Dell iDRAC Weak SessionID Vulnerability (IPMI Protocol) - Active Check

Intelligent Platform Management Interface IPMI v1.5 SessionID SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

CVE-2015-0590

Cisco WebEx Meeting Center allows remote attackers to activate disabled meeting attributes, and consequently obtain sensitive information, by providing crafted parameters during a meeting-join action, aka Bug ID CSCuo34165...

CVE-2015-0590

Cisco WebEx Meeting Center allows remote attackers to activate disabled meeting attributes, and consequently obtain sensitive information, by providing crafted parameters during a meeting-join action, aka Bug ID CSCuo34165...

MGASA-2015-0013 Updated glibc packages fix security vulnerabilities

The vfprintf function in stdio-common/vfprintf.c in GNU C Library aka glibc 2.5, 2.12, and probably other versions does not "properly restrict the use of" the alloca function when allocating the SPECS array, which allows context- dependent attackers to bypass the FORTIFYSOURCE format-string...

Fedora 20 : erlang-R16B-03.10.fc20 (2014-16214)

Disable SSLv3 - Backport useful os:getenv/2 from master. See this GitHub pull request for further details - https://github.com/erlang/otp/pull/535 - Fixed CVE-2014-1693 backported fix from ver. 17.x.x, see patch no. 17 - Trimmed dependency chain Note that Tenable Network Security has extracted...

Tuleap PHP Unserialize Code Execution Exploit

This Metasploit module exploits a PHP object injection vulnerability in Tuelap 'Tuleap PHP Unserialize Code Execution', 'Description' = %q This module exploits a PHP object injection vulnerability in Tuelap = 7.6-4 which could be abused to allow authenticated users to execute arbitrary code with...

Tuleap PHP Unserialize Code Execution

This module exploits a PHP object injection vulnerability in Tuleap 'Tuleap PHP Unserialize Code Execution', 'Description' = %q This module exploits a PHP object injection vulnerability in Tuleap = 7.6-4 which could be abused to allow authenticated users to execute arbitrary code with the...

Fedora 21 : phpMyAdmin-4.2.12-1.fc21 (2014-15588)

phpMyAdmin 4.2.12.0 2014-11-20 ================================ - Blank/white page when JavaScript disabled - Multi row actions cause full page reloads - ReferenceError: targeurl is not defined - Incorrect text/icon display in Tracking report - Recordset return from procedure display nothing - Ed...

CVE-2014-9022

The Webform Component Roles module 6.x-1.x before 6.x-1.8 and 7.x-1.x before 7.x-1.8 for Drupal allows remote attackers to bypass the "disabled" restriction and modify read-only components via a crafted form...

SuSE 11.3 Security Update : MozillaFirefox (SAT Patch Number 9972)

This version update of Mozilla Firefox to 31.2.0ESR brings improvements, stability fixes and also security fixes for the following CVEs : CVE-2014-1574 / CVE-2014-1575 / CVE-2014-1576 / CVE-2014-1577 / CVE-2014-1578 / CVE-2014-1581 / CVE-2014-1583 / CVE-2014-1585 / CVE-2014-1586 It also disables...

FreeBSD : phpMyAdmin -- XSS vulnerabilities in SQL debug output and server monitor page. (25b78f04-59c8-11e4-b711-6805ca0b3d42)

The phpMyAdmin development team reports : With a crafted database or table name it is possible to trigger an XSS in SQL debug output when enabled and in server monitor page when viewing and analysing executed queries. This vulnerability can be triggered only by someone who is logged in to...

Neutron: security groups fail to block traffic properly due to packstack configuration

It was discovered that the nova.conf configuration generated by PackStack did not correctly set the libvirtvifdriver configuration option if the Open vSwitch OVS monolithic plug-in was not used. This could result in deployments defaulting to having the firewall disabled unless the nova...

libxml2: denial of service via recursive entity expansion

A denial of service flaw was found in libxml2, a library providing support to read, modify and write XML and HTML files. A remote attacker could provide a specially crafted XML file that, when processed by an application using libxml2, would lead to excessive CPU consumption denial of service bas...

RelateIQ: Relateiq SSLv3 deprecated protocol vulnerability.

Relateiq Website service encrypts traffic using an old deprecated protocol with known weakness wich is obsolete and insecure, you should disable it. POC in the attachments. https://foundeo.com/products/iis-weak-ssl-ciphers/test.cfm?testdomain=www.relateiq.com...

UBUNTU-CVE-2014-7144

OpenStack keystonemiddleware formerly python-keystoneclient 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration paste.ini file regardless of the value, which allows remote attackers to conduct man-in-the-middle...

Disabled users still recieve 'Share Page' emails sent to groups

Steps to Reproduce in Confluence: Create a user, and set to 'Disabled' Create a Group and make this user a member of this group Share a page with the group This results in an email being sent to the inactive user Steps to Reproduce with a Crowd server handling user management: Same as above, but...

Information Exposure

OWASP Java HTML Sanitizer is vulnerable to Information Exposure. The vulnerability is due to improper handling of crafted FORM elements within a NOSCRIPT tag when JavaScript is disabled, which allows an attacker to obtain sensitive information through user-assisted interaction...

Tools/Share sends e-mail to disabled users

I have Confluence/JIRA latest versions self hosted. Confluence gets its users from JIRA. I created a new topic and then used the Tools/Share option to notify all of the new topic. I used "jira-users" to send the message to. It sent to everyone including disabled users. I would expect the behavior...

Tools/Share sends e-mail to disabled users

I have Confluence/JIRA latest versions self hosted. Confluence gets its users from JIRA. I created a new topic and then used the Tools/Share option to notify all of the new topic. I used "jira-users" to send the message to. It sent to everyone including disabled users. I would expect the behavior...

Tools/Share sends e-mail to disabled users

I have Confluence/JIRA latest versions self hosted. Confluence gets its users from JIRA. I created a new topic and then used the Tools/Share option to notify all of the new topic. I used "jira-users" to send the message to. It sent to everyone including disabled users. I would expect the behavior...