Cross site request forgery (csrf)

app/controllers/api/v1/hostscontroller.rb in Foreman before 1.2.2 does not properly restrict access to hosts, which allows remote attackers to access arbitrary hosts via an API request...

PT-2013-4890 · Foreman · Foreman

Name of the Vulnerable Software and Affected Versions: Foreman versions prior to 1.2.2 Description: The issue is related to improper access restriction to hosts in the Foreman application. This allows remote attackers to access arbitrary hosts via an API request to the /api/v1/hosts endpoint, whi...

Foreman: hosts_controller.rb power/ipmi_boot Symbol creation DoS

The 1 power and 2 ipmiboot actions in the HostController in Foreman before 1.2.2 allow remote attackers to cause a denial of service memory consumption via unspecified input that is converted to a symbol...

foreman: app/controllers/api/v1/hosts_controller.rb API privilege escalation

app/controllers/api/v1/hostscontroller.rb in Foreman before 1.2.2 does not properly restrict access to hosts, which allows remote attackers to access arbitrary hosts via an API request...

[SECURITY] Fedora 19 Update: fping-3.5-3.fc19

fping is a ping-like program which can determine the accessibility of multiple hosts using ICMP echo requests. fping is designed for parallelized monitoring of large numbers of systems, and is developed with ease of use in scripting in mind...

US Top Source of Web Application Attacks

The United States is no longer the most obese country in the world thanks to Mexico, but it still ranks No. 1 as the preeminent global source of Web-based attacks, according to the Imperva Web Application Attack Report. The report also notes that attackers are targeting retail-related application...

[MAC Address Scanner] Desktop Tool to Find MAC address of Remote Computers on Local Network

MAC Address Scanner is the free desktop tool to remotely scan and find MAC Address of all systems on your local network. It allows you to scan either a single host or range of hosts at a time. During the scan, it displays the current status for each host. After the completion, you can generate...

Oracle Linux 3 : gdb (ELSA-2007-0469)

From Red Hat Security Advisory 2007:0469 : An updated gdb package that fixes a security issue and various bugs is now available. This update has been rated as having low security impact by the Red Hat Security Response Team. GDB, the GNU debugger, allows debugging of programs written in C, C++, a...

DEBIAN-CVE-2013-0235

The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a crafted source URL for a pingback, related to a Server-Side Request Forgery SSRF issue...

Unable to Add Machine With RAS (Remote Access Service) Enabled

Challenge When trying to add a Windows Server that has the Remote Acces role enabled to Veeam Backup & Replication as a Managed Server, the operation fails with: Failed to check whether remote installer service is available. The RPC server is unavailable. RPC function call failed. Function name:...

RUCKUS ADVISORY ID 031813-2: User authentication bypass vulnerability in ZoneDirector administrative web interface

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 RUCKUS ADVISORY ID 031813-2 Customer release date: March 25, 2013 Public release date: May 27, 2013 TITLE User authentication bypass vulnerability in ZoneDirector administrative web interface SUMMARY An user authentication bypass vulnerability has bee...

find_vhosts

This plugin uses the HTTP Host header to find new virtual hosts. For example, if the intranet page is hosted in the same server that the public page, and the web server is misconfigured, this plugin will discover that virtual host. Please note that this plugin doesnt use any DNS technique to find...

Moderate: Red Hat Security Advisory: rhev 3.2 - vdsm security and bug fix update

Updated vdsm packages that fix one security issue and various bugs are now available. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available from the C...

No network data available for ESX(i) hosts

Challenge SCOM shows the following alert: VP510 No metrics obtained for ESX hosts, failed to process performance or configuration data for hosts Under SCOM Monitoring - Veeam for Vmware- vSphere Host- Performance views, performance counters for hosts actually exist and show all data except for th...

Serva32 2.1.0 TFTPD service buffer overflow vulnerability

Overview Serva32 2.1.0 TFTPD service contains a buffer overflow vulnerability. Description The Serva32 2.1.0 TFTPD service contains a buffer overflow vulnerability when parsing large read requests. When the application reads in a large buffer the application crashes. --- Impact An unauthenticated...

Information disclosure

Xen 3.1 through 4.x, when running 64-bit hosts on Intel CPUs, does not clear the NT flag when using an IRET after a SYSENTER instruction, which allows PV guest users to cause a denial of service hypervisor crash by triggering a GP fault, which is not properly handled by another IRET instruction...

CVE-2013-1917

Xen 3.1 through 4.x, when running 64-bit hosts on Intel CPUs, does not clear the NT flag when using an IRET after a SYSENTER instruction, which allows PV guest users to cause a denial of service hypervisor crash by triggering a GP fault, which is not properly handled by another IRET instruction...

CVE-2013-1917

Xen 3.1 through 4.x, when running 64-bit hosts on Intel CPUs, does not clear the NT flag when using an IRET after a SYSENTER instruction, which allows PV guest users to cause a denial of service hypervisor crash by triggering a GP fault, which is not properly handled by another IRET instruction...

Apache CouchDB < 1.0.4 / 1.1.2 / 1.2.1 Multiple Vulnerabilities

Binary data 800632.prm...

[Acunetix Web Vulnerability Scanner 8] Automated Web Application Security Testing Tool

Acunetix W eb V ulnerability S canner WVS is an automated web application security testing tool that audits your web applications by checking for exploitable hacking vulnerabilities. Automated scans may be supplemented and cross-checked with the variety of manual tools to allow for comprehensive...