fcron: Information disclosure

Background fcron is a periodic command scheduler for Unix-based systems Description The fcrontab function contains a race condition relating to symlinks. Impact A local attacker could perform symlink attacks to read arbitrary files with the privileges of the user running the application. Workarou...

[SECURITY] Fedora 18 Update: nepomuk-core-4.10.5-1.fc18

Nepomuk Core utilities and libraries...

Mandriva Linux Security Advisory : sleuthkit (MDVSA-2013:125)

Updated sleuthkit packages fix security vulnerabilities : A security flaw was found in the way the Sleuth Kit TSK, a collection of UNIX-based command line tools allowing to investigate a computer, performed management of '.' dotfile file system entry. An attacker could use this flaw to evade...

Time Stamp Bug in Sudo Could Have Allowed Code Entry

A vulnerability in sudo – a program that manages user privileges on certain types of systems – could allow an unauthenticated user to execute commands for about five minutes, without entering a password. The problem, which has since been fixed, previously existed in builds 1.6.0 through 1.7.10p6...

cPanel and WHM Multiple Cross Site Scripting Vulnerabilities

cPanel is a Unix based fully featured popular web based hosting account control panel that helps webmasters to manage their domains through a web browser. The latest version of cPanel & WHM is 11.34, which is vulnerable to multiple cross site scripting. During my bug hunting process, today I...

Tectia SSH USERAUTH Change Request Password Reset

This Metasploit module exploits a vulnerability in Tectia SSH server for Unix-based platforms. The bug is caused by a SSH2MSGUSERAUTHPASSWDCHANGEREQ request before password authentication, allowing any remote user to bypass the login routine, and then gain access as root. This file is part of the...

Tectia SSH USERAUTH Change Request Password Reset

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' require 'net/ssh' class Metasploit3...

(SSH.com Communications) SSH Tectia - USERAUTH Change Request Password Reset (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' require 'net/ssh' class Metasploit3...

[SECURITY] Fedora 16 Update: claws-mail-3.9.0-1.fc16

Claws Mail is an email client and news reader, based on GTK+, featuring quick response, graceful and sophisticated interface, easy configuration, intuitive operation, abundant features, and extensibility...

Tectia SSH USERAUTH Change Request Password Reset Vulnerability

This module exploits a vulnerability in Tectia SSH server for Unix-based platforms. The bug is caused by a SSH2MSGUSERAUTHPASSWDCHANGEREQ request before password authentication, allowing any remote user to bypass the login routine, and then gain access as root. Module Options msf use...

UBUNTU-CVE-2011-1412

sys/sysunix.c in the ioQuake3 engine on Unix and Linux, as used in World of Padman 1.5.x before 1.5.1.1 and OpenArena 0.8.x-15 and 0.8.x-16, allows remote game servers to execute arbitrary commands via shell metacharacters in a long fsgame variable...

[SECURITY] Fedora 14 Update: wireshark-1.4.7-1.fc14

Wireshark is a network traffic analyzer for Unix-ish operating systems. This package lays base for libpcap, a packet capture and filtering library, contains command-line utilities, contains plugins and documentation for wireshark. A graphical user interface is packaged separately to GTK+ package...

TIBCO Security Advisory: February 1, 2011 - TIBCO Rendezvous and Enterprise MessageService

TIBCO Rendezvous and Enterprise Message Service vulnerabilities Original release date: February 1, 2011 Last revised: -- CVE-2011-0649 Source: TIBCOSoftware Inc. TIBCO Rendezvous and Enterprise Message Service vulnerabilities Original release date: February 1, 2011 Last revised: -- Source: TIBCO...

Vulnerability in Windows Services for UNIX Could Allow Elevation of Privilege (939778)

This host is missing a critical security update according to Microsoft Bulletin MS07-053. OpenVAS Vulnerability Test $Id: gbms07-053.nasl 5362 2017-02-20 12:46:39Z cfi $ Vulnerability in Windows Services for UNIX Could Allow Elevation of Privilege 939778 Authors: Madhuri D Copyright: Copyright c...

MySQL COM_TABLE_DUMP Function Stack Overflow (CVE-2006-1517)

MySQL is an open-source implementation of a relational database management system. MySQL supports the SQL Structured Query Language database query language. The database product allows remote network connections from client applications over the proprietary MySQL network protocol. In addition to...

CVE-2009-2813

Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating systems, does not properly handle errors in resolving pathnames, which allows remote...

CVE-2009-1216: Undefined Security Weakness

Multiple unspecified vulnerabilities in 1 unlzh.c and 2 unpack.c in the gzip libraries in Microsoft Windows Server 2008, Windows Services for UNIX 3.0 and 3.5, and the Subsystem for UNIX-based Applications SUA; as used in gunzip, gzip, pack, pcat, and unpack 7.x before 7.0.1701.48, 8.x before...

[SECURITY] Fedora 8 Update: kazehakase-0.5.3-5.fc8

Kazehakase is a Web browser which aims to provide a user interface that is truly user-friendly & fully customizable. This package uses Gecko for HTML rendering engine. If you want to use WebKit for HTML rendering engine, install "kazehakase-webkit" rpm instead...

iDefense Security Advisory 03.10.08: SAP MaxDB sdbstarter Privilege Escalation Vulnerability

iDefense Security Advisory 03.10.08 http://labs.idefense.com/intelligence/vulnerabilities/ Mar 10, 2008 I. BACKGROUND SAP's MaxDB is a database software product. MaxDB was released as open source from version 7.5 up to version 7.6.00. Later versions are no longer open source but are available for...

CVE-2008-0928

Qemu 0.9.1 and earlier does not perform range checks for block device read or write requests, which allows guest host users with root privileges to access arbitrary memory and escape the virtual machine...