Mandriva Update for apache-mod_security MDVSA-2012:182 (apache-mod_security)

Check for the Version of apache-modsecurity OpenVAS Vulnerability Test Mandriva Update for apache-modsecurity MDVSA-2012:182 apache-modsecurity Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can...

Mandriva Linux Security Advisory : apache-mod_security (MDVSA-2012:182)

Multiple vulnerabilities has been discovered and corrected in apache-modsecurity : ModSecurity before 2.6.6, when used with PHP, does not properly handle single quotes not at the beginning of a request parameter value in the Content-Disposition field of a request with a multipart/form-data...

Fedora 18 : kde-settings-4.9-16.fc18.1 (2012-19158)

Ship kwin rules to fix maximization of some Gtk2 apps Tightens permissions on /var/run/kdm. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible...

Fedora Update for mod_security_crs FEDORA-2012-18315

Check for the Version of modsecuritycrs OpenVAS Vulnerability Test Fedora Update for modsecuritycrs FEDORA-2012-18315 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify ...

Fedora 17 : mod_security-2.7.1-3.fc17 / mod_security_crs-2.2.6-3.fc17 (2012-18315)

Update to 2.7.1 - Update Core rules set to 2.2.6 - Fix build against libxml2 = 2.9 upstreamed - Add some missing directives RHBZ 569360 - Fix multipart/invalid part ruleset bypass issue CVE-2012-4528 RHBZ 867424, 867773, 867774 Note that Tenable Network Security has extracted the preceding...

[SECURITY] Fedora 18 Update: php-symfony-symfony-1.4.20-2.fc18

Symfony is a complete framework designed to optimize the development of web applications by way of several key features. For starters, it separates a w eb application's business rules, server logic, and presentation views. It contains numerous tools and classes aimed at shortening the development...

[SECURITY] Fedora 17 Update: mod_security_crs-2.2.6-3.fc17

This package provides the base rules for modsecurity...

Snort Multiple HTTP Bypass <= 2.9.3.1 Exploit

Snort® is an open source network intrusion prevention and detection system IDS/IPS developed by Sourcefire. Combining the benefits of signature, protocol, and anomaly-based inspection, Snort is the most widely deployed IDS/IPS technology worldwide. With millions of downloads and nearly 400,000...

[SECURITY] Fedora 18 Update: mod_security_crs-2.2.6-3.fc18

This package provides the base rules for modsecurity...

PT-2012-1581 · Red Hat +1 · Jboss Enterprise Portal Platform +3

Name of the Vulnerable Software and Affected Versions: JBoss Enterprise Portal Platform versions prior to 5.2.2 BRMS Platform 5.3.0 before roll up patch 1 SOA Platform 5.3.0 before roll up patch 1 Description: A cross-site request forgery CSRF issue exists in the JMX Console, allowing remote...

Fedora 16 : rt3-3.8.15-1.fc16 (2012-17218)

---------------------------------------------------------------------- ---------- ChangeLog : - Sun Oct 28 2012 Ralf Corsepius - 3.8.15-1 - Upstream update RH BZ 870407, CVE-2012-4730, CVE-2012-4732, CVE-2012-4734, CVE-2012-4735, CVE-2012-4884. - Sat Oct 6 2012 Ralf Corsepius - 3.8.14-1 - Upstrea...

[360-FAAR] Firewall Analysis Audit And Repair 0.3.6

360-FAAR Firewall Analysis Audit and Repair is an offline, command line, Perl firewall policy manipulation tool to filter, compare to logs, merge, translate and output firewall commands for new policies, in Checkpoint dbedit, Cisco ASA or ScreenOS commands, and its one file! Read Policy and Logs...

Alliance Issues Guidance for Cloud-Based SIEM Services

The non-profit Cloud Security Alliance today released guidelines for the nascent Security as a Service SecaaS specialization within the broader realm of cloud computing. The goal, the group says, is to help companies and consumers gain a better handle on how best to evaluate, build and deploy...

Switchvox Asterisk v5.1.2 - Multiple Web Vulnerabilities

Title: ====== Switchvox Asterisk v5.1.2 - Multiple Web Vulnerabilities Date: ===== 2012-09-10 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=700 VL-ID: ===== 700 Common Vulnerability Scoring System: ==================================== 4.1 Introduction: =============...

Zero-Day Exploit released for Vulnerability in Novell ZENworks

Rapid7 researcher Juan Vazquez recently uncovered a zero-day security flaw in Novell ZENworks Asset Management 7.5. This Vulnerability CVE-2012-4933 gives access to any files with system privileges and could also allow an attacker to grab configuration parameters, including the backend credential...

ModSecurity - POST Security Bypass

ModSecurity - POST Security Bypass source: https://www.securityfocus.com/bid/56096/info ModSecurity is prone to a security-bypass vulnerability because it fails to sufficiently sanitize user-supplied input. Successful exploits can allow attackers to bypass filtering rules; this may aid in further...

ModSecurity - 'POST' Security Bypass

source: https://www.securityfocus.com/bid/56096/info ModSecurity is prone to a security-bypass vulnerability because it fails to sufficiently sanitize user-supplied input. Successful exploits can allow attackers to bypass filtering rules; this may aid in further attacks. ModSecurity 2.6.8 is...

Arbitrary resource file download in urlrewrite.xml

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-26888. panel There is an arbitrary resource file download vulnerability triggered by a third party library...

Novell ZENworks Asset Management 7.5 web console information disclosure vulnerability

Overview The web console for Novell ZENworks Asset Management 7.5 contains an information disclosure vulnerability. This vulnerability allows a remote attacker to read any file with SYSTEM privileges and retrieve configuration parameters from ZENworks Asset Management. Description The Novell...

Design/Logic Flaw

The dumpresource function in dird/dirdconf.c in Bacula before 5.2.11 does not properly enforce ACL rules, which allows remote authenticated users to obtain resource dump information via unspecified vectors...