UBUNTU-CVE-2014-5270

Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and ciphertext randomization, which makes it easier for physically proximate attackers to conduct key-extraction attacks by leveraging the ability to collect voltage data from exposed...

Mozilla: Out of bounds write in NSPR (MFSA 2014-55)

An out-of-bounds write flaw was found in NSPR. A remote attacker could potentially use this flaw to crash an application using NSPR or, possibly, execute arbitrary code with the privileges of the user running that application. This NSPR flaw was not exposed to web content in any shipped version o...

Pablo Software Solutions FTP Service 1.2 Plaintext Password Weakness

No description provided by source. source: http://www.securityfocus.com/bid/7801/info It has been reported that Pablo FTP Service stores FTP User account passwords in plaintext format. As a result, these credentials could be exposed to other users. It should be noted that while this weakness has...

Joomla Component com_category (catid) SQL Injection Vulnerability

No description provided by source. Joomla component 'comcategory' SQL injection vulnerability version: 1.0.12 dork:inurl:comcategory xploited by PrincePwn3r contact: [email protected] +++++++ greetz to all p0wnbox.com members !!! +++++++...

McAfee Subscription Manager Stack Buffer Overflow

No description provided by source. $Id: mcafeemcsubmgrvsprintf.rb 9669 2010-07-03 03:13:45Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and...

Ian Dunn: Multiple Path Disclosure

Hi Ian, I have downloaded all the latest version's of plugin's from your wp profile and did a quick check for FPD. I know you may point out that WP does'nt consider it as a issue however i personally for plugin i look at it as a miss on best practice from plugin developers part. I do not expect a...

Amazon Web Services Combing Third Parties for Credentials

Amazon Web Services is actively searching a number of sources, including code repositories and application stores, looking for exposed credentials that could put users’ accounts and services at risk. A week ago, a security consultant in Australia said that as many as 10,000 secret Amazon Web...

Oracle Reports Servlet Parsequery Function Remote Database Credentials Exposure

Nessus was able to exploit a flaw in the Oracle Reports servlet parsequery function, and was able to retrieve the plaintext database credentials for one or more users. A remote attacker can exploit this vulnerability to gain unauthorized database access. %NASLMINLEVEL 70300 C Tenable Network...

Design/Logic Flaw

NAS4Free 9.1.0.1.804 and earlier allows remote authenticated users to execute arbitrary PHP code via a request to exec.php, aka the "Advanced | Execute Command" feature. NOTE: this issue might not be a vulnerability, since it appears to be part of legitimate, intentionally-exposed functionality b...

EMC NetWorker information leakage

It's possible to retrieve sensible configuration information...

CVE-2012-6575

Cross-site scripting XSS vulnerability in the Exposed Filter Data module 6.x-1.x before 6.x-1.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the Exposed Filter Data module 6.x-1.x before 6.x-1.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-6575

CVE-2012-6575 affects the Drupal Exposed Filter Data module (6.x-1.x) prior to 6.x-1.2. It is a cross-site scripting (XSS) issue that allows remote attackers to inject arbitrary scripts via unspecified vectors. Root cause: insufficient input sanitization in the module. Impact: potential execution...

CVE-2012-6575

Cross-site scripting XSS vulnerability in the Exposed Filter Data module 6.x-1.x before 6.x-1.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

AXIS Media Control Active-X File Corruption

======================================================================== AXIS ==================================================================== ======================================================================== 1.Advisory Information Title: AXIS Media Control ActiveX vulnerability Date...

JBoss: twiddle.sh accepts credentials as command line arguments, exposing them to other local users via a process listing

twiddle.sh in JBoss AS 5.0 and EAP 5.0 and earlier accepts credentials as command-line arguments, which allows local users to read the credentials by listing the process and its arguments...

Cache: NonManagedConnectionFactory will log password in clear text when an exception occurs

The NonManagedConnectionFactory in JBoss Enterprise Application Platform EAP 5.1.2 and 5.2.0, Web Platform EWP 5.1.2 and 5.2.0, and BRMS Platform before 5.3.1 logs the username and password in cleartext when an exception is thrown, which allows local users to obtain sensitive information by readi...

Installer: Generated auto-install xml is world readable

The GUI installer in JBoss Enterprise Application Platform EAP and Enterprise Web Platform EWP 5.2.0 and possibly 5.1.2 uses world-readable permissions for the auto-install XML file, which allows local users to obtain the administrator password and the sucker password by reading this file...

Well-Known Ruby on Rails Secret Token Used on Remote Application

Binary data rubyonrailsknownsecret.nbin...

GitHub Search Down After Some Credentials and Crypto Keys Exposed

GitHub’s search capability remains dark Friday after it was discovered that the code-sharing site’s search feature could be used to dredge up passwords, private crypto keys, and other credentials developers use in their projects. GitHub is a popular collaboration site for open source software...