resteasy security update

CentOS Errata and Security Advisory CESA-2014:1011 Updated resteasy-base packages that fix one security issue are now available for Red Hat Enterprise Linux 7. The Red Hat Security Response Team has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS...

Updated file packages fix security vulnerability

file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service CPU consumption via a crafted file that triggers backtracking during processing of an awk rule, due to an incomplete fix for CVE-2013-7345...

CmsEasy最新版5.5_UTF-8_20140802两处SQL注入（指哪补哪的后果）

简要描述： CmsEasy官方8.2号，更新了CmsEasy5.5UTF-820140802.rar 并且发布了补丁CmsEasyforUploads20140802.rar 然后，下载了个最新的包，看了下，发现一处问题 这个问题打过补丁了，但是还是能从其他地方进行注入 详细说明： 首先来看看unionact.php： function registeraction $r = $this-union-getrowarray'userid'=$this-view-data'userid'; if$r echo 'alert"'.lang'你已经申请，转入联盟页面！'.'"';...

Mandriva Linux Security Advisory : file (MDVSA-2014:146)

A vulnerability has been found and corrected in file : file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service CPU consumption via a crafted file that triggers backtracking during processing of an awk...

CVE-2014-5029

The web interface in CUPS 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/ and language0 set to null. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3537...

DEBIAN-CVE-2014-5029

The web interface in CUPS 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/ and language0 set to null. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3537...

CVE-2014-5029

The web interface in CUPS 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/ and language0 set to null. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3537...

Code injection

The web interface in CUPS 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/ and language0 set to null. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3537...

CVE-2014-5029

The web interface in CUPS 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/ and language0 set to null. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3537...

CVE-2014-5029

The web interface in CUPS 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/ and language0 set to null. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3537...

CVE-2014-5029

The web interface in CUPS 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/ and language0 set to null. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3537...

UBUNTU-CVE-2014-5029

The web interface in CUPS 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/ and language0 set to null. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3537...

Medium: dovecot

Issue Overview: Dovecot 1.1 before 2.2.13 and dovecot-ee before 2.1.7.7 and 2.2.x before 2.2.12.12 does not properly close old connections, which allows remote attackers to cause a denial of service resource consumption via an incomplete SSL/TLS handshake for an IMAP/POP3 connection. Affected...

Medium: file

Issue Overview: A denial of service flaw was found in the way the File Information fileinfo extension parsed certain Composite Document Format CDF files. A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted CDF file. Buffer overflow in the mconve...

Cross site scripting

Incomplete blacklist vulnerability in the autoEscape function in commonhelper.php in LimeSurvey 2.05+ Build 140618 allows remote attackers to conduct cross-site scripting XSS attacks via the GBK charset in the loadname parameter to index.php, related to the survey resume...

CVE-2014-5018

CVE-2014-5018 affects LimeSurvey 2.05+ Build 140618, where an incomplete blacklist in the autoEscape function of common_helper.php can allow remote XSS via the GBK charset in the loadname parameter of index.php, related to the survey resume. The connected Red Hat and CVE records confirm the vulne...

CVE-2014-3538

file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service CPU consumption via a crafted file that triggers backtracking during processing of an awk rule. NOTE: this vulnerability exists because of an...

Design/Logic Flaw

file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service CPU consumption via a crafted file that triggers backtracking during processing of an awk rule. NOTE: this vulnerability exists because of an...

EUVD-2014-3533

file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service CPU consumption via a crafted file that triggers backtracking during processing of an awk rule. NOTE: this vulnerability exists because of an...

CVE-2014-3538

file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service CPU consumption via a crafted file that triggers backtracking during processing of an awk rule. NOTE: this vulnerability exists because of an...