ruby, rubygem, rubygems security update

CentOS Errata and Security Advisory CESA-2014:1912 Updated ruby packages that fix three security issues are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which...

Moderate: Red Hat Security Advisory: ruby193-ruby security update

Updated ruby193-ruby packages that fix three security issues are now available for Red Hat Software Collections 1. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

Device42 WAN Emulator 2.3 - Ping Command Injection (Metasploit)

Device42 WAN Emulator 2.3 - Ping Command Injection Metasploit This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'WAN Emulator v2.3 Command Execution', 'Description' = %q , 'License' =...

The use of CVE2012-0 1 5 8 old vulnerability in the latest APT attack V1. 0-vulnerability warning-the black bar safety net

Format overflow vulnerabilities are often APT to attack the use. In such vulnerability, CVE2012-0 1 5 8 over the past year the most often used one. The use of the vulnerability of the carrier is typically an RTF file formats, the internal data in hex string form saved. 2 0 1 3 years 1 month of...

Jenkins: insecure storage of passwords in Subversion plugin (SECURITY-58)

The Subversion plugin before 1.54 for Jenkins stores credentials using base64 encoding, which allows local users to obtain passwords and SSH private keys by reading a subversion.credentials file...

Automattic: Open Redirect in WordPress Feed Statistics {Affected All Versions}

Hi, Feed Statistics Plugin is vulnerable to Open Redirect and effecting large amount of Websites. Which is the reason it should be patched swiftly. Detail description is given below: Tested on: Wordpress 3.9.1 Vulnerable Plugin: Feed Statistics Plugin Link:...

National Science Foundation Squid Web Proxy 1.0/1.1/2.1 Authentication Failure

No description provided by source. source: http://www.securityfocus.com/bid/741/info There is a vulnerability present in certain versions of the Squid Web Proxy Cache developed by the National Science Foundation. This problem is only in effect when users of the cache are using an external...

PostNuke 0.6 Unauthenticated User Login Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/3435/info PostNuke, successor to PHPNuke, is a content management system written in PHP. PostNuke versions 0.62 to 0.64 suffer from a vulnerability that allows a remote user to log-in as any user with known username and I...

Sysax Multi Server <= 5.52 File Rename BoF RCE (Egghunter)

No description provided by source. !/usr/bin/python Title: Sysax Multi Server = 5.52 File Rename BoF RCE Egghunter Author: Craig Freyman @cd1zz Tested on: XP SP3 32bit and Server 2003 SP2 32bitNo DEP Software Versions Tested: 5.50 and 5.52 Date Discovered: Febrary 1, 2012 Vendor Contacted: Febrar...

PHP Charts 1.0 (index.php, type param) - Remote Code Execution

No description provided by source. !/usr/bin/python Original Advisory came from: http://packetstormsecurity.com/files/119582/PHP-Charts-1.0-Code-Execution.html infodox - insecurety.net import requests import random import threading import sys def genpayloadhost, port: Perl Reverse Shell Generator...

Symantec Web Gateway 5.0.2 - Remote LFI Root Exploit

No description provided by source. !/usr/bin/python Symantec Web Gateway 5.0.2 Remote LFI root Exploit Proof of Concept Exploit requires no authentication, /tmp/networkScript is sudoable and apache writable. muts at offensive-security dot com import socket import base64 payload= '''echo...

Design/Logic Flaw

LiveZilla before 5.1.1.0 stores the admin Base64 encoded username and password in a 1click file, which allows local users to obtain access by reading the file...

逐浪CMS某处编码SQL注入漏洞

简要描述： 逐浪cms某处编码SQL注入漏洞 详细说明： 地址 http://demo.zoomla.cn/3d/InsertContext.aspx protected void PageLoadobject sender, EventArgs e if base.Request.QueryString"type" != null this.md.Caddtime = DateTime.Now; this.md.Cadduser = this.user.GetLogin.UserName; string s = base.Request.Form.ToString; s =...

CVE-2013-6372

The Subversion plugin before 1.54 for Jenkins stores credentials using base64 encoding, which allows local users to obtain passwords and SSH private keys by reading a subversion.credentials file...

Design/Logic Flaw

The Subversion plugin before 1.54 for Jenkins stores credentials using base64 encoding, which allows local users to obtain passwords and SSH private keys by reading a subversion.credentials file...

CVE-2013-6372

The Subversion plugin before 1.54 for Jenkins stores credentials using base64 encoding, which allows local users to obtain passwords and SSH private keys by reading a subversion.credentials file...

CVE-2013-6372

The CVE-2013-6372 issue affects the Jenkins Subversion plugin prior to version 1.54. The vulnerability arises because credentials are stored using base64 encoding in a subversion.credentials file, allowing local users to read and extract passwords and SSH private keys. Impact is limited to local ...

CVE-2013-6372

The Subversion plugin before 1.54 for Jenkins stores credentials using base64 encoding, which allows local users to obtain passwords and SSH private keys by reading a subversion.credentials file...

PT-2014-3100 · Jenkins · Jenkins Subversion Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins Subversion plugin versions prior to 1.54 Description: The issue allows local users to obtain passwords and SSH private keys by reading a subversion.credentials file, due to the storage of credentials using base64 encoding...

COLDFUSION(CVE-2 0 1 0-2 8 6 1) the local contains a the use of method-vulnerability warning-the black bar safety net

Recently saw foreigner an article said that the CVE-2 0 1 0-2 8 6 1 This use of the method, only seen by reading the password. properties in the password field, to crack the SHA-1 value of the login background, or by passing a hash of the landing back, haven't seen can directly get the SHELL. In...