CVE-2017-5159

An issue was discovered on Phoenix Contact mGuard devices that have been updated to Version 8.4.0. When updating an mGuard device to Version 8.4.0 via the update-upload facility, the update will succeed, but it will reset the password of the admin user to its default value...

PHP study notes and security vulnerabilities-vulnerability warning-the black bar safety net

System variables $POST // get the post data is a dictionary $GET // get get data, is a dictionary The error control operator PHP supports one error control operator:@the. When it is placed in a PHP expression, the expression may produce any error information is ignored. Variable default value Whe...

Security: Wrong security context loaded when using SAML2 STS Login Module

It was found that when processing undefined security domains, the org.jboss.security.plugins.mapping.JBossMappingManager implementation would fall back to the default security domain if it was available. A user with valid credentials in the defined default domain, with a role that is valid in the...

Scientific Linux Security Update : wget on SL6.x, SL7.x i386/x86_64 (20141030)

A flaw was found in the way Wget handled symbolic links. A malicious FTP server could allow Wget running in the mirror mode using the '-m' command line option to write an arbitrary file to a location writable to by the user running Wget, possibly leading to code execution. CVE-2014-4877 Note: Thi...

Input validation

The input control in PasswordParameterDefinition in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to obtain passwords by reading the HTML source code, related to the default value...

CVE-2014-2061

The input control in PasswordParameterDefinition in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to obtain passwords by reading the HTML source code, related to the default value...

Apache Cordova文件传输不安全默认值漏洞

BUGTRAQ ID: 65967 CVECAN ID: CVE-2014-0072 Cordova InAppBrowser是在您使用window.open呼叫时应用内显示的Web浏览器。 Cordova 2.6.0-2.9.0版本内的Cordova File-Transfer iOS插件、Cordova File-Transfer iOS单机版插件org.apache.cordova.file-transfer0.1.0 - 0.4.1版本中，trustAllHosts的默认值在iOS上设置为true，在实现上存在远程安全漏洞，目前细节未知。 0 Apache Group Cordo...

Mozilla: XrayWrappers can be bypassed to run user defined methods in a privileged context (MFSA 2013-59)

The XrayWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly restrict use of DefaultValue for method calls, which allows remote attackers to execute arbitrary JavaScript code with...

Mozilla: XrayWrappers can be bypassed to run user defined methods in a privileged context (MFSA 2013-59)

The XrayWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly restrict use of DefaultValue for method calls, which allows remote attackers to execute arbitrary JavaScript code with...

Mozilla: defaultValue security checks not applied (MFSA 2012-89)

Mozilla Firefox before 16.0.1, Firefox ESR 10.x before 10.0.9, Thunderbird before 16.0.1, Thunderbird ESR 10.x before 10.0.9, and SeaMonkey before 2.13.1 omit a security check in the defaultValue function during the unwrapping of security wrappers, which allows remote attackers to bypass the Same...

Mozilla: defaultValue security checks not applied (MFSA 2012-89)

Mozilla Firefox before 16.0.1, Firefox ESR 10.x before 10.0.9, Thunderbird before 16.0.1, Thunderbird ESR 10.x before 10.0.9, and SeaMonkey before 2.13.1 omit a security check in the defaultValue function during the unwrapping of security wrappers, which allows remote attackers to bypass the Same...

Fedora 12 : mod_fcgid-2.3.6-1.fc12 (2010-17474)

This update to the current upstream maintenance release includes a fix for a possible stack buffer overwrite CVE-2010-3872. It also changes the default value of FcgidMaxRequestLen from 1GB to 128K; administrators should change this to an appropriate value based on site requirements. Other changes...

Design/Logic Flaw

Microsoft Dynamics GP has a default value of ACCESS for the system password, which might make it easier for remote authenticated users to bypass intended access restrictions via unspecified vectors...

CVE-2010-2083

Microsoft Dynamics GP has a default value of ACCESS for the system password, which might make it easier for remote authenticated users to bypass intended access restrictions via unspecified vectors...

TYPO3 Security Bulletin TYPO3-20080611-1: Multiple vulnerabilities in TYPO3 Core

Dear users of TYPO3, It has been discovered that the default value of the TYPO3 configuration variable fileDenyPattern allows arbitrary code execution on Apache web servers. Besides that, the library feadminlib.inc allows Cross Site Scripting XSS. === Component Type === TYPO3 Core === Affected...

Sun Solaris TCP SYN Flood远程拒绝服务漏洞

BUGTRAQ ID: 29089 Solaris是一款由Sun开发和维护的商业性质UNIX操作系统。 Solaris的TCP实现中的安全漏洞可能允许远程非特权用户在TCP SYN洪水的情况下导致接受新的网络连接速度变慢，可能无法创建网络连接便已超时。此外，单处理器系统还可能由于高CPU使用率而总体变慢，导致整个系统拒绝服务。 这个漏洞影响ndd1M可调节值tcpconnreqmaxq0明显高于默认值1024的主机。该值越大，漏洞被利用后对主机的影响越大。如果这个漏洞被利用，控制台中可看到以下消息： WARNING: High TCP connect timeout rate! Syst...

CVE-2006-6515

Mantis before 1.1.0a2 sets the default value of $gbugreminderthreshold to "reporter" instead of a more privileged role, which has unknown impact and attack vectors, possibly related to frequency of reminders...

security flaw

The XMLRPC server in utils.rb for the ruby library libruby 1.8 sets an invalid default value that prevents "security protection" using handlers, which allows remote attackers to execute arbitrary commands...

ruby -- arbitrary command execution on XMLRPC server

Nobuhiro IMAI reports: the default value modification on Modulepublicinstancemethods from false to true breaks s.addhandlerXMLRPC::iPIMethods"sample", MyHandler.new style security protection. This problem could allow a remote attacker to execute arbitrary commands on XMLRPC server of libruby...

CVE-2005-1992

Overview The XMLRPC server in utils.rb for the ruby library libruby 1.8 sets an invalid default value that prevents "security protection" using handlers, which allows remote attackers to execute arbitrary commands. Remediation There is no fixed version for ruby. References - Blade.nagaokaut.ac.jp...