[SECURITY] [DSA 3498-1] drupal7 security advisory

------------------------------------------------------------------------- Debian Security Advisory DSA-3498-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff February 28, 2016 https://www.debian.org/security/faq -...

Greater Visibility Through PowerShell Logging

UPDATE Feb. 29: This post has been updated with new configuration recommendations due to the Feb. 24 rerelease of PowerShell 5, and now includes a link to a parsing script that users may find valuable. Introduction Mandiant is continuously investigating attacks that leverage PowerShell throughout...

Unspecified Vulnerability in Oracle E-Business Suite Oracle Common Applications CRM User Management Framework Component

Oracle E-Business Suite is a new generation of e-business suite from Oracle. An unspecified security vulnerability exists in the Oracle E-Business Suite Oracle Common Applications CRM User Management Framework component, which could be exploited by remote attackers to submit a special request to...

Design/Logic Flaw

Unspecified vulnerability in the Oracle Common Applications component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, and 12.1.3 allows remote authenticated users to affect integrity via vectors related to CRM User Management Framework...

CVE-2016-0562

CVE-2016-0562 pertains to Oracle E-Business Suite (Oracle Common Applications CRM User Management Framework) and affects versions 11.5.10.2, 12.1.1, 12.1.2, and 12.1.3. The vulnerability is described as unspecified, allowing remote authenticated users to affect integrity via the CRM User Manageme...

CVE-2016-0562

Unspecified vulnerability in the Oracle Common Applications component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, and 12.1.3 allows remote authenticated users to affect integrity via vectors related to CRM User Management Framework...

appRain 4.0.3 - Multiple Vulnerabilities

Exploit for php platform in category web applications appRain 4.0.3 Code Execution , XSS, CSRF , Path Traversal Vulnerabilities appRain is described as a Content Management Framework written in PHP. There are various components of appRain 4.0.3 that should not provide the possibility of code...

Debian DSA-3200-1 : drupal7 - security update

Multiple vulnerabilities have been found in the Drupal content management framework. More information can be found at %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-3200. The text itself ...

Debian DSA-2913-1 : drupal7 - security update

An information disclosure vulnerability was discovered in Drupal, a fully-featured content management framework. When pages are cached for anonymous users, form state may leak between anonymous users. Sensitive or private information recorded for one anonymous user could thus be disclosed to othe...

Debian: Security Advisory (DSA-2847-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 2828-1 (drupal6 - several vulnerabilities)

Multiple vulnerabilities have been discovered in Drupal, a fully-featured content management framework: vulnerabilities due to optimistic cross-site request forgery protection, insecure pseudo random number generation, code execution and incorrect security token validation. In order to avoid the...

appRain CMF Arbitrary PHP File Upload (CVE-2012-1153)

An arbitrary file upload vulnerability has been reported in appRain's Content Management Framework...

Drupal Stage File Proxy模块拒绝服务漏洞

Bugtraq ID:61080 Drupal是使用PHP语言编写的开源内容管理框架，它由内容管理系统和PHP开发框架共同构成 Drupal Stage File Proxy模块存在一个拒绝服务漏洞，允许攻击者长时间重复向服务器提交多次请求，会降低所有文件操作的性能，也可能使得某些文件操作不能使用，造成拒绝服务攻击 0 Drupal Stage File Proxy 7.x-1.x 厂商解决方案 Drupal Stage File Proxy 7.x-1.4已经修复此漏洞，建议用户下载更新： http://drupal.org/project/stagefileproxy...

TYPO3 Maag Form Captcha开放重定向漏洞

BUGTRAQ ID: 60298 CVECAN ID: CVE-2013-4680 Typo3是开源内容管理系统（CMS）和内容管理框架（CMF）。 TYPO3的Maag Form Captcha 2.0.0及更早版本存在开放重定向漏洞，攻击者利用此漏洞可将用户重定向到任意网站并执行钓鱼攻击。 0 TYPO3 Maag Form Captcha = 2.0.0 厂商补丁： TYPO3 ----- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://typo3.org/extensions/repository/...

Drupal Login安全模块安全绕过漏洞

Bugtraq ID:60683 Drupal是一个基于PHP语言编写的开发型CMF（内容管理框架），Drupal Login Security是一个用于Drupal的登录安全模块 Drupal Login Security模块在禁用'soft blocking'时存在安全漏洞，由于模块不正确使用字符串过滤，可导致模块忽略所有检查 0 Drupal Login Security 6.x-1.x Drupal Login Security 7.x-1.x 厂商解决方案 Drupal Login Security 6.x-1.3和7.x-1.3已经修复此漏洞，建议用户下载更新：...

appRain CMF Arbitrary PHP File Upload Vulnerability

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 "appRain CMF...

appRain CMF Arbitrary PHP File Upload Vulnerability

Exploit for php platform in category web applications This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...

[SECURITY] [DSA 2445-1] typo3-src security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2445-1 [email protected] http://www.debian.org/security/ Florian Weimer March 31, 2012 http://www.debian.org/security/faq -...

IBM Tivoli Management Framework Endpoint addr URL Default Credentials

The remote Tivoli Endpoint installation is secured by default credentials. Nessus is able to make authenticated requests to '/addr' by using the username 'tivoli' and password 'boss', which are hard-coded in the server executable. A remote, unauthenticated attacker could change the endpoint's...

CVE-2011-2330

Tivoli Endpoint in IBM Tivoli Management Framework 3.7.1, 4.1, 4.1.1, and 4.3.1 has an unspecified "built-in account" that is "trivially" accessed, which makes it easier for remote attackers to send requests to restricted pages via a session on TCP port 9495, a different vulnerability than...