Design/Logic Flaw

Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching and recycling operations involving request objects, which allows remote attackers to obtain unintended read access to IP address and HTTP header information in opportunistic circumstances by readin...

CVE-2011-3375

CVE-2011-3375 affects Apache Tomcat 6.0.30–6.0.33 and 7.x before 7.0.22. The root cause is improper caching/recycling of request objects, which can allow remote attackers to read IP addresses and HTTP header information by reading TCP data. The impact is information disclosure of request metadata...

FreeBSD UIPC socket heap overflow proof-of-concept

Exploit for freebsd platform in category dos / poc !/bin/sh fbsd-uipcsock-heap.sh, by Shaun Colley , 29/09/11 proof-of-concept crash for the freebsd unix domain sockets heap overflow. this was tested on freebsd 8.2-RELEASE. just a PoC for now. see advisory & patches for details:...

Beckhoff TwinCAT 2.11.0.2004 - Denial of Service

Luigi Auriemma Application: Beckhoff TwinCAT http://www.beckhoff.de/twincat/ Versions: = 2.11.0.2004 Platforms: Windows Bug: Denial of Service Exploitation: remote Date: 13 Sep 2011 Author: Luigi Auriemma e-mail: [email protected] web: aluigi.org 1 Introduction 2 Bug 3 The Code 4 Fix...

Rockwell RSLogix 19 - Denial of Service

Rockwell RSLogix 19 - Denial of Service Luigi Auriemma Application: Rockwell RSLogix http://www.rockwellautomation.com/rockwellsoftware/design/rslogix5000/ Versions: = 19 RsvcHost.exe 2.30.0.23 Platforms: Windows Bug: Denial of Service Exploitation: remote Date: 13 Sep 2011 Author: Luigi Auriemma...

Beckhoff TwinCAT 2.11.0.2004 - Denial of Service

Beckhoff TwinCAT 2.11.0.2004 - Denial of Service Luigi Auriemma Application: Beckhoff TwinCAT http://www.beckhoff.de/twincat/ Versions: = 2.11.0.2004 Platforms: Windows Bug: Denial of Service Exploitation: remote Date: 13 Sep 2011 Author: Luigi Auriemma e-mail: [email protected] web: aluigi.or...

PT-2011-3665 · Libvirt · Libvirt

Name of the Vulnerable Software and Affected Versions: libvirt versions 0.8.8 through 0.9.1 Description: The issue is related to the virSecurityManagerGetPrivateData function in security/security manager.c, which incorrectly processes "security manager private data" due to a wrong argument used i...

Rockwell RSLogix Overflow Vulnerability

Overview This updated advisory is a follow-up to the Alert titled “ICS-ALERT-11-256-05A—Rockwell RSLogix Overflow Vulnerability” that was published September 13, 2011, on the Industrial Control Systems Cyber Emergency Response Team ICS-CERT web page. ICS-CERT is aware of a public report of an...

HP Discovery & Dependency Mapping Inventory information leak

public community has SNMP read access by default...

CVE-2009-5055

Open Ticket Request System OTRS before 2.4.4 grants ticket access on the basis of single-digit substrings of the CustomerID value, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by visiting a ticket, as demonstrated by leveraging the...

Debian Security Advisory DSA 2181-1 (subversion)

The remote host is missing an update to subversion announced via advisory DSA 2181-1. OpenVAS Vulnerability Test $Id: deb21811.nasl 6613 2017-07-07 12:08:40Z cfischer $ Description: Auto-generated from advisory DSA 2181-1 subversion Authors: Thomas Reinke Copyright: Copyright c 2011 E-Soft Inc...

Debian: Security Advisory (DSA-2181-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-2181-1 : subversion - denial of service

Philip Martin discovered that HTTP-based Subversion servers crash when processing lock requests on repositories which support unauthenticated read access. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Securit...

[SECURITY] [DSA 2181-1] subversion security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2181-1 [email protected] http://www.debian.org/security/ Florian Weimer March 04, 2011 http://www.debian.org/security/faq -...

mysql: multiple insufficient table name checks

Directory traversal vulnerability in MySQL 5.0 through 5.0.91 and 5.1 before 5.1.47 allows remote authenticated users to bypass intended table grants to read field definitions of arbitrary tables, and on 5.1 to read or delete content of arbitrary tables, via a .. dot dot in a table name...

[CORE-2010-0624] MS OpenType CFF Parsing Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://corelabs.coresecurity.com/ MS OpenType CFF Parsing Vulnerability 1. Advisory Information Title: MS OpenType CFF Parsing Vulnerability Advisory Id: CORE-2010-0624 Advisory URL:...

MS OpenType CFF Parsing Vulnerability

Core Security - CoreLabsMS OpenType CFF Parsing Vulnerability 1. Advisory Information Title: MS OpenType CFF Parsing Vulnerability Advisory Id: CORE-2010-0624 Advisory URL: http://www.coresecurity.com/content/ms-opentype-cff-parsing-vulnerability Date published: 2010-10-12 Date of last update:...

CVE-2010-2226

The xfsswapext function in fs/xfs/xfsdfrag.c in the Linux kernel before 2.6.35 does not properly check the file descriptors passed to the SWAPEXT ioctl, which allows local users to leverage write access and obtain read access by swapping one file into another file...

Arbitrary file deletion

The xfsswapext function in fs/xfs/xfsdfrag.c in the Linux kernel before 2.6.35 does not properly check the file descriptors passed to the SWAPEXT ioctl, which allows local users to leverage write access and obtain read access by swapping one file into another file...

CVE-2010-2226

CVE-2010-2226 affects the Linux kernel: the xfs_swapext function in fs/xfs/xfs_dfrag.c does not properly validate file descriptors passed to the SWAPEXT ioctl, enabling a local user with write access to swap a file into another and gain read access. The issue is present in kernel versions before ...