logrotate multiple security vulnerabilities

Race conditions, unfiltered shell characters vulnerability, DoS...

RedHat Update for ruby RHSA-2011:0908-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

JVN#51325625: Internet Explorer vulnerable to cross-site scripting

Microsoft Internet Explorer contains a vulnerability in handling specific EUC-JP encoded characters, which may result in cross-site scripting. Impact An arbitrary script may be executed on the user's web browser. Solution Upgrade the Software Upgrade to the latest version according to the...

Authentication flaw

The 1 config.guess, 2 contrib/groffer/perl/groffer.pl, and 3 contrib/groffer/perl/roff2.pl scripts in GNU troff aka groff 1.21 and earlier use an insufficient number of X characters in the template argument to the tempfile function, which makes it easier for local users to overwrite arbitrary fil...

CVE-2009-5081

The 1 config.guess, 2 contrib/groffer/perl/groffer.pl, and 3 contrib/groffer/perl/roff2.pl scripts in GNU troff aka groff 1.21 and earlier use an insufficient number of X characters in the template argument to the tempfile function, which makes it easier for local users to overwrite arbitrary fil...

On the PHP multi-character set encoding vulnerability research-exploit warning-the black bar safety net

| First, do an experiment,in the local environment in the establishment of such a php file ? php header"Content-Type:text/html;Charset=gb2312"; echo $GET"str"; echi "br/"; echo addslashes$GET"str"; ?& gt; Here my php environment has opened the Magicquotesgpc,contemporary code inside also made to...

Mandriva Update for dovecot MDVSA-2011:101 (dovecot)

Check for the Version of dovecot OpenVAS Vulnerability Test Mandriva Update for dovecot MDVSA-2011:101 dovecot Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...

ldap-novell-getpass NSE Script

Universal Password enables advanced password policies, including extended characters in passwords, synchronization of passwords from eDirectory to other systems, and a single password for all access to eDirectory. In case the password policy permits administrators to retrieve user passwords "Allo...

dovecot -- denial of service vulnerability

Timo Sirainen reports: Fixed potential crashes and other problems when parsing header names that contained NUL characters...

DEBIAN-CVE-2011-1929

lib-mail/message-header-parser.c in Dovecot 1.2.x before 1.2.17 and 2.0.x before 2.0.13 does not properly handle '\0' characters in header names, which allows remote attackers to cause a denial of service daemon crash or mailbox corruption via a crafted e-mail message...

Debian Security Advisory DSA 2217-1 (dhcp3)

The remote host is missing an update to dhcp3 announced via advisory DSA 2217-1. OpenVAS Vulnerability Test $Id: deb22171.nasl 6613 2017-07-07 12:08:40Z cfischer $ Description: Auto-generated from advisory DSA 2217-1 dhcp3 Authors: Thomas Reinke Copyright: Copyright c 2011 E-Soft Inc...

Debian: Security Advisory (DSA-2217-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

dhtml-menu-builder universal password and XSS cross-site vulnerabilities-vulnerability warning-the black bar safety net

Vulnerability Description: from abroad dhtml-menu-builder Auth bypass and Persistent xss; official website http://dhtml-menu-builder. com/; the system there is a serious background administrator authentication bypass vulnerability, as well asXSScross-site vulnerabilities. Publisher/date:...

openSUSE Security Update : dhcpcd (openSUSE-SU-2011:0385-1)

This update fixes the following security issue : A rogue DHCP server could instruct clients to use a host name that contains shell meta characters. Since many scripts in the system do not expect unusal characters in the system's host name the DHCP client needs to sanitize the host name offered by...

openSUSE Security Update : dhcp (openSUSE-SU-2011:0320-1)

A rogue dhcp server could instruct clients to use a host name that contains shell meta characters. Since many scripts in the system do not expect unusal characters in the system's host name the dhcp client needs to sanitize the host name offered by the server CVE-2011-0997. %NASLMINLEVEL 70300 C...

Dcore(lightweight CMS)backend to get the SHELL method and repair method-vulnerability warning-the black bar safety net

Author: Mr. DzY Increase the style with the site table of the Association; Background: admin/login. asp if does not exist, the self-guess solution. Injection point:http://www. xxxx. net/index. asp? subsite=1 In tool to increase the table name: dcoreuser column name: useradmin userpassword If not...

SuSE 10 Security Update : dhcp6 (ZYPP Patch Number 7464)

A rogue DHCP server could instruct clients to use a host name that contains shell meta characters. Since many scripts in the system do not expect unusal characters in the system's host name the DHCP client needs to sanitize the host name offered by the server. CVE-2011-0997 %NASLMINLEVEL 70300 C...

SuSE 11.1 Security Update : dhcpcd (SAT Patch Number 4389)

A rogue DHCP server could instruct clients to use a host name that contains shell meta characters. Since many scripts in the system do not expect unusal characters in the system's host name the DHCP client needs to sanitize the host name offered by the server. CVE-2011-0996 Note this update is...

Tencent WEB QQ file transfer a tasteless vulnerabilities and fixes-vulnerability warning-the black bar safety net

Brief description: In the file name special characters not carried out inspection and restrictions. Detailed description: 2011-04-12 2 2:4 0:5 8 The other side has agreed to receive"C:\fakepath\1.asa;. jpg",began to transfer files. 2011-04-12 2 2:4 1:0 2 File"1. asa"the transfer is successful...

Adobe Flash Player < 10.1.53.64 - Action Script Type Confusion (ASLR + DEP Bypass)

Source: http://www.abysssec.com/blog/2011/04/exploiting-adobe-flash-player-on-windows-7/ Adobe Flash player Action script type confusion exploit DEP+ASLR bypass advisory text : Here is another reliable windows 7 exploit . the main method used for exploitation is based on Haifei-li presentation at...