UBUNTU-CVE-2014-8764

DokuWiki 2014-05-05a and earlier, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a user name and password starting with a null \0 character, which triggers an anonymous bind...

CVE-2014-8764

DokuWiki 2014-05-05a and earlier, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a user name and password starting with a null \0 character, which triggers an anonymous bind...

CVE-2014-8763

CVE-2014-8763 affects DokuWiki when using Active Directory/LDAP authentication. The issue allows bypassing authentication via a password that starts with a null byte, triggering an unauthenticated bind. Connected advisories confirm related CVEs (8761, 8762, 8763, 8764) and indicate fixes in DokuW...

CVE-2014-7624

The CVE-2014-7624 entry affects the Android app “Guess the Pixel Character Quiz” (com.aiadp.pixelcQuiz) version 1.3, where the app does not verify X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certifica...

Design/Logic Flaw

Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier and 5.6.19 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:CHARACTER SETS...

CVE-2014-4287

Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier and 5.6.19 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:CHARACTER SETS...

CVE-2014-4287

Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier and 5.6.19 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:CHARACTER SETS...

UBUNTU-CVE-2014-4287

Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier and 5.6.19 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:CHARACTER SETS...

Amazon Linux AMI : nrpe (ALAS-2014-364)

DISPUTED Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor NRPE 2.15 and earlier allows remote attackers to execute arbitrary commands via a newline character in the -a option to libexec/checknrpe. NOTE: this issue is disputed by multiple parties. It has been reported...

CentOS 7 : php (CESA-2014:1327)

Updated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available for...

PYSEC-2014-73

ZPublisher.HTTPRequest.scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed LF character...

PYSEC-2014-28

ZPublisher.HTTPRequest.scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed LF character...

Important: Red Hat Security Advisory: bash Shift_JIS security update

Updated September 30, 2014 This advisory has been updated with information on restarting system services after applying this update. No changes have been made to the original packages. Updated bash ShiftJIS packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and ...

Fedora 21 : knot-1.5.2-1.fc21 (2014-10507)

New upstream release : - CVE-2014-0486: remote crash using crafted DNS message - transfers: do not refuse AXFR answers to IXFR queries - fix storing of hash character '' in zone file Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security...

Mavenlink: Email field filtering problem.

From the page: https://app.mavenlink.com/settings/email When I tried to update the email address, I noticed that the database field was allocating 255 characters there.And if the input was more than 255 character that field was truncating. For example: text...

cmseasy 管理员身份 后台缓存配置文件，没有过滤一个字符导致getshell(3)

简要描述： cmseasy 管理员身份 后台缓存配置文件，没有过滤一个字符导致getshell3 哥就是要找完所有后台shell，让你们后台无处可找，呵呵.......... 详细说明： 直接看代码: unionadmin.php:lines:123-138: if front::post'submit' &&$this-manage-vaild $this-manage-filter$this-Exc; $this-manage-addbefore$this; $this-manage-savebefore; $path = ROOT.'/config/union.php';...

Google Chrome < 37.0.2062.94 Multiple Vulnerabilities

The version of Google Chrome installed on the remote host is a version prior to 37.0.2062.94. It is, therefore, affected by the following vulnerabilities : - Blink contains a use-after-free vulnerability in its SVG implementation. By using a specially crafted web page, a remote attacker can cause...

Directory traversal

kcleanup.cpp in KDirStat 2.7.0 does not properly quote strings when deleting a directory, which allows remote attackers to execute arbitrary commands via a " double quote character in the directory name, a different vulnerability than CVE-2014-2528...

Updated bugzilla packages fix a CSRF vulnerability

Updated bugzilla packages fix security vulnerabilities: Adobe does not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery CSRF attacks against Bugzilla's JSONP endpoint, possibly obtaining sensitive bug information, via a crafted OBJECT...

Minimising font downloads

Optimising fonts is pretty difficult for larger sites. There's an easy solution, although only some browsers support it. Translations Français Fonts can be big Really big. They can be anywhere from 70k to many megabytes compressed of course, because why wouldn't you?. You want bold? Well, you jus...