libpng: Multiple vulnerabilities

Background libpng is a standard library used to process PNG Portable Network Graphics images. It is used by several programs, including web browsers and potentially server processes. Description Multiple vulnerabilities have been discovered in libpng: The “embeddedprofilelen” function in pngwutil...

Mono: Multiple vulnerabilities

Background Mono is an open source implementation of Microsoft's .NET Framework. Description Multiple vulnerabilities have been discovered in Mono and Mono debugger. Please review the CVE identifiers referenced below for details. Impact A remote attacker could execute arbitrary code, bypass genera...

Perl DBD-Pg Module: Arbitrary code execution

Background DBD-Pg is a PostgreSQL interface module for Perl. Description Format string vulnerabilities have been found in the the "pgwarn" and "dbdstprepare" functions in dbdimp.c. Impact A remote PostgreSQL server could send specially crafted database warnings or DBD statements, possibly resulti...

libxml2: Denial of service

Background libxml2 is the XML C parser and toolkit developed for the Gnome project. Description libxml2 does not properly randomize hash functions to protect against hash collision attacks. Impact A remote attacker could entice a user or automated system to open a specially crafted XML document...

sudo: Privilege escalation

Background sudo allows a system administrator to give users the ability to run commands as other users. Description Two vulnerabilities have been discovered in sudo: When the sudoers file is configured with a Runas group, sudo does not prompt for a password when changing to the new group...

GLSA-201203-05 : Rack: Denial of Service

The remote host is affected by the vulnerability described in GLSA-201203-05 Rack: Denial of Service Rack does not properly randomize hash functions to protect against hash collision attacks. Impact : A remote attacker could send a specially crafted form post, possibly resulting in a Denial of...

Logsurfer: Arbitrary code execution

Background Logsurfer is a real time log monitoring and analysis tool. Description Logsurfer log files may contain substrings used for executing external commands. The prepareexec function in src/exec.c contains a double-free vulnerability. Impact A remote attacker could inject specially-crafted...

Adobe Flash Player: Multiple vulnerabilities

Background The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Description Multiple vulnerabilities have been discovered in Adobe Flash Player. Please review the CVE identifiers and Adobe Security Advisories and Bulletins reference...

feh: Multiple vulnerabilities

Background feh is a fast, lightweight imageviewer using imlib2. Description Multiple vulnerabilities have been discovered in feh. Please review the CVE identifiers referenced below for details. Impact A malicious entity might entice a user to visit a URL using the --wget-timestamp option, thus...

Gentoo Security Advisory GLSA 201101-01 (gif2png)

The remote host is missing updates announced in advisory GLSA 201101-01. SPDX-FileCopyrightText: 2011 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR GPL-3.0-only...

Tor: Remote heap-based buffer overflow

Background Tor is an implementation of second generation Onion Routing, a connection-oriented anonymizing communication service. Description Tor contains a heap-based buffer overflow in the processing of user or attacker supplied data. No additional information is available. Impact Successful...

CVE-2010-2469

The Linear eMerge 50 and 5000 uses a default password of eMerge for the IEIeMerge account, which makes it easier for remote attackers to obtain Video Recorder data by establishing a session to the device...

CVE-2010-2465

The S2 Security NetBox 2.5, 3.3, and 4.0, as used in the Linear eMerge 50 and 5000 and the Sonitrol eAccess, stores sensitive information under the web root with insufficient access control, which allows remote attackers to download node logs, photographs of persons, and backup files via...

CVE-2010-2466

The S2 Security NetBox, possibly 2.x and 3.x, as used in the Linear eMerge 50 and 5000 and the Sonitrol eAccess, does not properly prevent downloading of database backups, which allows remote attackers to obtain sensitive information via requests for full.dar files with predictable filenames...

Improper access control

The S2 Security NetBox 2.5, 3.3, and 4.0, as used in the Linear eMerge 50 and 5000 and the Sonitrol eAccess, stores sensitive information under the web root with insufficient access control, which allows remote attackers to download node logs, photographs of persons, and backup files via...

CVE-2010-2467

CVE-2010-2467 affects the S2 Security NetBox (likely 2.x–3.x) used in Linear eMerge 50/5000 and Sonitrol eAccess. The FTP server storing database backups does not require a password, enabling remote download of backups via FTP requests. Exploitation details are not provided in the connected docum...

CVE-2010-2466

CVE-2010-2466 affects S2 NetBox (used in Linear eMerge and Sonitrol eAccess). The vulnerability allows remote attackers to obtain sensitive data by requesting full_*.dar database backups due to insufficient access protection and predictable backup filenames. Affected NetBox versions include 2.x/3...

CVE-2010-2468

CVE-2010-2468 affects S2 Security NetBox 2.x and 3.x as used in Linear eMerge 50/5000 and Sonitrol eAccess. The root cause is the use of a weak hash algorithm for storing the Administrator password, which can allow context-dependent attackers to recover the password and gain privileged access. Th...

CVE-2010-2465

CVE-2010-2465 affects S2 Security NetBox 2.5, 3.3, and 4.0 (as utilized in Linear eMerge 50/5000 and Sonitrol eAccess). The root cause is insufficient access control, permitting remote attackers to download node logs, photographs of persons, and backup files stored under the web root via unspecif...

CVE-2010-2467

The S2 Security NetBox, possibly 2.x and 3.x, as used in the Linear eMerge 50 and 5000 and the Sonitrol eAccess, does not require setting a password for the FTP server that stores database backups, which makes it easier for remote attackers to download backup files via unspecified FTP requests...