2809 matches found
CVE-2015-5318: Cross-Site Request Forgery (CSRF)
Jenkins before 1.638 and LTS before 1.625.2 uses a publicly accessible salt to generate CSRF protection tokens, which makes it easier for remote attackers to bypass the CSRF protection mechanism via a brute force attack...
IBM System Networking Switch Center DB Service Remote Elevation of Privilege Vulnerability
This vulnerability allows remote attackers to disclose information on vulnerable installations of IBM System Networking Switch Center. Authentication is not required to exploit this vulnerability. The specific flaw exists within the IBM SNSC DB Service, that listens by default on port 40999. This...
CVE-2015-5288
The crypt function in contrib/pgcrypto in PostgreSQL before 9.0.23, 9.1.x before 9.1.19, 9.2.x before 9.2.14, 9.3.x before 9.3.10, and 9.4.x before 9.4.5 allows attackers to cause a denial of service server crash or read arbitrary server memory via a "too-short" salt...
CVE-2015-5288: Exposure of Sensitive Information to an Unauthorized Actor
The crypt function in contrib/pgcrypto in PostgreSQL before 9.0.23, 9.1.x before 9.1.19, 9.2.x before 9.2.14, 9.3.x before 9.3.10, and 9.4.x before 9.4.5 allows attackers to cause a denial of service server crash or read arbitrary server memory via a "too-short" salt...
FreeBSD : Salt -- multiple vulnerabilities (3934cc60-f0fa-4eca-be09-c8bd7ae42871)
Salt release notes : CVE-2015-6918 - Git modules leaking HTTPS auth credentials to debug log Updated the Git state and execution modules to no longer display HTTPS basic authentication credentials in loglevel debug output on the Salt master. These credentials are now replaced with REDACTED in the...
Salt -- multiple vulnerabilities
Salt release notes: CVE-2015-6918 - Git modules leaking HTTPS auth credentials to debug log Updated the Git state and execution modules to no longer display HTTPS basic authentication credentials in loglevel debug output on the Salt master. These credentials are now replaced with REDACTED in the...
CVE-2015-5288
The crypt function in contrib/pgcrypto in PostgreSQL before 9.0.23, 9.1.x before 9.1.19, 9.2.x before 9.2.14, 9.3.x before 9.3.10, and 9.4.x before 9.4.5 allows attackers to cause a denial of service server crash or read arbitrary server memory via a "too-short" salt...
UBUNTU-CVE-2015-5288
The crypt function in contrib/pgcrypto in PostgreSQL before 9.0.23, 9.1.x before 9.1.19, 9.2.x before 9.2.14, 9.3.x before 9.3.10, and 9.4.x before 9.4.5 allows attackers to cause a denial of service server crash or read arbitrary server memory via a "too-short" salt...
From django SECRET_KEY to code execution-vulnerability warning-the black bar safety net
A recent review of the code found in some products in the logon of JS code in the leaked SECRETKEY,the value as the password to encrypt the salt, thus exposing the encryption salt is not good., more important is the django security caused great threat. 0x01 SECRETKEY role SECTETKEY in djanog used...
vBulletin 3.6.0 4.2.3 - ForumRunner SQL Injection
vBulletin 3.6.0 4.2.3 - ForumRunner SQL Injection Exploit Title : vBulletin = 4.2.3 SQL Injection CVE-2016-6195 Author : Manish Kishan Tanwar AKA error1046 https://twitter.com/IndiShell1046 Date : 25/08/2015 Love to : zero cool,Team indishell,Mannu,Viki,Hardeep Singh,Jagriti,Kishan Singh and ritu...
Fedora 21 : ecryptfs-utils-106-1.fc21 (2015-10581)
Fixes salt usage for password wrapping Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL...
Sql injection
SQL injection vulnerability in Subrion CMS before 3.3.3 allows remote authenticated users to execute arbitrary SQL commands via modified serialized data in a salt cookie...
CVE-2015-4129
SQL injection vulnerability in Subrion CMS before 3.3.3 allows remote authenticated users to execute arbitrary SQL commands via modified serialized data in a salt cookie...
CVE-2015-4129
CVE-2015-4129 is a SQL injection vulnerability in Subrion CMS prior to 3.3.3. The issue arises from processing modified serialized data in a salt cookie, allowing remote authenticated users to execute arbitrary SQL commands. Affected software: Subrion CMS; vulnerable component: cookie serializati...
CVE-2015-4129: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in Subrion CMS before 3.3.3 allows remote authenticated users to execute arbitrary SQL commands via modified serialized data in a salt cookie...
PT-2015-6422
Name of the Vulnerable Software and Affected Versions Subrion CMS versions prior to 3.3.3 Description The issue allows remote authenticated users to execute arbitrary SQL commands via modified serialized data in a salt cookie. Recommendations For versions prior to 3.3.3, update to version 3.3.3 o...
Subrion CMS 'salt' SQL Injection Vulnerability
Subrion CMS is an open source content management system CMS. A SQL injection vulnerability exists in Subrion CMS. An attacker could exploit this vulnerability to take control of the application and access or modify data...
FreeBSD : py-salt -- potential shell injection vulnerabilities (865863af-fb5e-11e4-8fda-002590263bf5)
Colton Myers reports : In order to fix potential shell injection vulnerabilities in salt modules, a change has been made to the various cmd module functions. These functions now default to pythonshell=False, which means that the commands will not be sent to an actual shell. The largest side effec...
SaltStack Insecure Temporary File Vulnerability
SaltStack is an open source set of tools for managing infrastructure. SaltStack has a security vulnerability due to the serverdensitydevice.py module creating the 'install.sh' temporary file in an incorrect way. This allows an attacker to perform arbitrary file operations via symbolic links...
