DEBIAN-CVE-2015-8746

fs/nfs/nfs4proc.c in the NFS client in the Linux kernel before 4.2.2 does not properly initialize memory for migration recovery operations, which allows remote NFS servers to cause a denial of service NULL pointer dereference and panic via crafted network traffic...

Debian Security Advisory DSA 3442-1 (isc-dhcp - security update)

It was discovered that a maliciously crafted packet can crash any of the isc-dhcp applications. This includes the DHCP client, relay, and server application. Only IPv4 setups are affected. OpenVAS Vulnerability Test $Id: deb3442.nasl 6608 2017-07-07 12:05:05Z cfischer $ Auto-generated from adviso...

Verification Bypass

Overview Versions 4.2.1 and earlier of jsonwebtoken are affected by a verification bypass vulnerability. This is a result of weak validation of the JWT algorithm type, occuring when an attacker is allowed to arbitrarily specify the JWT algorithm. Recommendation Update to version 4.2.2 or later...

vBulletin x.x.x rce "0day"

Not really a 0day since it's fixed in some versions, but still an exploit that doesn't seem to be "that" public. Please note, I didn't find this. vBulletin's memcache setting is vulnerable in certain versionsall before 4.2.2 to an RCE. vBulletin seem to have refused to classify it as a...

DEBIAN-CVE-2015-3429

Cross-site scripting XSS vulnerability in example.html in Genericons before 3.3.1, as used in WordPress before 4.2.2, allows remote attackers to inject arbitrary web script or HTML via a fragment identifier...

CVE-2014-2021

Cross-site scripting XSS vulnerability in admincp/apilog.php in vBulletin 4.2.2 and earlier, and 5.0.x through 5.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted XMLRPC API request, as demonstrated using the client name...

Android phone call permission bypass Vulnerability(CVE-2 0 1 3-6 2 7 2)Analysis-vulnerability warning-the black bar safety net

Author: Gong wide The 1. CVE-2 0 1 3-6 2 7 2 vulnerability background CVE-2 0 1 3-6 2 7 2 is an Android platform phone calls permission bypass vulnerability. The vulnerability is actually Berlin's security research organisation curesec in 2 0 1 3 the end of the year discovered and privately...

socialengine 4.2.2 - Multiple Vulnerabilities

No description provided by source. Social Engine 4.2.2 Multiples Vulnerabilities Earlier versions are also possibly vulnerable. INFORMATION Product: Social Engine 4.2.2 Remote-Exploit: yes Vendor-URL: http://www.socialengine.net/ Discovered by: Tiago Natel de Moura aka i4k Discovered at: 10/04/20...

TYPO3 File Backend Cross Site Scripting Vulnerability

TYPO3 is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:typo3:typo3";...

Squiz Matrix 4 - 'colour_picker.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/48118/info Squiz Matrix is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the conte...

Debian DSA-1432-1 : link-grammar - buffer overflow

Alin Rad Pop discovered that link-grammar, Carnegie Mellon University's link grammar parser for English, performed insufficient validation within its tokenizer, which could allow a malicious input file to execute arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

MyNews 4.2.2 - 'Week_Events.php' Remote File Inclusion

source: https://www.securityfocus.com/bid/23398/info MyNews is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to include arbitrary remote files containing malicious PHP code and execute it in the context o...

PHP Mail Function Header Spoofing Vulnerability

The remote host is running a version of PHP = 4.2.2. The mail function does not properly sanitize user input. This allows users to forge email to make it look like it is coming from a different source other than the server. Users can exploit this even if SAFEMODE is enabled. OpenVAS Vulnerability...

PT-2005-2627 · Woppoware · Woppoware Postmaster

Name of the Vulnerable Software and Affected Versions: Woppoware PostMaster version 4.2.2 Description: The web mail service in the affected software generates different error messages depending on whether a user exists or not. This allows remote attackers to determine valid usernames...

security flaw

The phphandleiff function in image.c for PHP 4.2.2, 4.3.9, 4.3.10 and 5.0.3, as reachable by the getimagesize PHP function, allows remote attackers to cause a denial of service infinite loop via a -8 size value...