnerability Description CWE-352: Cross-Site Request Forgery CSRF: The Cerberus FTP Server web interface is vulnerable to CSRF using the HTTP POST method in the :10000/usermanager/users/modify. The application h...

PT-2012-5621 · Sangoma · Freepbx

Name of the Vulnerable Software and Affected Versions: FreePBX versions 2.9 and earlier Description: The issue allows remote attackers to execute arbitrary commands. This is achieved through the callmenum parameter in a 'c' action, specifically targeting the callme startcall function in...

PT-2012-5627 · Artifex · Ghostscript

Name of the Vulnerable Software and Affected Versions: Ghostscript version 9.04 Description: The issue is related to a heap-based buffer overflow in the gdevwpr2.c file of Ghostscript, specifically when processing the OutputFile device parameter. This allows user-assisted remote attackers to...

Webmin contains input validation vulnerabilities

Overview Webmin 1.580, and possibly earlier versions, has been reported to contain input validation vulnerabilities. Description The advisories from American Information Security Group report the following vulnerabilities.CWE-20: Improper Input Validation - CVE-2012-2981 "An input validation flaw...

PT-2012-1396 · Zonealarm · Zonealarm Extreme Security

Name of the Vulnerable Software and Affected Versions: ZoneAlarm Extreme Security version 9.1.507.000 Description: A race condition issue exists, allowing local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked. This is achieved through certain...

PT-2012-1244 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 3.9 Description: The issue is related to the scsi ioctl function in the Linux kernel, which does not properly consider the SCSI device class during authorization of SCSI commands. This allows local users to bypa...

SA-CONTRIB-2012-109 - Restrict node page view - Access bypass

This module enables you to disable direct access to node pages node/XXX based on nodetypes and permissions. The module issues a NODEACCESSALLOW if it's permissions are met, but does not respect the "administer nodes" or "access own unpublished content" permissions. The consequence is that this...

PT-2012-4693 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 3.4.5 Description: The issue is related to a heap-based buffer overflow in the udf load logicalvol function, which can be triggered by a crafted UDF filesystem. This can cause a denial of service, resulting in a...

PT-2012-1533 · Modplug · Libmodplug

Name of the Vulnerable Software and Affected Versions: libmodplug versions prior to 0.8.8.3 Description: The issue is related to multiple stack-based buffer overflows in the abc new macro and abc new umacro functions, which can be triggered by a crafted ABC file. This can cause a denial of servic...

PT-2012-1208 · Unixodbc +1 · Unixodbc +1

Name of the Vulnerable Software and Affected Versions: unixODBC versions 2.0.10, 2.3.1, and earlier Description: The issue is related to a buffer overflow in the SQLDriverConnect function, which can be triggered by a long string in the FILEDSN option, potentially allowing local users to cause a...

RHEL 6 : kernel (RHSA-2012:0481)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0481 advisory. - kernel: sysctl: restrict write access to dmesgrestrict CVE-2011-4080 - kernel: block: CLONEIO iocontext refcounting issues CVE-2012-0879 -...

kernel: sysctl: restrict write access to dmesg_restrict

The sysrqsysctlhandler function in kernel/sysctl.c in the Linux kernel before 2.6.39 does not require the CAPSYSADMIN capability to modify the dmesgrestrict value, which allows local users to bypass intended access restrictions and read the kernel ring buffer by leveraging root privileges, as...

Database Open Access Information Disclosure Vulnerability

Various Database server might be prone to an information disclosure vulnerability if accessible to remote systems. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Opera Website - Cross Site Scripting Vulnerability

Document Title: =============== Opera Website - Cross Site Scripting Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=369 Release Date: ============= 2012-01-23 Vulnerability Laboratory ID VL-ID: ==================================== 369 Comm...

ZDI-12-015 : (0Day) HP StorageWorks P2000 G3 Directory Traversal and Default Account Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-015 : 0Day HP StorageWorks P2000 G3 Directory Traversal and Default Account Vulnerabilities http://www.zerodayinitiative.com/advisories/ZDI-12-015 January 12, 2012 - -- CVE ID: CVE-2011-4788 - -- CVSS: 9, AV:N/AC:L/Au:N/C:C/I:P/A:P - -- Affecte...