7226 matches found
CVE-2008-3655
Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not properly restrict access to critical variables and methods at various safe levels, which allows context-dependent attackers to bypass intended access restrictions via 1 untracevar, 2...
Design/Logic Flaw
Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not properly restrict access to critical variables and methods at various safe levels, which allows context-dependent attackers to bypass intended access restrictions via 1 untracevar, 2...
CVE-2008-3503
RSSFromParent in Plain Black WebGUI before 7.5.13 does not restrict view access to Collaboration System CS RSS feeds, which allows remote attackers to obtain sensitive information CS data...
CVE-2008-1376
CVE-2008-1376 affects the nfs-utils package prior to 1.0.9-35z.el5_2 on Red Hat Enterprise Linux 5, where a build script omission left TCP wrappers support out of the box. This omission could allow remote attackers to bypass intended access restrictions. Multiple connected advisories confirm the ...
CVE-2008-3424
The CVE-2008-3424 vulnerability affects Condor up to version 7.0.4, arising from improper handling of wildcards in ALLOW_WRITE, DENY_WRITE, HOSTALLOW_WRITE, and HOSTDENY_WRITE in authorization policy lists. This could allow authenticated remote users to bypass access restrictions and submit jobs,...
PT-2008-4695 · Emc · Emc Dantz Retrospect Backup Client
Name of the Vulnerable Software and Affected Versions: EMC Dantz Retrospect Backup Client version 7.5.116 Description: The issue allows remote attackers to obtain sensitive information via a crafted packet, as the password hash is sent in cleartext. Recommendations: For version 7.5.116, consider...
MyBlog 0.9.8 - Multiple Remote Information Disclosure Vulnerabilities
source: https://www.securityfocus.com/bid/30310/info MyBlog is prone to multiple information-disclosure vulnerabilities because the application fails to properly restrict access to sensitive files. An unprivileged attacker may exploit these issues to obtain sensitive information. MyBlog 0.9.8 is...
PHP (php-exec-dir) Patch Command Access Restriction Bypass
No description provided by source. ?php $blah = & /bin/ps aux; echo nl2br$blah; ? ?php $blah = | /bin/ps aux; echo nl2br$blah; ?...
F5 FirePass 1200 SNMP daemon DoS
F5 FirePass 1200 SNMP daemon DoS Product: F5 FirePass 1200 http://www.f5.com/products/firepass/ The F5 FirePass 1200 SSL VPN appliance contains a denial-of-service vulnerability in the SNMP daemon. Traversing walking OID branch hrSWInstalled in HOST-RESOURCES-MIB OID 1.3.6.1.2.1.25.6 will cause t...
Benja CMS 0.1 - adminadmin_new_submenu.php Cross-Site Scripting
Benja CMS 0.1 - adminadminnewsubmenu.php Cross-Site Scripting source: https://www.securityfocus.com/bid/29884/info The 'benja CMS' program is prone to multiple vulnerabilities because it fails to adequately validate input and restrict access. These issues include three cross-site scripting issues...
PT-2008-3012 · Microsoft · Windows Xp +1
Name of the Vulnerable Software and Affected Versions: Microsoft Windows XP versions SP2 through SP3 Microsoft Windows Server 2003 versions SP1 through SP2 Description: The issue arises from improper validation of the option length field in Pragmatic General Multicast PGM packets, allowing remote...
QuickerSite 1.8.5 - Multiple Vulnerabilities
www.BugReport.ir AmnPardaz Security Research Team Title: QuickerSite Multiple Vulnerabilities Vendor: www.quickersite.com Vulnerable Version: 1.8.5 Exploit: Available Impact: High Fix: N/A Original Advisory: http://bugreport.ir/index.php?/39 1. Description: QuickerSite is a Content Management...
QuickerSite 1.8.5 - Multiple Vulnerabilities
QuickerSite 1.8.5 - Multiple Vulnerabilities www.BugReport.ir AmnPardaz Security Research Team Title: QuickerSite Multiple Vulnerabilities Vendor: www.quickersite.com Vulnerable Version: 1.8.5 Exploit: Available Impact: High Fix: N/A Original Advisory: http://bugreport.ir/index.php?/39 1...
CVE-2008-2420
CVE-2008-2420 affects stunnel’s OCSP search functionality (pre-4.24) where certificate revocation lists (CRLs) are not properly checked. This can let a remote attacker bypass access restrictions by presenting a revoked certificate, as described in multiple advisories; Mandriva notes updated packa...
CVE-2008-0167
CVE-2008-0167 affects GForge 4.5.14 (Debian: etch) where scripts open configuration files in write mode, truncating them before writing new data, potentially allowing local attackers to overwrite files or bypass access restrictions. Debian DSA-1577-1 confirms the issue and provides fixed package ...
CVE-2008-2146
wp-includes/vars.php in Wordpress before 2.2.3 does not properly extract the current path from the PATHINFO $PHPSELF, which allows remote attackers to bypass intended access restrictions for certain pages...
CVE-2008-2146
CVE-2008-2146 affects WordPress prior to 2.2.3, where wp-includes/vars.php fails to correctly extract the current path from PATH_INFO ($PHP_SELF). This allows remote attackers to bypass page access restrictions. The root cause is a path-determination flaw in WordPress’ request handling. A fix is ...
CVE-2008-2138
Oracle Application Server Portal 10g is affected by an authentication bypass vulnerability (CVE-2008-2138) where an unauthenticated attacker can read files under /dav_portal/portal by sending a crafted GET request containing a trailing %0A and then reusing the session ID generated from that reque...
Design/Logic Flaw
Acidcat CMS 3.4.1 does not properly restrict access to 1 defaultmailaspemail.asp, 2 defaultmailcdosys.asp or 3 defaultmailjmail.asp, which allows remote attackers to bypass restrictions and relay email messages with modified From, FromName, and To fields...