GLSA-201009-03 : sudo: Privilege Escalation

The remote host is affected by the vulnerability described in GLSA-201009-03 sudo: Privilege Escalation Multiple vulnerabilities have been reported in sudo: Evan Broder and Anders Kaseorg of Ksplice, Inc. reported that the sudo 'secure path' feature does not properly handle multiple PATH variable...

CVE-2010-3194

CVE-2010-3194 affects IBM DB2 via the DB2DART program. The vulnerability allows bypass of file access restrictions by overwriting files owned by the instance owner in DB2 9.1 before FP9, 9.5 before FP6, and 9.7 before FP2. The initial description notes bypass via unspecified vectors related to ov...

CVE-2010-2363: Undefined Security Weakness

The IPv6 Unicast Reverse Path Forwarding RPF implementation on the SEIL/X1, SEIL/X2, and SEIL/B1 routers with firmware 1.00 through 2.73, when strict mode is used, does not properly drop packets, which might allow remote attackers to bypass intended access restrictions via a spoofed IP address...

CVE-2010-3002: Undefined Security Weakness

Unspecified vulnerability in RealNetworks RealPlayer 11.0 through 11.1 allows attackers to bypass intended access restrictions on files via unknown vectors...

PT-2010-3305 · Cacti · Cacti

Name of the Vulnerable Software and Affected Versions: Cacti versions prior to 0.8.7f Description: The issue allows remote attackers to inject arbitrary web script or HTML via specific parameters to certain PHP files. The vulnerable parameters include hostname and description in host.php, as well...

CVE-2010-1386

page/Geolocation.cpp in WebCore in WebKit before r56188 and before 1.2.5 does not properly restrict access to the lastPosition function, which has unspecified impact and remote attack vectors, aka rdar problem 7746357...

CVE-2010-1386

page/Geolocation.cpp in WebCore in WebKit before r56188 and before 1.2.5 does not properly restrict access to the lastPosition function, which has unspecified impact and remote attack vectors, aka rdar problem 7746357...

CVE-2010-1386

The concrete details in connected documents show CVE-2010-1386 affects WebKit/WebCore: page/Geolocation.cpp did not properly restrict access to the lastPosition function, with unspecified impact and remote attack vectors. Root cause is insufficient access control in Geolocation.lastPosition. Affe...

CVE-2010-2242

Red Hat libvirt 0.2.0 through 0.8.2 creates iptables rules with improper mappings of privileged source ports, which allows guest OS users to bypass intended access restrictions by leveraging IP address and source-port values, as demonstrated by copying and deleting an NFS directory tree...

CVE-2010-2984: Undefined Security Weakness

Cisco Unified Wireless Network UWN Solution 7.x before 7.0.98.0 on 4404 series controllers does not properly implement the WEBAUTHREQD state, which allows remote attackers to bypass intended access restrictions via WLAN traffic, aka Bug ID CSCtb75305...

CVE-2010-2978: Undefined Security Weakness

Cisco Unified Wireless Network UWN Solution 7.x before 7.0.98.0 does not use an adequate message-digest algorithm for a self-signed certificate, which allows remote attackers to bypass intended access restrictions via vectors involving collisions, aka Bug ID CSCtd67660...

CVE-2010-2493: Undefined Security Weakness

The default configuration of the deployment descriptor aka web.xml in picketlink-sts.war in 1 the securitysaml quickstart, 2 the webserviceproxysecurity quickstart, 3 the web-console application, 4 the http-invoker application, 5 the gpd-deployer application, 6 the jbpm-console application, 7 the...

Bugzilla 3.7/3.7.1 Information Disclosure

According to its banner, the version of Bugzilla installed on the remote host fails to restrict access to bugs created with inbound email interface emailin.pl or with 'Bug.create' method in the WebServices interface to 'mandatory' or 'Default' groups. This could allow bug information to become...

Apache Tomcat 5.5.x < 5.5.30

According to its self-reported version number, the Apache Tomcat server listening on the remote host is 5.5.x prior to 5.5.30. It is, therefore, affected by multiple vulnerabilities : - An error in the access restriction on a 'ServletContext' attribute which holds the location of the work directo...

CVE-2010-2685

siteadmin/adduser.php in Customer Paradigm PageDirector CMS does not properly restrict access, which allows remote attackers to bypass intended restrictions and add administrative users via a direct request...

CVE-2010-2685

CVE-2010-2685 concerns Customer Paradigm PageDirector CMS. The issue arises from improper access control in siteadmin/adduser.php, allowing remote attackers to bypass restrictions and add administrative users via a direct request. The vulnerability is documented with a high severity (CVSS v2 base...

CVE-2010-2685

siteadmin/adduser.php in Customer Paradigm PageDirector CMS does not properly restrict access, which allows remote attackers to bypass intended restrictions and add administrative users via a direct request...

CVE-2009-4913: Undefined Security Weakness

The IPv6 implementation on Cisco Adaptive Security Appliances ASA 5580 series devices with software before 8.12 exposes IP services on the "far side of the box," which might allow remote attackers to bypass intended access restrictions via IPv6 packets, aka Bug ID CSCso58622...

CVE-2009-4912: Undefined Security Weakness

Cisco Adaptive Security Appliances ASA 5580 series devices with software before 8.12 complete an SSL handshake with an HTTPS client even if this client is unauthorized, which might allow remote attackers to bypass intended access restrictions via an HTTPS session, aka Bug ID CSCso10876...

CVE-2010-1641

The dogfs2setflags function in fs/gfs2/file.c in the Linux kernel before 2.6.34-git10 does not verify the ownership of a file, which allows local users to bypass intended access restrictions via a SETFLAGS ioctl request...