2869 matches found
Golabi CMS <= 1.0.1 Session Poisoning Vulnerability
No description provided by source. -------------------------------------------------------------------------------- \ \ / \ | | / \ /\ \ \ \ | |/ /\ \ / \ / / | | \ | | // / / \ / | \ | / // /| | \ /|| / / | /| /\ / \ / / / // / /// /...
rsync 2.3/2.4/2.5 Signed Array Index Remote Code Execution Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/3958/info A vulnerability exists within some versions of rsync. Under some circumstances, a remotely supplied signed value is used as an array index, allowing NULL bytes to be written to arbitrary memory locations...
TinyBrowser (TinyMCE Editor File browser) 1.41.6 - Multiple Vulnerabilities
No description provided by source. ============================================================================== TinyBrowser TinyMCE Editor File browser 1.41.6 - Multiple Vulnerabilities ============================================================================== Discovered by Aung Khant, YGN...
chkrootkit 0.49 - Local Root Vulnerability
No description provided by source. We just found a serious vulnerability in the chkrootkit package, which may allow local attackers to gain root access to a box in certain configurations /tmp not mounted noexec. The vulnerability is located in the function slapper in the shellscript chkrootkit:...
PHP 5.2 Session.Save_Path() Safe_Mode and Open_Basedir Restriction Bypass Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/21508/info PHP is prone to a 'safemode' and 'openbasedir' restriction-bypass vulnerability. Successful exploits could allow an attacker to access sensitive information or to write files in unauthorized locations. This...
Apache Tomcat 3.2.3/3.2.4 Example Files Web Root Path Disclosure
No description provided by source. source: http://www.securityfocus.com/bid/4877/info Apache Tomcat is a freely available, open source web server maintained by the Apache Foundation. When Apache Tomcat is installed with a default configuration, several example files are also installed. When some ...
GLSA-201406-24 : Dnsmasq: Denial of Service
The remote host is affected by the vulnerability described in GLSA-201406-24 Dnsmasq: Denial of Service When used with certain libvirt configurations Dnsmasq replies to queries from prohibited interfaces. Impact : A remote attackers can cause a Denial of Service via spoofed TCP based DNS queries...
How to: Version Control
How to: Version Control In Linux, /etc directory contains important system-related or application-specific configuration files. Especially in a server environment, it is wise to back up various server configurations in /etc directory regularly, to save trouble from any accidental changes in the...
YASAT - Yet Another Stupid Audit Tool
YASAT Yet Another Stupid Audit Tool is a simple stupid audit tool. Its goal is to be as simple as possible with minimum binary dependencies only sed, grep and cut Second goal is to document each test with maximum information and links to official documentation. It do many tests for checking...
Design/Logic Flaw
The Netlink implementation in the Linux kernel through 3.14.1 does not provide a mechanism for authorizing socket operations based on the opener of a socket, which allows local users to bypass intended access restrictions and modify network configurations by using a Netlink socket for the 1 stdou...
CVE-2014-0181
The CVE-2014-0181 issue affects the Linux kernel Netlink implementation prior to 3.14.1, where there is no authorization based on the opener of a Netlink socket. This can allow a local user to bypass intended access restrictions and modify network configurations by using a Netlink socket for the ...
CVE-2014-0181
The Netlink implementation in the Linux kernel through 3.14.1 does not provide a mechanism for authorizing socket operations based on the opener of a socket, which allows local users to bypass intended access restrictions and modify network configurations by using a Netlink socket for the 1 stdou...
CVE-2014-0181
The Netlink implementation in the Linux kernel through 3.14.1 does not provide a mechanism for authorizing socket operations based on the opener of a socket, which allows local users to bypass intended access restrictions and modify network configurations by using a Netlink socket for the 1 stdou...
DEBIAN-CVE-2014-2327
Cross-site request forgery CSRF vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that 1 modify binary files, 2 modify configurations, or 3 add arbitrary users...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that 1 modify binary files, 2 modify configurations, or 3 add arbitrary users...
CVE-2014-2327
Cross-site request forgery CSRF vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that 1 modify binary files, 2 modify configurations, or 3 add arbitrary users...
CVE-2014-2327
Cross-site request forgery CSRF vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that 1 modify binary files, 2 modify configurations, or 3 add arbitrary users...
CVE-2013-7363
CVE-2013-7363 concerns an unspecified vulnerability in the Diagnostics (SMD) agent of SAP Solution Manager . The connected sources describe that remote attackers can leverage vectors involving the P4 protocol to: (1) obtain sensitive information, (2) modify the configuration of applications, and ...
Scientific Linux Security Update : httpd on SL6.x i386/x86_64 (20140403)
It was found that the moddav module did not correctly strip leading white space from certain elements in a parsed XML. In certain httpd configurations that use the moddav module for example when using the moddavsvn module, a remote attacker could send a specially crafted DAV request that would...
Yahoo Encryption Slammed for Lack of Forward Secrecy, HSTS
Yahoo, as promised, rolled out HTTPs by default this week for its email service, bringing it in line with other Internet companies that have been securing users’ communication for years. But if Yahoo expected applause from security experts, it can think again. The response from those well-versed ...