2097 matches found
Ubuntu 12.04 LTS / 12.10 / 13.04 : nova vulnerabilities (USN-2000-1)
It was discovered that Nova did not properly enforce the ispublic property when determining flavor access. An authenticated attacker could exploit this to obtain sensitive information in private flavors. This issue only affected Ubuntu 12.10 and 13.10. CVE-2013-2256, CVE-2013-4278 Grant Murphy...
Important: Red Hat Security Advisory: commons-fileupload security update
An update for the commons-fileupload component that fixes one security issue is now available from the Red Hat Customer Portal for Red Hat JBoss SOA Platform 4.3.0.GACP05 and 5.3.1 GA. The Red Hat Security Response Team has rated this update as having important security impact. A Common...
Important: Red Hat Security Advisory: jakarta-commons-fileupload security update
An update for Red Hat JBoss Web Server 1.0.2 that fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...
Inaccessible page titles leaked by Share Page API
The Share Page API exposes a REST endpoint that is available to authenticated users of Confluence. It is possible for any user to share any page simply by specifying the corresponding numeric id and the resulting notification includes the title of the shared page. In particular, a user may obtain...
Unauthenticated enumeration of resource information via tinymce plugin
It is possible for unauthenticated users to retrieve a large amount of information from a Confluence instance, including page titles, attachment filenames, and username, by making calls to the link REST API in the confluence-tinymce-plugin. This is effective even when the anonymous user does not...
Unauthenticated enumeration of resource information via tinymce plugin
It is possible for unauthenticated users to retrieve a large amount of information from a Confluence instance, including page titles, attachment filenames, and username, by making calls to the link REST API in the confluence-tinymce-plugin. This is effective even when the anonymous user does not...
PT-2013-4933
Name of the Vulnerable Software and Affected Versions OpenStack Compute Nova versions Folsom through Havana Description The issue is related to the "create an instance" API, which does not properly enforce the os-flavor-access:is public property. This allows remote authenticated users to boot...
Important: Red Hat Security Advisory: jbossweb security update
An update for Red Hat JBoss Enterprise Application Platform 6.1.0 that fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score,...
CVE-2013-2800
The OSIsoft PI Interface for IEEE C37.118 before 1.0.6.158 allows remote attackers to cause a denial of service memory consumption or memory corruption, instance shutdown, and data-collection outage via crafted C37.118 configuration packets...
Memory corruption
The OSIsoft PI Interface for IEEE C37.118 before 1.0.6.158 allows remote attackers to cause a denial of service memory consumption or memory corruption, instance shutdown, and data-collection outage via crafted C37.118 configuration packets...
CVE-2013-4261
OpenStack Compute Nova Folsom, Grizzly, and earlier, when using Apache Qpid for the RPC backend, does not properly handle errors that occur during messaging, which allows remote attackers to cause a denial of service connection pool consumption, as demonstrated using multiple requests that send...
https://jira.atlassian.com/500page.jsp
this page shows all the data about JIRA instance to intruder. It makes it more vulnerable when you know the whole setup...
Ubuntu 11.10 / 12.04 LTS / 12.10 : nova vulnerabilities (USN-1771-1)
Loganathan Parthipan discovered that Nova did not properly validate VNC tokens after an instance was deleted. An authenticated attacker could exploit this to access other virtual machines under certain circumstances. This issue did not affect Ubuntu 11.10. CVE-2013-0335 Vish Ishaya discovered tha...
Nmap NSE 6.01: ms-sql-info
Attempts to determine configuration and version information for Microsoft SQL Server instances. SQL Server credentials required: No will not benefit from 'mssql.username' & 'mssql.password'. Run criteria: Host script: Will always run. Port script: N/A NOTE: Unlike previous versions, this script...
CVE-2013-1391
creationtimestamp| type| source ---|---|--- 2013-01-29 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/38248 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/misc/dvrconfigdisclosure.rb 2019-10-30 23:31:10+00:00|...
Default application configuration files are available for download
h3. Summary of The Bug By browsing to the following URL path user would be able to download any files under /atlassian-jira/WEB-INF/... code/s/1519/3/1.0//WEB-INF/...code The above URL will be accessible by any users including anonymous even to an instance that does not allow anonymous access h5...
MSSQL Password Hashdump
This module extracts the usernames and encrypted password hashes from a MSSQL server and stores them for later cracking. This module also saves information about the server version and table names, which can be used to seed the wordlist. This module requires Metasploit:...
CVE-2012-3989
CVE-2012-3989 affects Mozilla Firefox (and related Mozilla products) prior to version 16.0, Thunderbird prior to 16.0, and SeaMonkey prior to 2.13. The vulnerability is a crash caused by an invalid cast when using the instanceof operator on certain JavaScript objects, which could allow remote att...
soapbox protection bypass
It's possible to bypass protection by launching second application instance...
Fedora 16 : cloud-init-0.6.3-0.5.bzr532.fc16 (2012-14189)
This update changes the URL that cloud-init uses as a fallback for instance metadata when http://169.254.169.254/ is not reachable from http://instance-data:8773/ to http://instance-data.:8773/ . It also fixes two systemd-related bugs. Note that the former will require DNS server reconfiguration ...