ansible -- multiple vulnerabilities

Ansible, Inc. reports: Arbitrary execution from data from compromised remote hosts or local data when using a legacy Ansible syntax - resolved in Ansible 1.7 ansible-galaxy command when used on local tarballs and not galaxy.ansible.com can install a malformed tarball if so provided - resolved in...

DoS via fail2ban

Invalid logs parsing allows to ban arbitrary hosts...

DSA-2979-1 fail2ban - security update

Bulletin has no description...

Microsoft Internet Explorer 5 JavaScript Local File Enumeration Vulnerability (1)

No description provided by source. source: http://www.securityfocus.com/bid/3779/info Microsoft Internet Explorer is prone to a vulnerability which may disclose sensitive information to a malicious webmaster. When script code includes a file outside of the document it is embedded in and the file...

Apache 1.3.x - 2.0.48 - mod_userdir Remote Users Disclosure Exploit

No description provided by source. / m00-apache-w00t.c Apache 1.3.-2.0.48 remote users disclosure exploit by m00 Security. Proof-of-Concept edition This tool scans remote hosts with httpd apache and disclosure information about existens users accounts via wrong default configuration of moduserdir...

cgiCentral WebStore 400 Arbitrary Command Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2861/info cgiCentral's Webstore is an shopping cart application which processes and manages online purchases. Wsmail.cgi calls system with user-supplied data in the command string. Because it does not filter metacharacter...

Microsoft Windows Media Player 11 ScriptCommand Multiple Information Disclosure Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/35335/info Microsoft Windows Media Player is prone to multiple information-disclosure vulnerabilities because it fails to properly restrict access to certain functionality when handling media files. An attacker can exploi...

BindView HackerShield 1.0/1.1 HackerShield AgentAdmin Password Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/628/info The BindView HackerShield product originally Netect's HackerShield creates an NT service account called NetectAgentAdmin$. This account is a member of the local administrators group on an NT host. The service...

Sun Management Center 3.0/3.5 Error Message Information Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/8873/info A problem in the handling of error messages has been identified in Sun Management Center. Because of this, an attacker may be able to gain sensitive information about vulnerable hosts...

Boozt 0.9.8 - Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/3787/info Boozt! is a free open source banner management software for Linux hosts. An issue has been reported which could allow for a user to execute arbitrary code on a Boozt! host. This is acheivable when a Boozt! user...

Microsoft Crypto API X.509 Certificate Validation - Remote Information Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/28548/info Microsoft's Crypto API library is prone to an information-disclosure vulnerability because HTTP requests to arbitrary hosts and ports may be automatically triggered when validating X.509 certificates. Successfu...

Acme.Serve 1.7 - Arbitrary File Access Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2809/info Acme.Serve is a free, open-source, embeddable webserver written in Java. It is small, is intended to provide minimal functionality, and is fully compatible with JavaServer. Acme.Serve 1.7 comes with a webserver...

Symantec Web Gateway contains SQL injection and cross-site scripting vulnerabilities

Overview Symantec Web Gateway 5.1.1.24, and possibly earlier versions, contains cross-site scripting and SQL injection vulnerabilities. Description CVE-2014-1652 -CWE-79: Improper Neutralization of Input During Web Page Generation Symantec Web Gateway 5.1.1.24, and possibly earlier versions,...

openSUSE Security Update : inkscape (openSUSE-SU-2013:0294-1)

Inkscape was updated to fix two security issues : - inkscape occasionaly tries to open EPS files from /tmp bnc796306, CVE-2012-6076. - inkscape could load XML from external hosts bnc794958, CWE-827, CVE-2012-5656. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and packa...

PT-2016-5688 · Openssl +3 · Polarssl +4

Name of the Vulnerable Software and Affected Versions: cURL and libcurl versions prior to 7.49.0 Description: The issue allows remote attackers to spoof servers via an arbitrary valid certificate when using SSLv3 or making a TLS connection to a URL that uses a numerical IP address. This occurs...

VMware Workstation 10.x < 10.0.2 Windows 8.1 Guest Privilege Escalation (VMSA-2014-0005) (Linux)

The version of VMware Workstation installed on the remote host is version 10.x prior to 10.0.2. It is, therefore, reportedly affected by a privilege escalation vulnerability. A kernel NULL dereference flaw exists in VMware tools on Windows 8.1 guest hosts. An attacker could escalate his privilege...

Hostscan - PHP tool for scanning specific range of hosts

Hostscan is a php tool which allows you to scan specific range of hosts, mostly for information gathering and testing for weak passwords. I guess it's a pentest tool, i'd created it to automate some tests that i often do. Since it's PHP, it works quite slowly compared to client-side soft. How it...

IRCCloud: Host Header Injection - irccloud.com

Host Header Injection Attack - irccloud.com An attacker can manipulate the Host header as seen by the web application and cause the application to behave in unexpected ways. Very often multiple websites are hosted on the same IP address. This is where the Host Header comes in. This header specifi...

ICS-CERT Confirms Public Utility Compromised Recently

Attackers recently compromised a utility in the United States through an Internet-connected system that gave the attackers access to the utility’s internal control system network. The utility, which has not been named, had remote access enabled on some of its Internet-connected hosts and the...

Run a Command on Multiple Servers: ClusterSSH

Run a Command on Multiple Servers How to run a command on multiple servers at once? If you maintain multiple Linux servers, there are cases where you want to run the same commands on all the servers. For example, you may want to install/upgrade packages, patch the kernel, and update configuration...