KTP Computer Customer Database CMS 1.0 - Local File Inclusion Vulnerability

No description provided by source. !/usr/bin/perl -w ====================================== KTPCCD Local File Inclusion Exploit ====================================== ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground Hacking Team...

Nessus 2.0.x LibNASL Arbitrary Code Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7664/info Nessus has reported that various flaws have been discovered in the 'libnasl' library used by the Nessus application. As a result, a malicious NASL script may be able to break outside of the established sandbox...

Critical: Red Hat Security Advisory: rubygem-openshift-origin-node security update

An updated rubygem-openshift-origin-node package that fixes one security issue and several bugs is now available for Red Hat OpenShift Enterprise 2.1.1. The Red Hat Security Response Team has rated this update as having Critical security impact. A Common Vulnerability Scoring System CVSS base...

Disabled user are still able to request for password reset email.

h3. Step to Reproduce: Disable a user test in Crowd administration console make sure that there is no duplicate user Request password reset for the disabled user test h3. Expected result No mail will be sent to disabled account. h3. Observerd Result. The disabled user still receive the password...

openSUSE Security Update : xtrabackup (openSUSE-SU-2014:0363-1)

xtrabackup was updated to 2.1.8 : Disabled the 'binary version check' functionality in the VersionCheck module due to security concerns. The automatic version check remains disabled in the openSUSE package. bnc864194 CVE-2014-2029 More bugs fixed : - do not discard read-ahead buffers through...

openSUSE Security Update : xulrunner (openSUSE-SU-2012:1586-1)

Changes in xulrunner : - update to 17.0 bnc790140 - MFSA 2012-91/CVE-2012-5842/CVE-2012-5843 Miscellaneous memory safety hazards - MFSA 2012-92/CVE-2012-4202 bmo758200 Buffer overflow while rendering GIF images - MFSA 2012-93/CVE-2012-4201 bmo747607 evalInSanbox location context incorrectly appli...

Oracle Linux 5 / 6 : thunderbird (ELSA-2014-0742)

The remote Oracle Linux 5 / 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2014-0742 advisory. 24.6.0-1.0.1.el65 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js 24.6.0-1 - Update to 24.6.0 Tenable has...

Domain restricted signup is creating enabled users on ApacheDS

When a user signs up to a Confluence instance that has domain restricted sign up enabled, they are normally created as disabled users and are unable to login. However, when the underlying user directory does not support disabling users, such as ApacheDS 1.5, then the user ends up being created as...

kernel: vhost-net: insufficiency in handling of big packets in handle_rx()

drivers/vhost/net.c in the Linux kernel before 3.13.10, when mergeable buffers are disabled, does not properly validate packet lengths, which allows guest OS users to cause a denial of service memory corruption and host OS crash or possibly gain privileges on the host OS via crafted packets,...

kernel: vhost-net: insufficiency in handling of big packets in handle_rx()

drivers/vhost/net.c in the Linux kernel before 3.13.10, when mergeable buffers are disabled, does not properly validate packet lengths, which allows guest OS users to cause a denial of service memory corruption and host OS crash or possibly gain privileges on the host OS via crafted packets,...

openstack-heat-templates: use of HTTPS url and sslverify=false

OpenStack Heat Templates heat-templates, as used in Red Hat Enterprise Linux OpenStack Platform 4.0, sets sslverify to false for certain Yum repositories, which disables SSL protection and allows man-in-the-middle attackers to prevent updates via unspecified vectors...

openstack-heat-templates: setting gpgcheck=0 for signed packages

OpenStack Heat Templates heat-templates, as used in Red Hat Enterprise Linux OpenStack Platform 4.0, sets gpgcheck to 0 for certain templates, which disables GPG signature checking on downloaded packages and allows man-in-the-middle attackers to install arbitrary packages via unspecified vectors...

TORQUE Resource Manager 2.5.x < 2.5.13 - Stack Buffer Overflow Stub

!/usr/bin/env python Exploit Title: TORQUE Resource Manager 2.5.x-2.5.13 stack based buffer overflow stub Date: 27 May 2014 Exploit Author: bwall - @botnethunter Vulnerability discovered by: MWR Labs CVE: CVE-2014-0749 Vendor Homepage: http://www.adaptivecomputing.com/ Software Link:...

libxml2: external parameter entity loaded when entity substitution is disabled

It was discovered that libxml2 loaded external parameter entities even when entity substitution was disabled. A remote attacker able to provide a specially crafted XML file to an application linked against libxml2 could use this flaw to conduct XML External Entity XXE attacks, possibly resulting ...

kernel: vhost-net: insufficiency in handling of big packets in handle_rx()

drivers/vhost/net.c in the Linux kernel before 3.13.10, when mergeable buffers are disabled, does not properly validate packet lengths, which allows guest OS users to cause a denial of service memory corruption and host OS crash or possibly gain privileges on the host OS via crafted packets,...

UBUNTU-CVE-2014-0191

The xmlParserHandlePEReference function in parser.c in libxml2 before 2.9.2, as used in Web Listener in Oracle HTTP Server in Oracle Fusion Middleware 11.1.1.7.0, 12.1.2.0, and 12.1.3.0 and other products, loads external parameter entities regardless of whether entity substitution or validation i...

Scientific Linux Security Update : thunderbird on SL5.x, SL6.x i386/x86_64 (20140319)

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. CVE-2014-1493, CVE-2014-1510, CVE-2014-1511, CVE-2014-1512,...

DEBIAN-CVE-2014-0106

Sudo 1.6.9 before 1.8.5, when envreset is disabled, does not properly check environment variables for the envdelete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable...

openldap security update

2.3.43-27 - fix: CVE-2013-4449 segfault on certain queries with rwm overlay 1064145 2.3.43-26 - fix: do not send IPv6 DNS queries when IPv6 is disabled on the host 812772...

Threat Outbreak Alert: Fake Disabled Account Notification Email Messages on January 15, 2014

Medium Alert ID: 32456 First Published: 2014 January 16 17:17 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain an account removal notification for the recipient. The text in the email message attempts to convince the...