jenkins: Public value used for CSRF protection salt (SECURITY-169)

Jenkins before 1.638 and LTS before 1.625.2 uses a publicly accessible salt to generate CSRF protection tokens, which makes it easier for remote attackers to bypass the CSRF protection mechanism via a brute force attack...

openSUSE Security Update : salt (openSUSE-2016-318)

This update for salt fixes the following issues : - CVE-2016-1866: Improper handling of clear messages on the minion remote code execution boo965403 The following bugs were fixed : - boo958350: Salt crashes on invalid UTF-8 in package data - boo959572: 'salt '' pkg.infoinstalled' causes exception...

Fedora 23 : salt-2015.5.8-1.fc23 (2016-105b3b8804)

Update to bugfix release 2015.5.8 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 ...

PT-2017-7315

Name of the Vulnerable Software and Affected Versions Salt versions prior to 2015.8.3 Description The issue concerns the state.sls function in Salt, which uses weak permissions on the cache data. This allows local users to obtain sensitive information by reading the file. Recommendations For...

Open Real Estate 1.15.1 XSS / SQL Injection / Weak Hashing

Introduction: Open Real Estate is an open source CMS for managing estate agent websites. It is written in PHP and uses the YII CMF. It supports multiple languages. It is supported by MonoRay.net The product has a number of commercial support offerings available and an internal market for...

[SECURITY] Fedora 22 Update: salt-2015.5.9-2.fc22

Salt is a distributed remote execution system used to execute commands and query data. It was developed in order to bring the best solutions found in the world of remote execution together and make them better, faster and more malleable. Salt accomplishes this via its ability to handle larger loa...

FreeBSD : salt -- code execution (0652005e-ca96-11e5-96d6-14dae9d210b8)

SaltStack reports : Improper handling of clear messages on the minion, which could result in executing commands not sent by the master. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database :...

SUSE-SU-2016:0290-1 Security update for ecryptfs-utils

This update for ecryptfs-utils fixes the following issues: - CVE-2016-1572: A local user could have escalated privileges by mounting over special filesystems bsc962052 - CVE-2014-9687: A default salt value reduced complexity of offline precomputation attacks bsc920160...

PHP 7.0.x < 7.0.1 Multiple Vulnerabilities

Binary data 9064.prm...

jenkins: Public value used for CSRF protection salt (SECURITY-169)

Jenkins before 1.638 and LTS before 1.625.2 uses a publicly accessible salt to generate CSRF protection tokens, which makes it easier for remote attackers to bypass the CSRF protection mechanism via a brute force attack...

SUSE-SU-2016:0241-1 Security update for ecryptfs-utils

This update for ecryptfs-utils fixes the following issues: - CVE-2016-1572: A local user could have escalated privileges by mounting over special filesystems bsc962052 - CVE-2014-9687: A default salt value reduced complexity of offline precomputation attacks bsc920160...

Fedora Update for salt FEDORA-2016-105

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 23 Update: salt-2015.5.8-1.fc23

Salt is a distributed remote execution system used to execute commands and query data. It was developed in order to bring the best solutions found in the world of remote execution together and make them better, faster and more malleable. Salt accomplishes this via its ability to handle larger loa...

saltlakenightout.com XSS vulnerability

Vulnerable URL: http://www.SaltLakeNightOut.com?option=calendar=12%2F31%2F1969id=5"=1=time=false Details: Description| Value ---|--- Patched:| Yes, at 31.03.2016 Latest check for patch:| 31.03.2016 08:28 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 20805508...

Seemingly tasteless ESPCMS background injected, can actually be a lot of fun-vulnerability warning-the black bar safety net

Yesterday, the black bar safety net loophole platform exposes a ESPCMS of injection vulnerabilities, Ali cloud computing security attack and defense against a team of friends first time on the vulnerability to do an impact assessment. Did not think need to login to the backend before it can be...

PHP 7.0.x < 7.0.1 Multiple Vulnerabilities

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.1. It is, therefore, affected by multiple vulnerabilities : - A use-after-free error exists in the collatorsortwithsortkeys function due to improper clearing of pointers when destroying an array. An...

FreeBSD : Salt -- information disclosure (e6b974ab-9d35-11e5-8f5c-002590263bf5)

Salt release notes report : CVE-2015-8034: Saving state.sls cache data to disk with insecure permissions This affects users of the state.sls function. The state run cache on the minion was being created with incorrect permissions. This file could potentially contain sensitive data that was insert...

CloudBees Jenkins CSRF Mechanism Bypass Vulnerability

CloudBees Jenkins is the open source continuous integration server. CloudBees Jenkins 1.638, LTS 1.625.2 before the version , the use of public salt to generate CSRF protection tokens , remote attackers through brute-force attacks can bypass the CSRF protection mechanism...

CVE-2015-5318

Jenkins before 1.638 and LTS before 1.625.2 uses a publicly accessible salt to generate CSRF protection tokens, which makes it easier for remote attackers to bypass the CSRF protection mechanism via a brute force attack...

Cross site request forgery (csrf)

Jenkins before 1.638 and LTS before 1.625.2 uses a publicly accessible salt to generate CSRF protection tokens, which makes it easier for remote attackers to bypass the CSRF protection mechanism via a brute force attack...