PT-2013-3533

Name of the Vulnerable Software and Affected Versions Moodle versions 2.3.x through 2.3.6 Moodle versions 2.4.x through 2.4.3 Description The issue allows remote authenticated users to read other users' assignments by leveraging the student role, due to the failure of mod/assign/locallib.php in t...

httpd: mod_rewrite allows terminal escape sequences to be written to the log file

modrewrite.c in the modrewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator...

httpd: multiple XSS flaws due to unescaped hostnames

Multiple cross-site scripting XSS vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the 1 modimagemap, 2 modinfo, 3 modldap, 4 modproxyftp, and 5...

CVE-2013-1845

CVE-2013-1845 affects Subversion, specifically mod_dav_svn, where a remote authenticated user can trigger a denial of service by setting or deleting a large number of properties. Vulnerable versions are Subversion 1.6.x prior to 1.6.21 and 1.7.0 through 1.7.8. The issue causes memory exhaustion/D...

(mod_dav_svn): DoS (crash) via LOCK requests against a non-existent URL

The moddavsvn Apache HTTPD server module in Subversion 1.6.0 through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service NULL pointer dereference and crash via an anonymous LOCK for a URL that does not exist...

(mod_dav_svn): DoS (crash) via PROPFIND request made against activity URLs

The moddavsvn Apache HTTPD server module in Subversion 1.6.x through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service NULL pointer dereference and crash via a PROPFIND request for an activity URL...

(mod_dav_svn): DoS (crash) via LOCK requests against an activity URL

The moddavsvn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service NULL pointer dereference and crash via a LOCK on an activity URL...

Debian DSA-2659-1 : libapache-mod-security - XML external entity processing vulnerability

Timur Yunusov and Alexey Osipov from Positive Technologies discovered that the XML files parser of ModSecurity, an Apache module whose purpose is to tighten the Web application security, is vulnerable to XML external entities attacks. A specially crafted XML file provided by a remote attacker,...

Debian Security Advisory DSA 2659-1 (libapache-mod-security - XML external entity processing vulnerability)

Timur Yunusov and Alexey Osipov from Positive Technologies discovered that the XML files parser of ModSecurity, an Apache module whose purpose is to tighten the Web application security, is vulnerable to XML external entities attacks. A specially-crafted XML file provided by a remote attacker,...

Debian: Security Advisory (DSA-2659-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 2641-2 (perl - rehashing flaw)

Yves Orton discovered a flaw in the rehashing code of Perl. This flaw could be exploited to carry out a denial of service attack against code that uses arbitrary user input as hash keys. Specifically an attacker could create a set of keys of a hash causing a denial of service via memory exhaustio...

PT-2013-2759

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions prior to 10.8.3 Description The issue concerns the Apple mod hfs apple module for the Apache HTTP Server, which does not properly handle ignorable Unicode characters. This allows remote attackers to bypass intended...

Debian DSA-2641-2 : perl - rehashing flaw

Yves Orton discovered a flaw in the rehashing code of Perl. This flaw could be exploited to carry out a denial of service attack against code that uses arbitrary user input as hash keys. Specifically an attacker could create a set of keys of a hash causing a denial of service via memory exhaustio...

DSA-2641-1 perl - rehashing flaw

Bulletin has no description...

ALLMediaServer 0.94 SEH Overflow Exploit

Exploit for windows platform in category remote exploits !/usr/bin/python import socket, sys Exploit Title: ALLMediaServer 0.94 SEH Overflow Exploit Date: 07/03/2013 Exploit Author: metacom E-mail:email protected Software Link:http://allmediaserver.org/download Version: ALLMediaServer 0.94 Tested...

httpd: mod_negotiation XSS via untrusted file names in directories with MultiViews enabled

Multiple cross-site scripting XSS vulnerabilities in the makevariantlist function in modnegotiation.c in the modnegotiation module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews option is enabled, allow remote attackers to inject arbitrary web script or HTML via a crafted...

httpd: mod_negotiation XSS via untrusted file names in directories with MultiViews enabled

Cross-site scripting XSS vulnerability in the modnegotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary web script or HTML by...

PT-2013-1606

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.2.x before 2.2.24-dev Apache HTTP Server versions 2.4.x before 2.4.4 Description The issue involves multiple cross-site scripting XSS vulnerabilities that allow remote attackers to inject arbitrary web script or...

VLC Player 2.0.4 <= Arbitrary Code Execution

Exploit for windows platform in category local exploits VLC Player 2.0.4 = Arbitrary Code Execution !/usr/bin/perl VLC Player 2.0.4 = ReadAV Arbitrary Code Execution Vendor URI: http://www.videolan.org/vlc/ Vendor Description: VLC is a free and open source cross-platform multimedia player and...

PT-2013-3431

Name of the Vulnerable Software and Affected Versions Subversion versions 1.6.x through 1.6.20 Subversion versions 1.7.0 through 1.7.8 Description The issue allows remote attackers to cause a denial of service, resulting in a NULL pointer dereference and crash, via a PROPFIND request for an...