CVE-2014-8651

The KDE Clock KCM policykit helper in kde-workspace before 4.11.14 and plasma-desktop before 5.1.1 allows local users to gain privileges via a crafted ntpUtility ntp utility name argument...

kde-workspace -- privilege escalation

David Edmundson reports: KDE workspace configuration module for setting the date and time has a helper program which runs as root for performing actions. This is secured with polkit. This helper takes the name of the ntp utility to run as an argument. This allows a hacker to run any arbitrary...

VMware Workspace Portal Multiple Bash Shell Vulnerabilities (VMSA-2014-0010) (Shellshock)

The version of VMware Workspace Portal formerly known as VMware Horizon Workspace installed on the remote host is missing package updates. It is, therefore, affected by the following vulnerabilities in the Bash shell : - A command injection vulnerability exists in GNU Bash known as Shellshock,...

openSUSE Security Update : kdelibs4 (openSUSE-SU-2014:0981-1)

KDE4 Libraries and Workspace received a security fix to fix a race condition in DBUS/Polkit authorization, where local attackers could potentially call root KDE services without proper authenticiation. CVE-2014-5033 Additionaly a interlaced GIF display bug in KHTML was fixed. kde330148 This updat...

CVE-2014-4232

CVE-2014-4232 concerns an unspecified vulnerability in Oracle Secure Global Desktop (SGD) within Oracle Virtualization versions 4.63, 4.71, 5.0, and 5.1. The flaw affects SGD’s Workspace Web Application and allows remote attackers to impact integrity via unknown vectors; this is described as a se...

CVE-2014-4232

Unspecified vulnerability in the Oracle Secure Global Desktop SGD component in Oracle Virtualization 4.63, 4.71, 5.0, and 5.1 allows remote attackers to affect integrity via unknown vectors related to Workspace Web Application, a different vulnerability than CVE-2014-2463...

Oracle Secure Global Desktop Multiple Vulnerabilities (July 2014 CPU)

The remote host has a version of Oracle Secure Global Desktop that is version 4.63, 4.71, 5.0 or 5.1. It is, therefore, affected by the following vulnerabilities : - Apache Tomcat does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrec...

SuSE 11.3 Security Update : kdebase4-workspace (SAT Patch Number 9467)

This kdebase4-workspace update fixes two security issues : - NULL pointer dereference in KDM and KCheckPass. CVE-2013-4132 - Memory leak that could lead to a denial of service. CVE-2013-4133 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugi...

Constructr CMS 3.03 Arbitrary File Upload

No description provided by source. !/usr/bin/env perl Constructr CMS 3.03 Arbitrary File Upload Author: plucky Email: [email protected] Vulnerable Page: /constructr/backend/media.php line App Download: http://sourceforge.net/projects/constructr/ Date: 23/03/2011 THX TO: yawn, shrod, h473 and...

Symantec Workspace Streaming Arbitrary File Upload

No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rexml/document' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include...

Symantec Workspace Virtualization 6.4.1895.0 - Local Kernel Mode Privilege Escalation

No description provided by source. Symantec Workspace Virtualization 6.4.1895.0 Local Kernel Mode Privilege Escalation Exploit Date: 2013-7-17 Author : MJ0011 Version: Symantec Workspace Virtualization 6.4.1895.0 Tested on: Windows XP SP3 DETAILS: In fslx.sys 's hook function of NtQueryValueKey ,...

openSUSE Security Update : kdebase4-workspace (openSUSE-SU-2013:1291-1)

kdebase4-workspace received fixes for : - KDM: a potential crash in crypt was fixed bnc829857, CVE-2013-4132 - Fixes plasma systemtray memory leak with legacy icons kde314919, bnc817932, bnc829857, CVE-2013-4133 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

openSUSE Security Update : kdebase4-workspace (openSUSE-SU-2013:1253-1)

Added changesetra2bab28a.diff from upstream 4.11 branch, fixes kde321576 - Added kdm-kcheckpass-Check-for-NULL-return-from-crypt-3-an.pat ch, bnc829857, CVE-2013-4132 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

Symantec Workspace Streaming XML-RPC Arbitrary File Upload (CVE-2014-1649)

An arbitrary file upload vulnerability exists in Symantec Workspace. The vulnerability is due to lack of access control validation in the functionality used to process XMLRPC requests. A remote unauthenticated attacker could exploit this vulnerability by a sending specially crafted XML-RPC reques...

Symantec Workspace Streaming - Arbitrary File Upload (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rexml/document' class Metasploit3 'Symantec Workspace Streaming Arbitrary File Upload', 'Description' = %q This module exploits a code executio...

Symantec Workspace Streaming Server Detection

Binary data symantecworkspacestreaminginstalled.nbin...

Symantec Workspace Streaming < 7.5 SP1 XMLRPC Request Remote Code Execution (SYM14-009)

The version of Symantec Workspace Streaming server formerly known as Altiris Streaming System installed on the remote Windows host is affected by a remote code execution vulnerability. This issue is caused by improper validation of HTTPS XMLRPC requests by the Management Agent asagent.exe...

Symantec Workspace Streaming Arbitrary File Upload Exploit

This Metasploit module exploits a code execution flaw in Symantec Workspace Streaming. The vulnerability exists in the ManagementAgentServer.putFile XMLRPC call exposed by the asagent.exe service, which allows for uploading arbitrary files under the server root. This Metasploit module abuses the...

Symantec Workspace Streaming Arbitrary File Upload

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rexml/document' class Metasploit3 'Symantec Workspace Streaming Arbitrary File Upload', 'Description' = %q This module exploits a code executio...

Design/Logic Flaw

The server in Symantec Workspace Streaming SWS before 7.5.0.749 allows remote attackers to access files and functionality by sending a crafted XMLRPC request over HTTPS...