PT-2012-5370

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.2 Description The issue allows remote attackers to inject arbitrary web script or HTML via various parameters in different ownCloud components. This includes file names, url, title, tag, page, identity, stack nam...

CVE-2012-4389: Undefined Security Weakness

Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.0.7 allows remote attackers to execute arbitrary code by uploading a crafted .htaccess file in an import.zip file and accessing an uploaded PHP file...

PT-2012-5363

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.7 Description The issue allows remote attackers to execute arbitrary code by uploading a crafted .htaccess file in an import.zip file and accessing an uploaded PHP file. This is due to an incomplete blacklist...

CVE-2012-3410

Stack-based buffer overflow in lib/sh/eaccess.c in GNU Bash before 4.2 patch 33 might allow local users to bypass intended restricted shell access via a long filename in /dev/fd, which is not properly handled when expanding the /dev/fd prefix...

CVE-2012-3410: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in lib/sh/eaccess.c in GNU Bash before 4.2 patch 33 might allow local users to bypass intended restricted shell access via a long filename in /dev/fd, which is not properly handled when expanding the /dev/fd prefix...

PT-2012-4772

Name of the Vulnerable Software and Affected Versions Roundcube Webmail version 0.8.0 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML by using "javascript:" in an href attribute in the body of an HTML-formatted email. This occurs in the...

CVE-2012-3508: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in program/lib/washtml.php in Roundcube Webmail 0.8.0 allows remote attackers to inject arbitrary web script or HTML by using "javascript:" in an href attribute in the body of an HTML-formatted email...

CentOS Update for libvirt CESA-2012:1202 centos6

Check for the Version of libvirt OpenVAS Vulnerability Test CentOS Update for libvirt CESA-2012:1202 centos6 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under...

PT-2012-1116

Name of the Vulnerable Software and Affected Versions GNU Bash versions prior to 4.2 patch 33 GNU Bash versions prior to 4.2 p37 Description The issue is related to a stack-based buffer overflow in lib/sh/eaccess.c, which might allow local users to bypass intended restricted shell access. This ca...

PT-2012-4733

Name of the Vulnerable Software and Affected Versions Ruby on Rails versions 3.0.0 through 3.0.16 Ruby on Rails versions 3.1.0 through 3.1.7 Ruby on Rails versions 3.2.0 through 3.2.7 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via t...

CVE-2012-3453

logol 1.5.0 uses world writable permissions for the /var/lib/logol/results directory, which allows local users to delete or overwrite arbitrary files...

CVE-2012-3453

logol 1.5.0 uses world writable permissions for the /var/lib/logol/results directory, which allows local users to delete or overwrite arbitrary files...

PT-2012-4726

Name of the Vulnerable Software and Affected Versions logol version 1.5.0 Description The issue allows local users to delete or overwrite arbitrary files due to world writable permissions for the /var/lib/logol/results directory. Recommendations For logol version 1.5.0, consider changing the...

PT-2012-4727

Name of the Vulnerable Software and Affected Versions eXtplorer version 2.1.0b6 Description The issue concerns the use of world-writable permissions for the /var/lib/extplorer/ftp tmp directory. This setup allows local users to delete or overwrite arbitrary files. Recommendations For version...

CVE-2012-3408

lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address...

CVE-2012-3866

lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for lastrunreport.yaml, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file...

CVE-2012-3865

Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. dot dot in a...

CVE-2012-3408: Improper Authentication

lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address...

PT-2012-5048

Name of the Vulnerable Software and Affected Versions Puppet versions prior to 2.6.17 Puppet versions 2.7.x prior to 2.7.18 Puppet Enterprise versions prior to 2.5.2 Description A directory traversal issue allows remote authenticated users to delete arbitrary files on the puppet master server. Th...

CVE-2012-3865: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. dot dot in a...