WS: Incomplete fix for CVE-2013-2133

It was found that the fix for CVE-2013-2133 was incomplete: the JAX-WS handlers were being executed for outbound messages even when authorization had failed. A remote attacker who is authorized to access the EJB class, could invoke a JAX-WS handler which they were not authorized to invoke...

DEBIAN-CVE-2012-4542

block/scsiioctl.c in the Linux kernel through 3.8 does not properly consider the SCSI device class during authorization of SCSI commands, which allows local users to bypass intended access restrictions via an SGIO ioctl call that leverages overlapping opcodes...

Sonexis ConferenceManager Information Disclosure

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Netragard Security Advisory - Sonexis ConferenceManager - 20120201 POSTING NOTICE If you intend to post this advisory on your web page please create a link back to the original Netragard advisory as the contents of the advisory may change. For more...

CVE-2005-0409

CitrusDB 0.3.6 and earlier does not verify authorization for the 1 importcc.php and 2 uploadcc.php, which allows remote attackers to upload credit card data and obtain sensitive information such as the pathnames for temporary files that store credit card data, and facilitates the exploitation of...