CVE-2014-2916

CVE-2014-2916 affects phpList’s subscription page editor (spageedit) up to version 3.0.6. The issue is a Cross-site request forgery (CSRF) that enables an attacker to hijack an administrator’s session via a request to admin/. The vulnerability is triggered through authenticated admin actions, ena...

[security bulletin] HPSBHF03006 rev.1 - HP Integrated Lights-Out 2 (iLO 2) Denial of Service

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04244787 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04244787 Version: 1 HPSBHF03006 rev....

[security bulletin] HPSBMU02994 rev.3 - HP BladeSystem c-Class Onboard Administrator (OA) running OpenSSL, Remote Disclosure of Information

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04236062 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04236062 Version: 3 HPSBMU02994 rev....

(RHSA-2014:0350) Low: Red Hat Enterprise MRG for Red Hat Enterprise Linux 5 Retirement Notice

In accordance with the Red Hat Enterprise MRG Life Cycle policy, the Red Hat Enterprise MRG product, which includes MRG-Messaging, MRG-Realtime, and MRG-Grid, Version 1 offering for Red Hat Enterprise Linux 5 was retired as of March 31, 2014, and support is no longer provided. Accordingly, Red Ha...

AST-2014-004: Remote Crash Vulnerability in PJSIP Channel Driver Subscription Handling

Asterisk Project Security Advisory - AST-2014-004 Product Asterisk Summary Remote Crash Vulnerability in PJSIP Channel Driver Subscription Handling Nature of Advisory Denial of Service Susceptibility Remote Authenticated Sessions Severity Moderate Exploits Known No Reported On January 14th, 2014...

Microsoft Office 365 Outlook - Persistent Vulnerability

Document Title: =============== Microsoft Office 365 Outlook - Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=811 Microsoft Security Response Center MSRC ID: 14095 Release Date: ============= 2014-02-28 Vulnerability Laboratory ...

Mass Assignment in extension Direct Mail Subscription (direct_mail_subscription)

It has been discovered that the extension "Direct Mail Subscription" directmailsubscription is susceptible to Mass Assignment. Release Date: February 12, 2014 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 2.0.0 an...

Seam: XML eXternal Entity (XXE) flaw in remoting

Multiple XML External Entity XXE vulnerabilities in the 1 ExecutionHandler, 2 PollHandler, and 3 SubscriptionHandler classes in JBoss Seam Remoting in JBoss Seam 2 framework 2.3.1 and earlier, as used in JBoss Web Framework Kit, allow remote attackers to read arbitrary files and possibly have oth...

CVE-2013-6439

Candlepin in Red Hat Subscription Asset Manager 1.0 through 1.3 uses a weak authentication scheme when the configuration file does not specify a scheme, which has unspecified impact and attack vectors...

Authentication flaw

Candlepin in Red Hat Subscription Asset Manager 1.0 through 1.3 uses a weak authentication scheme when the configuration file does not specify a scheme, which has unspecified impact and attack vectors...

CVE-2013-6439

Candlepin in Red Hat Subscription Asset Manager 1.0 through 1.3 uses a weak authentication scheme when the configuration file does not specify a scheme, which has unspecified impact and attack vectors...

CVE-2013-6439

CVE-2013-6439 affects Red Hat Subscription Asset Manager Candlepin 1.0–1.3, which uses a weak authentication scheme when the configuration file does not specify a scheme. Public sources reiterate an authentication-bypass risk. Remediation involves applying the updated candlepin packages from RHSA...

candlepin: insecure authentication enabled by default

Candlepin in Red Hat Subscription Asset Manager 1.0 through 1.3 uses a weak authentication scheme when the configuration file does not specify a scheme, which has unspecified impact and attack vectors...

Important: Red Hat Security Advisory: candlepin security update

Updated candlepin packages that fix one security issue are now available for Red Hat Subscription Asset Manager. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

ESPCMS某处SQL注入漏洞

简要描述： 问题出在修复,这个开发的人已经是第二次修复有遗留问题了.上次修复 会员个人资料注入 有3个字段 结果就修复了2个字段,这次的问题跟这个差不多. 不过这个漏洞还是有点让人无语.真的很无语. 算通用吗? 详细说明： 问题出在邮件订阅. 其实就是这个漏洞http://wooyun.org/bugs/wooyun-2010-023688 但是官方没有修复完整 public.php 修复了. 但是 3gwappublic.php 未修复完. 问题是一样的. 查询出来未过滤,是存在二次注入. 好了现在就说这个漏洞的无语把.因为这个问题没办法注入 什么意思? WTF? 复制代码复制多了?...

Important: Red Hat Security Advisory: rhev-hypervisor6 security and bug fix update

An updated rhev-hypervisor6 package that fixes two security issues and various bugs is now available. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

CVE-2012-6137

rhn-migrate-classic-to-rhsm tool in Red Hat subscription-manager does not verify the Red Hat Network Classic server's X.509 certificate when migrating to a Certificate-based Red Hat Network, which allows remote man-in-the-middle attackers to obtain sensitive information such as user credentials...

Code injection

rhn-migrate-classic-to-rhsm tool in Red Hat subscription-manager does not verify the Red Hat Network Classic server's X.509 certificate when migrating to a Certificate-based Red Hat Network, which allows remote man-in-the-middle attackers to obtain sensitive information such as user credentials...

CVE-2012-6137

rhn-migrate-classic-to-rhsm tool in Red Hat subscription-manager does not verify the Red Hat Network Classic server's X.509 certificate when migrating to a Certificate-based Red Hat Network, which allows remote man-in-the-middle attackers to obtain sensitive information such as user credentials...

CVE-2012-6137

The CVE refers to a vulnerability in the subscription-manager tool (rhn-migrate-classic-to-rhsm) where the Red Hat Network Classic server’s X.509 certificate is not verified during migration to the Certificate-based Red Hat Network. This is a MITM risk that could allow an attacker to obtain sensi...