CVE-2015-2166: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the Instance Monitor in Ericsson Drutt Mobile Service Delivery Platform MSDP 4, 5, and 6 allows remote attackers to read arbitrary files via a ..%2f dot dot encoded slash in the default URI...

PT-2015-5639

Name of the Vulnerable Software and Affected Versions Ericsson Drutt Mobile Service Delivery Platform MSDP versions 4 through 6 Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This is achieved via a URL in the url parameter to...

mailman -- path traversal vulnerability

Mark Sapiro reports: A path traversal vulnerability has been discovered and fixed. This vulnerability is only exploitable by a local user on a Mailman server where the suggested Exim transport, the Postfix postfixtomailman.py transport or some other programmatic MTA delivery not using aliases is...

Threat Outbreak Alert RuleID14120: Email Messages Distributing Malicious Software on March 20, 2015

Medium Alert ID: 37967 First Published: 2015 March 20 12:57 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID14120 may contain the following files: Name | Si...

HTTPS Opens Door to Paid Pinterest Bug Bounty

Pinterest’s journey toward becoming a fully HTTPS website opened a lot of doors, including a potentially profitable one for hackers. The social networking site this week announced that it would begin paying cash rewards through its bug bounty program, upping the stakes from the T-shirt it...

Threat Outbreak Alert RuleID13978: Email Messages Distributing Malicious Software on March 17, 2015

Medium Alert ID: 37858 First Published: 2015 March 13 14:51 GMT Last Updated: 2015 March 18 16:30 GMT Version: 2 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID13978 and...

File Containment Vulnerability in CDN Acceleration Server of Shanghai Dilian Information Technology Co.

Ltd. CDN acceleration server, through the introduction of active content management layer and global load balancing, and combined with content caching and other technologies, for users to build a middle layer optimized for broadband service support on the basis of the existing IP network, so that...

Threat Outbreak Alert RuleID13746: Email Messages Distributing Malicious Software on February 27, 2015

Medium Alert ID: 37620 First Published: 2015 February 27 15:07 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID13746 may contain the following files: Name |...

SYNCK GRAPHICA Mailform Pro Remote Code Execution Vulnerability

Mailform Pro CGI is a mail form application. A security vulnerability exists in Mailform Pro CGI's handling of email delivery, which allows remote attackers to exploit the vulnerability to execute arbitrary code...

PYSEC-2015-38

OpenStack Image Registry and Delivery Service Glance 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service disk consumption by creating a large number of images using the task v2 API and then deleting them, a different...

CVE-2014-9684

OpenStack Image Registry and Delivery Service Glance 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service disk consumption by creating a large number of images using the task v2 API and then deleting them before the uploads...

CVE-2015-1881

OpenStack Image Registry and Delivery Service Glance 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service disk consumption by creating a large number of images using the task v2 API and then deleting them, a different...

CVE-2015-1881: Undefined Security Weakness

OpenStack Image Registry and Delivery Service Glance 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service disk consumption by creating a large number of images using the task v2 API and then deleting them, a different...

CVE-2014-9684: Undefined Security Weakness

OpenStack Image Registry and Delivery Service Glance 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service disk consumption by creating a large number of images using the task v2 API and then deleting them before the uploads...

PT-2015-4352

Name of the Vulnerable Software and Affected Versions OpenStack Image Registry and Delivery Service Glance versions 2014.2 through 2014.2.2 Description The issue allows remote authenticated users to cause a denial of service, specifically disk consumption, by creating a large number of images usi...

OpenStack Image Registry Delivery Service Arbitrary File Manipulation Vulnerability

The OpenStack Image Registry Delivery Service is an OpenStack project that stores, queries, and retrieves virtual machine images. An arbitrary file manipulation vulnerability exists in OpenStack Image Registry Delivery Service versions prior to 2014.1.4, and 2014.2.x versions prior to 2014.2.2,...

CVE-2015-1195

The CVE-2015-1195 issue concerns OpenStack Image Registry Delivery Service (Glance) V2 API where versions prior to 2014.1.4 and 2014.2.x prior to 2014.2.2 allow an authenticated remote user to read or delete arbitrary files via a full pathname in a filesystem:// URL in the image location property...

CVE-2015-1195: Improper Limitation of a Pathname to a Restricted Directory

The V2 API in OpenStack Image Registry and Delivery Service Glance before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem: URL in the image location property. NOTE: this vulnerability exists because of a...

WordPress Welcart e-Commerce Plugin <= 1.3.12 - Multiple XSS

Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML in an adddeliverymethod action to wp-admin/admin-ajax.php via 4 parameters: "name", "intl", "nocod", or "time parameter". Solution Update the plugin...

PT-2015-4243

Name of the Vulnerable Software and Affected Versions OpenStack Image Registry and Delivery Service Glance versions prior to 2014.2.2 OpenStack Image Registry and Delivery Service Glance version 2014.1.4 Description The issue allows remote authenticated users to read or delete arbitrary files via...