CVE-2014-2195

CVE-2014-2195 affects Cisco AsyncOS on Email Security Appliance (ESA) and Content Security Management Appliance (SMA). When Active Directory is enabled, the software does not properly handle group names, enabling a remote attacker to gain role privileges by exploiting group-name similarity (Bug I...

CVE-2013-4432

Mahara before 1.5.13, 1.6.x before 1.6.8, and 1.7.x before 1.7.4 does not properly restrict access to folders, which allows remote authenticated users to read arbitrary folders 1 by leveraging an active folder tab loaded before permissions were removed or 2 via the folder parameter to...

Cogent DataHub Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Cogent DataHub. Authentication is not required to exploit this vulnerability. The specific flaw exists within the GetPermissions.asp component of the web server. This active server page is vulnerab...

MS14-025: Vulnerability in Group Policy Preferences Could Allow Elevation of Privilege (2962486)

The remote Windows host is potentially affected by a vulnerability in the way that Active Directory distributes passwords that are configured using Group Policy preferences. This could allow a remote attacker to retrieve and decrypt passwords stored with Group Policy preferences. The following...

PT-2014-1013 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions prior to the patchday that contains the fix for the vulnerability Description: The Group Policy implementation in Microsoft Windows does not properly handle distribution of passwords, which allows remote authenticat...

Microsoft Group Policy Preferences Privilege Elevation Vulnerability (2962486)

This host is missing an important security update according to Microsoft Bulletin MS14-025. OpenVAS Vulnerability Test $Id: gbms14-025.nasl 6692 2017-07-12 09:57:43Z teissa $ Microsoft Group Policy Preferences Privilege Elevation Vulnerability 2962486 Authors: Veerendra GG Copyright: Copyright C...

Microsoft Group Policy Preferences Privilege Elevation Vulnerability (2962486)

This host is missing an important security update according to Microsoft Bulletin MS14-025. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Microsoft Active Directory CVE-2014-1812 Privilege Escalation Vulnerability

Description Microsoft Active Directory is prone to a privilege-escalation vulnerability. An authenticated attacker can exploit this issue to gain access to services with escalated privileges. Technologies Affected Avaya Aura Conferencing 6.0 Avaya Aura Conferencing 6.0 Standard Avaya Aura...

MS14-025: Vulnerability in Group Policy Preferences could allow elevation of privilege: May 13, 2014

Resolves a vulnerability in Windows that could allow elevation of privilege if Active Directory Group Policy Preferences extensions are used to distribute passwords across the domain. This practice could allow an attacker to retrieve and decrypt the password that is stored together with Group...

VulnCheck KEV: CVE-2014-1812

Microsoft Windows Active Directory contains a privilege escalation vulnerability due to the way it distributes passwords that are configured using Group Policy preferences. An authenticated attacker who successfully exploits the vulnerability could decrypt the passwords and use them to elevate...

Lighttpd < 1.4.35 Multiple Vulnerabilities - Active Check

Lighttpd is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:lighttpd:lighttpd"; ifdescription...

PT-2014-2868 · D Link · D-Link Dir-505L Shareport Mobile Companion +1

Name of the Vulnerable Software and Affected Versions: D-Link DIR-505L SharePort Mobile Companion version 1.01 D-Link DIR-826L Wireless N600 Cloud Router version 1.02 Description: The issue allows remote attackers to bypass authentication via a direct request when an authorized session is active...

[oss-security] Unsafe Query Risk in Active Record

This advisory concerns a security risk in all supported versions of Active Record. There is no patch to apply for this issue. Due to the query API that Active Record supports, there is a risk of unsafe query generation in two scenarios. Databases with a table that contains a column with the same...

While bypassing Baidu heuristic engine and active Defense-vulnerability warning-the black bar safety net

While bypassing Baidu heuristic engine and the Proactive Defense heuristic Avira and active defense in the two different logic levels for system protection, but rely on the malware's malicious behavior to be killing, if malicious behavior is scattered in different logic levels, will make these tw...

C2FO: All Active user sessions should be destroyed when user change his password!

Hello, There is an user sessions issue on your application that should be fixed. Proof of Concept ------------------------ Suppose, you have an account on C2FO app.c2fo.com. Somehow an attacker manage to get your password and logged in your account.. after knowing that your ID has been compromise...

RelateIQ: Old Sessions remain valid after the password change.

Industry Standard Procedure When the password is changed or email address has been updated for any particular account,all the sessions which were active with the old password/email should be destroyed. Reason If somehow anybody hacked into your account and you understand that someone has trespass...

New Zero-Day Vulnerability CVE-2014-1776 Affects all Versions of Internet Explorer Browser

Microsoft confirmed a new Zero Day critical vulnerability in its browser Internet Explorer. Flaw affects all versions of Internet Explorer, starting with IE version 6 and including IE version 11. In a Security Advisory 2963983 released yesterday, Microsoft acknowledges a zero-day Internet Explore...

MGASA-2014-0191 Updated ruby-rails and associated packages fix multiple vulnerabilities

Updated ruby-activerecord and ruby-actionpack packages fix security vulnerabilities: There is a data injection vulnerability in Active Record. Specially crafted strings can be used to save data in PostgreSQL array columns that may not be intended CVE-2014-0080. There is an XSS vulnerability in th...

JetError -1404, JET_errIndexNotFound, No such index

Challenge When trying to open a database in VEAD, you receive the following error message: JetError -1404, JETerrIndexNotFound, No such index Solution Log in to the domain controller from which you are trying to restore the database, run cmd as Administrator and run the following: 1. Type regsvr3...

PT-2014-2059 · Cisco · Cisco Asa

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software affected versions not specified Description: The issue is a cross-site scripting XSS vulnerability in the WebVPN login page of Cisco Adaptive Security Appliance ASA Software. This vulnerability...