Mandriva Linux Security Advisory : bugzilla (MDVSA-2014:169)

Updated bugzilla packages fix security vulnerabilities : Adobe does not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery CSRF attacks against Bugzilla's JSONP endpoint, possibly obtaining sensitive bug information, via a crafted OBJECT...

SA-CONTRIB-2014-074 - Storage API - Code execution prevention

Storage API is a low-level framework for managed file storage and serving. The module creates an .htaccess file in the files directory to prevent code execution, but copied the Drupal core file and wasn't updated to include the improved file contents after SA-CORE-2013-003. This vulnerability is...

SA-CONTRIB-2014-066 - Node Access Keys - Access Bypass

Node Access Keys helps to grant users temporary view permissions to selected content types on a per user role basis. It was found that unpublished nodes of content types that that did not have an access key were visible to all. Also, If an unpublished node of a content type that was protected by ...

CVE-2012-3521

Multiple directory traversal vulnerabilities in the cssgen contrib module in GeSHi before 1.0.8.11 allow remote attackers to read arbitrary files via a .. dot dot in the 1 geshi-path or 2 geshi-lang-path parameter...

UBUNTU-CVE-2012-3522

Cross-site scripting XSS vulnerability in contrib/langwiz.php in GeSHi before 1.0.8.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-3521

Multiple directory traversal vulnerabilities in the cssgen contrib module in GeSHi before 1.0.8.11 allow remote attackers to read arbitrary files via a .. dot dot in the 1 geshi-path or 2 geshi-lang-path parameter...

PT-2014-2270

Name of the Vulnerable Software and Affected Versions GeSHi versions prior to 1.0.8.11 Description The issue concerns multiple directory traversal vulnerabilities in the cssgen contrib module. These vulnerabilities allow remote attackers to read arbitrary files by utilizing a .. dot dot in the...

CVE-2012-3522: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in contrib/langwiz.php in GeSHi before 1.0.8.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

openSUSE Security Update : postgresql (openSUSE-SU-2012:1299-1)

This version upgrade of PostgreSQL fixes following issues : - Bugfix release 9.0.10 : - Fix planner's assignment of executor parameters, and fix executor's rescan logic for CTE plan nodes. - Improve page-splitting decisions in GiST indexes. - Fix cascading privilege revoke to stop if privileges a...

SA-CONTRIB-2014-059 - Touch Theme - Cross Site Scripting (XSS)

Touch Theme is a light weight theme with modern look and feel. The theme does not sufficiently sanitize theme settings input for Twitter and Facebook username. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer themes". CVE identifiers...

GLSA-201405-28 : xmonad-contrib: Arbitrary code execution

The remote host is affected by the vulnerability described in GLSA-201405-28 xmonad-contrib: Arbitrary code execution A vulnerability in the Xmonad.Hooks.DynamicLog module could allow a malicious website with a specially crafted title to inject commands into the title bar which would be executed...

PT-2014-1882

Name of the Vulnerable Software and Affected Versions xmonad-contrib versions prior to 0.11.2 Description The issue allows remote attackers to execute arbitrary commands via a web page title. This can be achieved when the user clicks on the xmobar window title, as demonstrated using an action tag...

SA-CONTRIB-2014-055 - Require Login - Access bypass

This module enables you to restrict access to a site for all non-authenticated users. The module does not protect the front page, thereby exposing any sensitive information on the front page to anonymous users. This vulnerability is mitigated by the fact that private/sensitive information must be...

Information disclosure

The IPXPINGCOMMAND in contrib/checkipxping.c in Nagios Plugins 1.4.16 allows local users to gain privileges via a symlink attack on /tmp/ipxping/ipxping...

CVE-2013-4215

The IPXPINGCOMMAND in contrib/checkipxping.c in Nagios Plugins 1.4.16 allows local users to gain privileges via a symlink attack on /tmp/ipxping/ipxping...

CVE-2013-4215: Improper Link Resolution Before File Access

The IPXPINGCOMMAND in contrib/checkipxping.c in Nagios Plugins 1.4.16 allows local users to gain privileges via a symlink attack on /tmp/ipxping/ipxping...

Vulnerability in contrib module (CVE-2014-0066)

Potential null pointer dereference crash when crypt3 returns NULL...

Fedora 19 : drupal6-image_resize_filter-1.14-1.fc19 (2014-2612)

Updated to 1.14 - Release notes: https://drupal.org/node/2194065 - SA-CONTRIB-2014-017: https://drupal.org/node/2194655 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and...

PT-2014-4862

Name of the Vulnerable Software and Affected Versions PostgreSQL versions 9.0.x through 9.0.15 PostgreSQL versions 9.1.x through 9.1.11 PostgreSQL versions 9.2.x through 9.2.6 PostgreSQL versions 9.3.x through 9.3.2 Description The issue is caused by multiple integer overflows in the...

Fedora 20 : drupal6-ctools-1.11-1.fc20 (2014-2531)

Updated to 1.11 - Release notes: https://drupal.org/node/2194547 - SA-CONTRIB-2014-013 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible withou...