114 matches found
openSUSE Security Update : virtualbox (openSUSE-2017-141)
This update for virtualbox fixes the following issues : - The version has been updated from 5.1.8 to 5.1.12. Upstream fixed various functional and security issues. - Multiple security issues have been fixed that could cause DoS and possibly privilege escalation...
Attachmate Host Access Management and Security Server PassThru Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Attachmate Host Access Management and Security Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the PassThru resource. The issue results...
DEBIAN-CVE-2016-4985
The ironic-api service in OpenStack Ironic before 4.2.5 Liberty and 5.x before 5.1.2 Mitaka allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the...
UBUNTU-CVE-2016-4985
The ironic-api service in OpenStack Ironic before 4.2.5 Liberty and 5.x before 5.1.2 Mitaka allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the...
PT-2016-6206
Name of the Vulnerable Software and Affected Versions OpenStack Ironic versions prior to 4.2.5 Liberty OpenStack Ironic versions 5.x prior to 5.1.2 Mitaka Description The issue allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC addre...
openstack-ironic: Ironic Node information including credentials exposed to unauthenticated users
An authentication vulnerability was found in openstack-ironic. A client with network access to the ironic-api service could bypass OpenStack Identity authentication, and retrieve all information about any node registered with OpenStack Bare Metal. If an unprivileged attacker knew or was able to...
openstack-ironic: Ironic Node information including credentials exposed to unauthenticated users
An authentication vulnerability was found in openstack-ironic. A client with network access to the ironic-api service could bypass OpenStack Identity authentication, and retrieve all information about any node registered with OpenStack Bare Metal. If an unprivileged attacker knew or was able to...
Fedora 20 : php-5.5.22-1.fc20 (2015-2328)
19 Feb 2015, PHP 5.5.22 Core : - Fixed bug 67068 getClosure returns somethings that's not a closure. Danack at basereality dot com - Fixed bug 68925 Mitigation for CVE-2015-0235 ' GHOST: glibc gethostbyname buffer overflow. Stas - Fixed bug 68942 Use after free vulnerability in unserialize with...
CVE-2014-7178
Enalean Tuleap before 7.5.99.6 allows remote attackers to execute arbitrary commands via the User-Agent header, which is provided to the passthru PHP function...
CVE-2014-7178
Enalean Tuleap before 7.5.99.6 allows remote attackers to execute arbitrary commands via the User-Agent header, which is provided to the passthru PHP function...
PHPCompta/NOALYSS 6.7.1 5638 - Remote Command Execution
No description provided by source. Vulnerability title: Remote Command Execution in PHPCompta/NOALYSS CVE: CVE-2014-6389 Vendor: PHPCompta Product: PHPCompta/NOALYSS Affected version: 6.7.1 5638 Fixed version: 6.7.2 Reported by: Jerzy Kramarz Details: PhpCompta 6.7.1-2 does not validate the synta...
PHPCompta / NOALYSS 6.7.1 5638 - Remote Command Execution Vulnerability
PHPCompta/NOALYSS version 6.7.1 5638 suffers from a remote command execution vulnerability. Vulnerability title: Remote Command Execution in PHPCompta/NOALYSS CVE: CVE-2014-6389 Vendor: PHPCompta Product: PHPCompta/NOALYSS Affected version: 6.7.1 5638 Fixed version: 6.7.2 Reported by: Jerzy Krama...
PHPCompta/NOALYSS 6.7.1 5638 Remote Command Execution
Vulnerability title: Remote Command Execution in PHPCompta/NOALYSS CVE: CVE-2014-6389 Vendor: PHPCompta Product: PHPCompta/NOALYSS Affected version: 6.7.1 5638 Fixed version: 6.7.2 Reported by: Jerzy Kramarz Details: PhpCompta 6.7.1-2 does not validate the syntax of the commands when processing...
VICIdial Manager Send OS Command Injection
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient def...
openSUSE Security Update : kvm (openSUSE-2011-56)
Malicous clients could potentially exploit a heap based buffer overflow in the CCID card passthru device. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2011-56. The text description...
Joomla JomSocial 2.6 Code Execution Exploit
Joomla JomSocial component version 2.6 remote PHP code execution exploit. !/usr/bin/python Joomla! JomSocial component = 2.6 PHP code execution exploit Authors: - Matias Fontanini - Gaston Traberg This exploit allows the execution of PHP code without any prior authentication on the Joomla!...
VICIdial Manager Send OS Command Injection Vulnerability
The file agc/managersend.php in the VICIdial web application uses unsanitized user input as part of a command that is executed using the PHP passthru function. A valid username, password and session are needed to access the injection point. Fortunately, VICIdial has two built-in accounts with...
VICIdial Manager Send OS Command Injection
This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'VICIdial Manager Send OS Command Injection', 'Description' = %q The file agc/managersend.php in the VICIdial web application uses...
VICIdial Manager Send OS Command Injection
The file agc/managersend.php in the VICIdial web application uses unsanitized user input as part of a command that is executed using the PHP passthru function. A valid username, password and session are needed to access the injection point. Fortunately, VICIdial has two built-in accounts with...
Narcissus backend.php release Parameter Remote Command Execution
The remote web server hosts Narcissus, an online tool for the Angstrom distribution, used to create 'rootfs' images for embedded devices. The version of Narcissus hosted on the remote web server fails to properly sanitize user-supplied input in a POST request to the 'release' parameter of the...