6955 matches found
Fedora 21 : php-horde-Horde-Auth-2.1.10-1.fc21 / php-horde-Horde-Core-2.20.6-1.fc21 / etc (2015-11287)
HordeForm 2.0.10 - jan SECURITY: Fixed XSS in form renderer. HordeIcalendar 2.1.1 - jan Fix generated VALARM TRIGGER attributes with empty duration Ralf Becker. HordeAuth 2.1.10 - jan SECURITY: Don't allow to login to LDAP with an emtpy password. HordeCore 2.20.6 - jan SECURITY: Don't allow to...
Fedora Update for php-horde-Horde-Auth FEDORA-2015-11261
The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Fedora Update for php-horde-Horde-Auth FEDORA-2015-11287
The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] Fedora 22 Update: php-horde-Horde-Auth-2.1.10-1.fc22
The HordeAuth package provides a common interface into the various backends for the Horde authentication system...
[SECURITY] Fedora 21 Update: php-horde-Horde-Auth-2.1.10-1.fc21
The HordeAuth package provides a common interface into the various backends for the Horde authentication system...
CVE-2015-4737
Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Pluggable Auth...
Design/Logic Flaw
Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Pluggable Auth...
CVE-2015-4737
Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Pluggable Auth...
Endian Firewall < 3.0.0 - OS Command Injection (Metasploit)
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit4 'Endian Firewall %q This module exploits an OS command injection vulnerability in a web-accessible CGI script used to change password...
CVE-2015-4345
CVE-2015-4345 affects Drupal's RESTful Web Services RESTWS module (Drupal 7.x). The vulnerability is in the Basic Auth submodule: RESTWS 7.x-1.x versions before 7.x-1.5 and 7.x-2.x before 7.x-2.3 cache pages for authenticated requests, which can lead to information disclosure of potentially sensi...
Nakid-CMS CSRF, Persistent XSS & LFI
Credits: John Page hyp3rlinx + Domains: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-NAKIDCMS0611.txt Vendor: ================================ http://kilrizzy.github.io/Nakid-CMS/ Product: ================================ kilrizzy-Nakid-CMS-f274624 Nakid CMS is...
Medusa - Speedy, Parallel and Modular Login Brute-Forcer
Medusa is intended to be a speedy, massively parallel, modular, login brute-forcer. The goal is to support as many services which allow remote authentication as possible. The author considers following items as some of the key features of this application: Thread-based parallel testing. Brute-for...
DEBIAN-CVE-2015-3200
modauth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as demonstrated by a string containing a NULL and new line character...
kernel: net: slab corruption from use after free on INIT collisions
A use-after-free flaw was found in the way the Linux kernel's SCTP implementation handled authentication key reference counting during INIT collisions. A remote attacker could use this flaw to crash the system or, potentially, escalate their privileges on the system...
Heroku API - Re Auth Session Token Bypass Vulnerability
Document Title: =============== Heroku API - Re Auth Session Token Bypass Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1336 View: https://www.youtube.com/watch?v=1WpWVVXVUSs Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1323 Release Date:...
Heroku API - Re Auth Session Token Bypass Vulnerability
Document Title: =============== Heroku API - Re Auth Session Token Bypass Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1336 View: https://www.youtube.com/watch?v=1WpWVVXVUSs Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1323 Release Date:...
CVE-2015-0218
Cross-site request forgery CSRF vulnerability in auth/shibboleth/logout.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger a logout...
Ruby Web Applications Vulnerability Scanner: Yasuo
Ruby Web Applications Vulnerability Scanner Yasuo is a ruby script that scans for vulnerable 3rd-party web applications While working on a network security assessment internal, external, redteam gigs etc., we often come across vulnerable 3rd-party web applications or web front-ends that allow us ...
CVE-2015-1868
The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authoritative Auth Server 3.2.x, 3.3.x before 3.3.2, and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service CPU consumption or crash via a request with a name that...
Design/Logic Flaw
The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authoritative Auth Server 3.2.x, 3.3.x before 3.3.2, and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service CPU consumption or crash via a request with a name that...