postgresql: CREATE INDEX race condition possibly leading to privilege escalation

Race condition in the 1 CREATE INDEX and 2 unspecified ALTER TABLE commands in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allows remote authenticated users to create an unauthorized index or read portions of unauthorized tables b...

PT-2014-5758 · Mysql Server +5 · Mysql Server +5

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 5.5.35 and earlier MySQL Server versions 5.6.15 and earlier Description: The issue affects the availability of the system, allowing remote authenticated users to cause an impact via vectors related to ENFED...

CVE-2013-6734

CVE-2013-6734 affects IBM WebSphere eXtreme Scale Client versions 7.1.0.x–8.6.0.4 (and WebSphere DataPower XC10 Appliance) where cached HTTP session data can be read by another user when sharing the same web container. The underlying issue is improper isolation of cached data, enabling informatio...

UBUNTU-CVE-2014-0064

Multiple integer overflows in the pathin and other unspecified functions in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact and attack vectors, which trigger a buffer overflo...

mysql: unspecified vulnerability related to Replication DoS (CPU Jan 2014)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.34 and earlier, and 5.6.14 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Replication...

mysql: unspecified flaw related to Replication (CPU October 2013)

Unspecified vulnerability in Oracle MySQL Server 5.5.x through 5.5.32 and 5.6.x through 5.6.12 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Replication...

CVE-2013-7320

Cross-site request forgery CSRF vulnerability in D-Link DAP-2253 Access Point Rev. A1 with firmware before 1.30 allows remote attackers to hijack the authentication of administrators for requests that modify configuration settings via unspecified vectors...

Design/Logic Flaw

TRENDnet TEW-812DRU router allows remote authenticated users to execute arbitrary commands via shell metacharacters in the 1 wan network prefix to internet/ipv6.asp; 2 remote port to adm/management.asp; 3 pptp username, 4 pptp password, 5 ip, 6 gateway, 7 l2tp username, or 8 l2tp password to...

CVE-2013-4662

The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer and conduct SQL injection attacks via a direct request to the "second layer" of the API, related to contact.getquick...

CVE-2013-2747

The CVE-2013-2747 affects Courion Access Risk Management Suite (Version 8 Update 9). The password reset feature allows remote authenticated users to bypass Internet Explorer usage restrictions and execute arbitrary commands by using keyboard shortcuts to navigate the file system and open a comman...

CVE-2014-0794

SQL injection vulnerability in the JV Comment comjvcomment component before 3.0.3 for Joomla! allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a comment.like action to index.php...

Design/Logic Flaw

The OpenID module in Drupal 6.x before 6.30 and 7.x before 7.26 allows remote OpenID users to authenticate as other users via unspecified vectors...

UBUNTU-CVE-2014-1475

The OpenID module in Drupal 6.x before 6.30 and 7.x before 7.26 allows remote OpenID users to authenticate as other users via unspecified vectors...

CVE-2013-1886

Format string vulnerability in the token processing system pki-tps in Red Hat Certificate System RHCS 8.1 and possibly Dogtag Certificate System 9 and 10 allows remote authenticated users to cause a denial of service crash and possibly execute arbitrary code via format string specifiers in...

Heat: ReST API doesn't respect tenant scoping

The ReST API in OpenStack Orchestration API Heat before Havana 2013.2.1 and Icehouse before icehouse-2 allows remote authenticated users to bypass the tenant scoping restrictions via a modified tenantid in the request path...

DEBIAN-CVE-2013-1923

rpc-gssd in nfs-utils before 1.2.8 performs reverse DNS resolution for server names during GSSAPI authentication, which might allow remote attackers to read otherwise-restricted files via DNS spoofing attacks...

CVE-2013-2104

python-keystoneclient before 0.2.4, as used in OpenStack Keystone Folsom, does not properly check expiry for PKI tokens, which allows remote authenticated users to 1 retain use of a token after it has expired, or 2 use a revoked token once it expires...

Xxe

XML External Entity XXE vulnerability in sam/admin/vpe2/public/php/server.php in F5 BIG-IP 10.0.0 through 10.2.4 and 11.0.0 through 11.2.1 allows remote authenticated users to read arbitrary files via a crafted XML file...

CVE-2013-6922

CVE-2013-6922 concerns Seagate BlackArmor NAS sg2000-2000.1331. Multiple CSRF vulnerabilities allow an attacker to hijack administrator authentication and perform dangerous actions via crafted requests to admin/access_control_user_add.php and related endpoints. Affected device: BlackArmor NAS sg2...

CVE-2010-5297

WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once changed, which might allow remote authenticated administrators to bypass intended access restrictions in opportunistic circumstances via an add action after a...