D-Link DIR-615 - Multiple Buffer Overflow Vulnerabilities

Advisory Information Title: Dlink DIR-615 Authenticated Buffer overflow in Ping and Send email functionality Vendors contacted: William Brown , Patrick Cline [email protected] CVE: None Note: All these security issues have been discussed with the vendor and vendor indicated that they...

Debian DSA-3382-1 : phpmyadmin - security update

Several issues have been fixed in phpMyAdmin, the web administration tool for MySQL. - CVE-2014-8958 Wheezy only Multiple cross-site scripting XSS vulnerabilities. - CVE-2014-9218 Wheezy only Denial of service resource consumption via a long password. - CVE-2015-2206 Risk of BREACH attack due to...

Debian DLA-336-1 : phpmyadmin security update

Several issues have been fixed in phpMyAdmin, the web administration tool for MySQL. CVE-2014-8958 Multiple cross-site scripting XSS vulnerabilities. CVE-2014-9218 Denial of service resource consumption via a long password. CVE-2015-2206 Risk of BREACH attack due to reflected parameter...

[SECURITY] [DLA 336-1] phpmyadmin security update

Package : phpmyadmin Version : 4:3.3.7-9 CVE ID : CVE-2014-8958 CVE-2014-9218 CVE-2015-2206 CVE-2015-3902 Several issues have been fixed in phpMyAdmin, the web administration tool for MySQL. CVE-2014-8958 Multiple cross-site scripting XSS vulnerabilities. CVE-2014-9218 Denial of service resource...

[SECURITY] [DSA 3382-1] phpmyadmin security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3382-1 [email protected] https://www.debian.org/security/ Thijs Kinkhorst October 28, 2015 https://www.debian.org/security/faq -...

Debian Security Advisory DSA 3382-1 (phpmyadmin - security update)

Several issues have been fixed in phpMyAdmin, the web administration tool for MySQL. CVE-2014-8958 Wheezy only Multiple cross-site scripting XSS vulnerabilities. CVE-2014-9218 Wheezy only Denial of service resource consumption via a long password. CVE-2015-2206 Risk of BREACH attack due to...

DLA-336-1 phpmyadmin - security update

Bulletin has no description...

XSRF check failure when trying to add a logo to a topic

h3. Steps to reproduce Create a topic in Confluence Questions. Select an image as a logo. Click Done. h3. Expected results The topic is created with the chosen logo. h3. Actual results The topic is created, but with the default tag logo. h3. Notes The same thing occurs when trying to add a logo t...

XSRF check failure when trying to add a logo to a topic

h3. Steps to reproduce Create a topic in Confluence Questions. Select an image as a logo. Click Done. h3. Expected results The topic is created with the chosen logo. h3. Actual results The topic is created, but with the default tag logo. h3. Notes The same thing occurs when trying to add a logo t...

Debian: Security Advisory (DSA-3382-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OrientDB < 2.0.15 / 2.1.1 XSRF

The version of OrientDB running on the remote host is prior to 2.0.15 or 2.1.1. It is, therefore, affected by a cross-site request forgery XSRF vulnerability due to the server allowing JSONP callbacks within the REST API. An unauthenticated, remote attacker can exploit this, via a crafted web pag...

Safari < 6.2.7 / 7.1.7 / 8.0.7 Multiple Vulnerabilities

Binary data 8950.prm...

Auto-Exchanger 5.1.0 - Cross-Site Request Forgery

Auto-Exchanger 5.1.0 - Cross-Site Request Forgery INPUT type='hidden' maxLength=60 size=30 name="mail" id="mail" va...

Autoexchanger 5.1.0 Cross Site Request Forgery

Exploit Title: Auto-exchanger version 5.1.0 Xsrf Date: 2015/06/05 Exploit Author: Aryan Bayaninejad Linkedin : https://www.linkedin.com/profile/view?id=276969082 Vendor Homepage: www.auto-exchanger.com Version: Version 5.1.0 Demo : www.farhadexchange.com CVE : CVE-2015-6827...

Siemens SIMATIC S7-1200 PLC < 4.1.3 XSRF

Binary data scadasiemenssimatics71200plcSSA-134003.nbin...

Joomla! 3.x < 3.4.2 Multiple Vulnerabilities

According to its self-reported version number, the Joomla! installation running on the remote web server is 3.x prior to 3.4.2. It is, therefore, affected by multiple vulnerabilities : - A cross-site request forgery XSRF vulnerability exists due to a failure to require explicit confirmation or a...

CollabNet Subversion Edge insecure password change

Vuln Title: The CollabNet Subversion Edge management frontend does not require current password upon password change Date: 28.06.2015 Author: otr Software Link: https://www.open.collab.net/downloads/svnedge Vendor: CollabNet Version: 4.0.11 Tested on: Fedora Linux Type: Insecure password change...

CollabNet Subversion Edge missing XSRF protection

Vuln Title: The CollabNet Subversion Edge Management Frontend does not implement XSRF protection tokens Date: 28.06.2015 Author: otr Software Link: https://www.open.collab.net/downloads/svnedge Vendor: CollabNet Version: 4.0.11 Tested on: Fedora Linux Type: XSRF Risk: Low Status: public/fixed Fix...

Updated python-tornado package fixes security vulnerability

Security fixes CVE-2014-9720 The XSRF token is now encoded with a random mask on each request. This makes it safe to include in compressed pages without being vulnerable to the BREACH attack. This applies to most applications that use both the xsrfcookies and gzip options or have gzip applied by ...

MGASA-2015-0251 Updated python-tornado package fixes security vulnerability

Security fixes CVE-2014-9720 The XSRF token is now encoded with a random mask on each request. This makes it safe to include in compressed pages without being vulnerable to the BREACH attack. This applies to most applications that use both the xsrfcookies and gzip options or have gzip applied by ...