3431 matches found
[SECURITY] [DSA 3562-1] tardiff security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3562-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 01, 2016 https://www.debian.org/security/faq -...
mysql: unspecified vulnerability related to Server:SP (CPU October 2015)
Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : SP...
bind: malformed packet sent to rndc can trigger assertion failure
A denial of service flaw was found in the way BIND processed certain control channel input. A remote attacker able to send a malformed packet to the control channel could use this flaw to cause named to crash...
php: Files from archive can be extracted outside of destination directory using phar
A flaw was found in the way the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened...
openssl: SSLv2 Bleichenbacher protection overwrites wrong bytes for export ciphers
It was discovered that the SSLv2 protocol implementation in OpenSSL did not properly implement the Bleichenbacher protection for export cipher suites. An attacker could use a SSLv2 server using OpenSSL as a Bleichenbacher oracle...
mysql: use of SSL/TLS can not be enforced in mysql client library (oCERT-2015-003, BACKRONYM)
It was found that the MySQL client library permitted but did not require a client to use SSL/TLS when establishing a secure connection to a MySQL server using the "--ssl" option. A man-in-the-middle attacker could use this flaw to strip the SSL/TLS protection from a connection between a client an...
ThaiWeb CMS 2015Q3 - SQL Injection Web Vulnerability
Document Title: =============== ThaiWeb CMS 2015Q3 - SQL Injection Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1555 Release Date: ============= 2015-07-23 Vulnerability Laboratory ID VL-ID: ==================================== 1555...
ThaiWeb CMS 2015Q3 - SQL Injection Web Vulnerability
Document Title: =============== ThaiWeb CMS 2015Q3 - SQL Injection Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1555 Release Date: ============= 2015-07-23 Vulnerability Laboratory ID VL-ID: ==================================== 1555...
Q-shell - Quick Shell for Unix Administrator
q-shell is quick shell for remote login into Unix system, it use blowfish crypt algorithm to protect transport data from client to server, you can get two program: 'qsh' for client, and 'qshd' for server, those program can rename by any name with you prefer. Compile Just enter 'make' and it will...
IT-Grundschutz M4.022: Verhinderung des Vertraulichkeitsverlusts schutzbedürftiger Daten im Unix-System
IT-Grundschutz M4.022: Verhinderung des Vertraulichkeitsverlusts schutzbedürftiger Daten im Unix-System. Stand: 14. Ergänzungslieferung 14. EL. OpenVAS Vulnerability Test $Id: GSHBM4022.nasl 7883 2017-11-23 11:22:59Z emoss $ IT-Grundschutz, 14. EL, Maßnahme 4.022 Authors: Thomas Rotter Copyright:...
IT-Grundschutz M4.019: Restriktive Attributvergabe bei Unix-Systemdateien und -verzeichnissen
IT-Grundschutz M4.019: Restriktive Attributvergabe bei Unix-Systemdateien und -verzeichnissen. Stand: 14. Ergaenzungslieferung 14. EL. Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...
CVE-2013-6500
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
tnftp: arbitrary command execution
A malicious webserver can trick tnftp below 20141031 via HTTP redirects into executing arbitrary commands...
php: gd extension NUL byte injection in file names
It was found that PHP's gd extension did not properly handle file names with a null character. A remote attacker could possibly use this flaw to make a PHP application access unexpected files and bypass intended file system access restrictions...
AltaVista Search Intranet 2.0 b/2.3 A Directory Traversal Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/896/info The AltaVista Search engine sets up a webserver at port 9000 to listen for search queries. The main search function will accept a single '../' string in the query, providing access to all documents in the 'http'...
Intel Corporation NetStructure 7110 Undocumented Password Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/1182/info NetStructure formerly known as Ipivot Commerce Accelerator is a multi-site traffic director. This internet equipment is designed for businesses with multiple Web site locations, routing traffic to the best...
Bajie 0.78 Arbitrary Shell Command Execution Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/2389/info Requesting a specailly crafted URL containg arbitrary code, can be exected on a Unix system running Bajie Webserver. Any arbitrary commands appended to a malicious URL after the ';' will be executed as an...
CXF: Large invalid content could cause temporary space to fill
It was found that when a large invalid SOAP message was processed by Apache CXF, it could be saved to a temporary file in the /tmp directory. A remote attacker could send a specially crafted SOAP message that, when processed by an application using Apache CXF, would use an excessive amount of dis...
sb0x-project - A simple and Lightweight framework for Penetration testing
sb0x-project is A Lightweight Framework for PenTesting Written in Python Platforms: Linux BSD "Or Unix System" Download sb0x...
IT-Grundschutz M4.022: Verhinderung des Vertraulichkeitsverlusts schutzbedürftiger Daten im Unix-System
IT-Grundschutz M4.022: Verhinderung des Vertraulichkeitsverlusts schutzbedürftiger Daten im Unix-System. ACHTUNG: Dieser Test wird nicht mehr unterstützt. Er wurde ersetzt durch den entsprechenden Test der nun permanent and die aktuelle EL angepasst wird: OID 1.3.6.1.4.1.25623.1.0.94193 Stand: 13...