PT-2015-6400

Name of the Vulnerable Software and Affected Versions ceph-deploy versions prior to 1.5.25 Description The issue concerns the admin command in ceph-deploy, which uses world-readable permissions for the /etc/ceph/ceph.client.admin.keyring file. This allows local users to obtain sensitive informati...

P2PE in Higher Education--Reducing Applicable Controls

Point to Point Encryption P2PE is the hottest topic in the PCI world right now and many of our Higher Education clients are anxious to take advantage of the solutions available to them. However, with 2.0 not yet released, and then the subsequent release of the audit guidelines, there are many...

thermostat: world-readable configuration file containing credentials

It was discovered that the Thermostat web application stored database authentication credentials in a world-readable configuration file. A local user on a system running the Thermostat web application could use this flaw to access and modify monitored JVM data, or perform actions on connected JVM...

Maian Gallery 2.0 SQL Injection / Header Injection

| Title : Maian Gallery v2.0 Mulllti Vulnerability | Author : indoushka | email : [email protected] | Dork : Maian Gallery v2.0. Copyright © 2006-2015 Maian Script World. All Rights Reserved | Tested on: Win 8.1 fr pro / 21:58 15/05/2015 | Bug : Mulllti | Download :...

JBossSX/PicketBox: World readable audit.log file

It was found that the security auditing functionality provided by PicketBox and JBossSX, both security frameworks for Java applications, used a world-readable audit.log file to record sensitive information. A local user could possibly use this flaw to gain access to the sensitive information in t...

Race condition

Race condition in Lenovo System Update formerly ThinkVantage System Update before 5.06.0034 uses world-writable permissions for the update files directory, which allows local users to gain privileges by writing to an update file after the signature is validated...

PT-2015-5677

Name of the Vulnerable Software and Affected Versions Lenovo System Update versions prior to 5.06.0034 Description A race condition issue exists due to world-writable permissions for the update files directory. This allows local users to gain privileges by writing to an update file after the...

CVE-2015-2234: Concurrent Execution using Shared Resource with Improper Synchronization

Race condition in Lenovo System Update formerly ThinkVantage System Update before 5.06.0034 uses world-writable permissions for the update files directory, which allows local users to gain privileges by writing to an update file after the signature is validated...

Updated setup packages fix security vulnerabilities

Updated setup package fixes security issue An issue has been identified in Mageia 4's setup package where the /etc/shadow and /etc/gshadow files containing password hashes were created with incorrect permissions, making them world-readable mga14516. This update fixes this issue by enforcing that...

PT-2015-7895

Name of the Vulnerable Software and Affected Versions Mageia 4 versions affected versions not specified, but only new installations are affected Description A security issue was identified where the /etc/shadow and /etc/gshadow files containing password hashes were created with incorrect...

Fedora 21 : ceph-deploy-1.5.23-1.fc21 (2015-5981)

Update to ceph-deploy 1.5.23. This fixes CVE-2015-3010 keyring permissions are world readable in ceph. See upstream changelog for detailed changes. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to...

Important: Red Hat Security Advisory: Red Hat JBoss BRMS 6.1.0 update

Red Hat JBoss BRMS 6.1.0, which fixes multiple security issues, several bugs, and adds various enhancements, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores,...

JBossSX/PicketBox: World readable audit.log file

It was found that the security auditing functionality provided by PicketBox and JBossSX, both security frameworks for Java applications, used a world-readable audit.log file to record sensitive information. A local user could possibly use this flaw to gain access to the sensitive information in t...

dcwood.trade-world.org XSS vulnerability

Open Bug Bounty ID: OBB-58232 Description| Value ---|--- Affected Website:| dcwood.trade-world.org Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention...

[ MDVSA-2015:184 ] setup

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:184 http://www.mandriva.com/en/support/security/ Package : setup Date : March 30, 2015 Affected: Business Server 2.0 Problem Description: Updated setup package fixes security vulnerability: An issue has been...

worldpeoplesnews.com XSS vulnerability

Open Bug Bounty ID: OBB-58061 Description| Value ---|--- Affected Website:| worldpeoplesnews.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Design/Logic Flaw

The bsdinstall installer in FreeBSD 10.x before 10.1 p9, when configuring full disk encrypted ZFS, uses world-readable permissions for the GELI keyfile /boot/encryption.key, which allows local users to obtain sensitive key information by reading the file...

CVE-2015-1415

The bsdinstall installer in FreeBSD 10.x before 10.1 p9, when configuring full disk encrypted ZFS, uses world-readable permissions for the GELI keyfile /boot/encryption.key, which allows local users to obtain sensitive key information by reading the file...

CVE-2015-1415

The bsdinstall installer in FreeBSD 10.x before 10.1 p9, when configuring full disk encrypted ZFS, uses world-readable permissions for the GELI keyfile /boot/encryption.key, which allows local users to obtain sensitive key information by reading the file...

Updated setup package fixes security vulnerability

An issue has been identified in Mageia 4's setup package where the /etc/shadow and /etc/gshadow files containing password hashes were created with incorrect permissions, making them world-readable mga14516. This update fixes this issue by enforcing that those files are owned by the root user and...