Fedora 21 : bugzilla-4.4.10-1.fc21 (2015-15768)

Security fix for CVE-2015-4499 A security problem was found in supported versions of Bugzilla. Login names longer than 127 characters can be corrupted, which could lead to the creation of a user account with an unexpected email address. Bugzilla 4.4.10 fixes the issue for the 4.4 branch of...

LMD - Linux Malware Detect

Linux Malware Detect LMD is a malware scanner for Linux released under the GNU GPLv2 license, that is designed around the threats faced in shared hosted environments. It uses threat data from network edge intrusion detection systems to extract malware that is actively being used in attacks and...

Security advisory for Bugzilla 5.0, 4.4.9, and 4.2.14

Summary ======= Bugzilla is a Web-based bug-tracking system used by a large number of software projects. The following security issue has been discovered in Bugzilla: Login names longer than 127 characters can be corrupted, which could lead to the creation of a user account with an unexpected ema...

Samba Unicode Filename Buffer Overflow (CVE-2004-0882)

A vulnerability has been reported in the way Samba handles file information requests. A malformed request can trick the server into overflowing an incorrectly allocated buffer while generating a response. If certain conditions are met, an attacker can exploit this vulnerability to execute malicio...

CVE-2015-6003

Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X 1 user or 2 guest account...

Directory traversal

Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X 1 user or 2 guest account...

CVE-2015-6003

CVE-2015-6003 affects QNAP QTS (pre-4.1.4 build 0910 and pre-4.2.0 RC2 build 0910) where AFP enables a path traversal flaw allows remote attackers with OS X user or guest accounts to read/write arbitrary files. Root cause: directory traversal in AFP handling enables access due to insufficient pat...

kppw最新版2处sql注入。

简要描述： 二次注入。 详细说明： 1 /www/control/user/accountbasic.php ..... $arrMemberExts = kekezu::gettabledata "", "witkeymemberext", " type='sect' and uid= ".$gUid, "", "", "", "k" ; ........ if $sect foreach $sect as $k = $v if $arrMemberExts $k dbfactory::execute sprintf " update %switkeymemberext set...

Fedora 23 : bugzilla-4.4.10-1.fc23 (2015-15769)

Security fix for CVE-2015-4499 A security problem was found in supported versions of Bugzilla. Login names longer than 127 characters can be corrupted, which could lead to the creation of a user account with an unexpected email address. Bugzilla 4.4.10 fixes the issue for the 4.4 branch of...

Kaseya Virtual System Administrator Remote Privilege Escalation Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Kaseya Virtual System Administrator. Authentication is not required to exploit this vulnerability. The specific flaw exists within the forwarding service's handing of the setAccount.aspx page, whic...

F5 Networks BIG-IP : iCall privilege escalation vulnerability (K16728)

An authenticated user, with Resource Administrator role permissions, is able to use iCall scripts and associated handlers to create and modify user account properties. CVE-2015-3628 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from F5...

Amazon Linux AMI : pam (ALAS-2015-589)

It was discovered that the unixrunhelperbinary function of PAM's unixpam module could write to a blocking pipe, possibly causing the function to become unresponsive. An attacker able to supply large passwords to the unixpam module could use this flaw to enumerate valid user accounts, or cause a...

Medium: pam

Issue Overview: It was discovered that the unixrunhelperbinary function of PAM's unixpam module could write to a blocking pipe, possibly causing the function to become unresponsive. An attacker able to supply large passwords to the unixpam module could use this flaw to enumerate valid user...

Input validation

Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 improperly checks for a user account's read-only attribute, which allows remote authenticated users to execute arbitrary OS commands via crafted HTTP requests, as demonstrated by read or write operations on the Unified...

CVE-2015-4328

Cisco TelePresence Video Communication Server VCS Expressway X8.5.2 improperly checks for a user account's read-only attribute, which allows remote authenticated users to execute arbitrary OS commands via crafted HTTP requests, as demonstrated by read or write operations on the Unified...

CVE-2015-5515

The Views Bulk Operations VBO module 6.x-1.x and 7.x-3.x before 7.x-3.3 for Drupal, when the bulk operation for changing Roles is enabled, allows remote authenticated users to edit user accounts and add arbitrary roles to the accounts by leveraging access to a user account listing view with VBO...

Design/Logic Flaw

Unspecified vulnerability in the Hyperion Common Security component in Oracle Hyperion 11.1.2.2, 11.1.2.3, and 11.1.2.4 allows remote authenticated users to affect availability via unknown vectors related to User Account Update...

Zendesk: Security Missconfiguration in Autologin

Here I am addressing Critical misconfiguration in autologin feature 1. Open the link in the browser https://dashboard.zopim.com/home and enter your username and password and don't tick select the option Always sign in automatically and login 2. now logout from your account 3. now you logged out...

CVE-2015-4773

Technical details about CVE-2015-4773 are not publicly available in the provided documents. The connected records mention Oracle Hyperion and generic impact but do not specify affected versions, root cause, or fixes. Monitor for updates.

Cross site scripting

Cross-site scripting XSS vulnerability in the Users module in Orchard 1.7.3 through 1.8.2 and 1.9.x before 1.9.1 allows remote attackers to inject arbitrary web script or HTML via the username when creating a new user account, which is not properly handled when deleting an account...