Authentication flaw

The Gentoo Nullmailer package before 1.11-r2 uses world-readable permissions for /etc/nullmailer/remotes, which allows local users to obtain SMTP authentication credentials by reading the file...

CVE-2013-4223

The Gentoo Nullmailer package before 1.11-r2 uses world-readable permissions for /etc/nullmailer/remotes, which allows local users to obtain SMTP authentication credentials by reading the file...

Threatpost News Wrap, May 23, 2014

Dennis Fisher and Mike Mimoso discuss the US indictments of Chinese army officers for hacking, the Blackshades malware arrests, the new IE 8 zero day and the US prospects in the World Cup. Download: digitalunderground154.mp3 Music by Chris Gonsalves...

PHPSay World v1.0 user.php SQL注入漏洞

user.php id参数未经过过滤，导致SQL注入漏洞。 0 v1.0 更新到最新版本...

PT-2014-2765

Name of the Vulnerable Software and Affected Versions Nullmailer versions prior to 1.11-r2 Description The issue allows local users to obtain SMTP authentication credentials by reading the /etc/nullmailer/remotes file due to world-readable permissions. Recommendations For versions prior to 1.11-r...

iTunes < 11.2.1 User Directory Insecure Permissions Vulnerability (Mac OS X)

The version of iTunes installed on the remote Mac OS X host is older than 11.2.1. It is, therefore, affected by an insecure permissions vulnerability. An insecure permissions vulnerability exists where the '/Users' and '/Users/Shared' directories have world-writable permissions. This could allow ...

CVE-2014-1347

Apple iTunes before 11.2.1 on OS X sets world-writable permissions for /Users and /Users/Shared during reboots, which allows local users to modify files, and consequently obtain access to arbitrary user accounts, via standard filesystem operations...

Code injection

Apple iTunes before 11.2.1 on OS X sets world-writable permissions for /Users and /Users/Shared during reboots, which allows local users to modify files, and consequently obtain access to arbitrary user accounts, via standard filesystem operations...

CVE-2014-1347

Apple iTunes before 11.2.1 on OS X sets world-writable permissions for /Users and /Users/Shared during reboots, which allows local users to modify files, and consequently obtain access to arbitrary user accounts, via standard filesystem operations...

CVE-2014-1347: Undefined Security Weakness

Apple iTunes before 11.2.1 on OS X sets world-writable permissions for /Users and /Users/Shared during reboots, which allows local users to modify files, and consequently obtain access to arbitrary user accounts, via standard filesystem operations...

ldns weak permissions

ldns-keygen can create world-readable private key file...

[oss-security] CVE request: Pyplate multiple vulnerabilities

Hello list, My friend Teemu V. "requested" security audit for Pyplate. While quickly checking quality of this software I noticed following issues. This is not a full security audit as I don't have much free time. Tested version: v0.08 still beta Vendor notification: 2014-05-13 Issue 1. Installati...

CVE-2013-4455

Katello Installer before 0.0.18 uses world-readable permissions for /etc/pki/tls/private/katello-node.key when deploying a child Pulp node, which allows local users to obtain the private key by reading the file...

CVE-2013-4455

Katello Installer before 0.0.18 uses world-readable permissions for /etc/pki/tls/private/katello-node.key when deploying a child Pulp node, which allows local users to obtain the private key by reading the file...

CVE-2013-4455: Undefined Security Weakness

Katello Installer before 0.0.18 uses world-readable permissions for /etc/pki/tls/private/katello-node.key when deploying a child Pulp node, which allows local users to obtain the private key by reading the file...

Mandriva Linux Security Advisory : ldns (MDVSA-2014:085)

Updated ldns packages fix security vulnerability : ldns-keygen creates a private key with the default permissions according to the users umask, which in most cases will cause the private key to be world-readable CVE-2014-3209. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

DEBIAN-CVE-2013-4577

A certain Debian patch for GNU GRUB uses world-readable permissions for grub.cfg, which allows local users to obtain password hashes, as demonstrated by reading the passwordpbkdf2 directive in the file...

CVE-2013-4577

A certain Debian patch for GNU GRUB uses world-readable permissions for grub.cfg, which allows local users to obtain password hashes, as demonstrated by reading the passwordpbkdf2 directive in the file...

Default credentials

A certain Debian patch for GNU GRUB uses world-readable permissions for grub.cfg, which allows local users to obtain password hashes, as demonstrated by reading the passwordpbkdf2 directive in the file...

CVE-2013-4577

A certain Debian patch for GNU GRUB uses world-readable permissions for grub.cfg, which allows local users to obtain password hashes, as demonstrated by reading the passwordpbkdf2 directive in the file...