OpenStack cinder privilege escalation

Authorized user can access any files...

openSUSE Security Update : mysql-connector-java (openSUSE-2015-389)

mysql-connector-java was updated to 5.1.35 to fix one security issue and a number of bugs. The following vulnerability was fixed : - CVE-2015-2575: Difficult to exploit vulnerability allows successful authenticated network attacks via multiple protocols. Successful attack of this vulnerability ca...

xorg-x11-server: information leak in the XkbSetGeometry request of X servers

A buffer overflow flaw was found in the way the X.Org server handled XkbGetGeometry requests. A malicious, authorized client could use this flaw to disclose portions of the X.Org server memory, or cause the X.Org server to crash using a specially crafted XkbGetGeometry request...

DEBIAN-CVE-2015-1558

Asterisk Open Source 12.x before 12.8.1 and 13.x before 13.1.1, when using the PJSIP channel driver, does not properly reclaim RTP ports, which allows remote authenticated users to cause a denial of service file descriptor consumption via an SDP offer containing only incompatible codecs...

Updated openvas-manager packages fix security vulnerability

Updated openvas-manager packages fixes security vulnerability: It has been identified that OpenVAS Manager before 4.0.6 is vulnerable to sql injections due to a improper handling of the timezone parameter in modifyschedule OMP command. It has been identified that this vulnerability may allow...

ESA-2014-156: EMC Documentum Content Server Insecure Direct Object Reference Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-156: EMC Documentum Content Server Insecure Direct Object Reference Vulnerability EMC Identifier: ESA-2014-156 CVE Identifier: CVE-2014-4629 Severity Rating: CVSS v2 Base Score: 8.2 AV:N/AC:M/Au:S/C:C/I:P/A:C Affected products: • All EMC...

Snowfox CMS 1.0 Cross Site Request Forgery

input type="hidden" name="userGroups...

Wechat exposed two vulnerabilities: not authorized to login others account-vulnerability warning-the black bar safety net

Recently the black bar safety net vulnerability announcements section of the public Tencent wechat are two of the vulnerabilities. According to the vulnerability of the author described by the two vulnerability a hacker may not be authorized to access and log in directly to their wechat account...

Information disclosure in the REST API

Jira reports the 404 not-found earlier than the 401 not-authorized. This discloses the non-existence of a specific issue numbers to unauthorized users. While this isn't a huge leak, this could come in useful with social engineering. Proof of concept: Both of the calls below are unauthenticated, a...

Make categories in Space Directory visible only to users who can access the spaces

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Server. Using Confluence Cloud? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFCLOUD-34136. panel Anonymous users can see a list of categories in the Space Directory, even though they don't see the spaces...

Authentication flaw

D-Link DIR-505L SharePort Mobile Companion 1.01 and DIR-826L Wireless N600 Cloud Router 1.02 allows remote attackers to bypass authentication via a direct request when an authorized session is active...

Loadbalancer.org Enterprise VA 7.5.2 - Static SSH Key

Loadbalancer.org Enterprise VA 7.5.2 - Static SSH Key ----------- Author: ----------- xistence ------------------------- Affected products: ------------------------- Loadbalancer.org Enterprise VA 7.5.2 and below ------------------------- Affected vendors: ------------------------- Loadbalancer.o...

Loadbalancer.org Enterprise VA 7.5.2 - Static SSH Key Vulnerability

The Loadbalancer.org Virtual Appliance is a revolution in software load balancing. The software is simple to install on Windows, Mac & Linux and does not have any adverse effects on the host operating system. Details: ---------- 0x01 - SSH Private Key Loadbalancer.org Enterprise VA 7.5.2 contains...

Loadbalancer.org Enterprise VA 7.5.2 Static SSH Key

----------- Author: ----------- xistence ------------------------- Affected products: ------------------------- Loadbalancer.org Enterprise VA 7.5.2 and below ------------------------- Affected vendors: ------------------------- Loadbalancer.org http://www.loadbalancer.org/...

Officials Call NSA PRISM Leaks 'Egregious', Say Program Has Foiled Many Terror Plots

Speaking before the House Intelligence Committee on Tuesday, senior intelligence and law enforcement officials said that the FISA-authorized collection of telephone records and other data revealed by Edward Snowden’s leaks has prevented more than 50 terror attacks against the United States since...

osCommerce - Cross-Site Request Forgery

osCommerce - Cross-Site Request Forgery source: https://www.securityfocus.com/bid/57892/info osCommerce is prone to a cross-site request-forgery vulnerability because the application fails to properly validate HTTP requests. Exploiting this issue may allow a remote attacker to perform certain...

SSH Authorization

This script allows users to enter the information required to authorize and login via ssh protocol. These data will be used by other tests to executed authenticated checks. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are...

Fedora Update for gitolite3 FEDORA-2012-15731

Check for the Version of gitolite3 OpenVAS Vulnerability Test Fedora Update for gitolite3 FEDORA-2012-15731 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under t...

WordPress Core 3.4.2 - Cross-Site Request Forgery

source: https://www.securityfocus.com/bid/55660/info WordPress is prone to a cross-site request-forgery vulnerability because the application fails to properly validate HTTP requests. Exploiting this issue may allow a remote attacker to perform certain actions in the context of an authorized user...

Scientific Linux Security Update : xorg-x11-server on SL5.x, SL6.x i386/x86_64

X.Org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Multiple input sanitization flaws were found in the X.Org GLX OpenGL extension to the X Window System extension. A malicious,...