CVE-2014-6414

Summary: CVE-2014-6414 affects OpenStack Neutron; unauthenticated? or remote authenticated users could reset admin network attributes to default values due to insufficient access control in Neutron prior to 2014.2.4 (and before 2014.1.2 in 2014.1 line). This could lead to misconfiguration or deni...

Major Bash Shell Vulnerability Affects Linux, UNIX, Mac OS X

A critical vulnerability in the Bourne again shell, simply known as Bash and which is present in most Linux and UNIX distributions and Apple’s Mac OS X, has been discovered and administrators are being urged to patch immediately. The flaw allows an attacker to remotely attach a malicious executab...

Ubuntu: Security Advisory (USN-2347-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-2347-1 python-django vulnerabilities

Florian Apolloner discovered that Django incorrectly validated URLs. A remote attacker could use this issue to conduct phishing attacks. CVE-2014-0480 David Wilson discovered that Django incorrectly handled file name generation. A remote attacker could use this issue to cause Django to consume...

Cross site scripting

Cross-site scripting XSS vulnerability in SpiceWorks before 7.2.00195 allows remote authenticated users to inject arbitrary web script or HTML via the Summary field in a ticket request to the portal page...

Updated python-django packages fix multiple vulnerabilities

Updated python-django and python-django14 packages fix security vulnerabilities: These releases address an issue with reverse generating external URLs CVE-2014-0480; a denial of service involving file uploads CVE-2014-0481; a potential session hijacking issue in the remote-user middleware...

DEBIAN-CVE-2014-0482

The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors...

CVE-2014-0483

The administrative interface contrib.admin in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a tofield...

PYSEC-2014-6

The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors...

[SECURITY] [DSA 3010-1] python-django security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3010-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso August 22, 2014 http://www.debian.org/security/faq -...

PT-2014-3650

Name of the Vulnerable Software and Affected Versions Django versions 1.4.x through 1.4.13 Django versions 1.5.x through 1.5.8 Django versions 1.6.x through 1.6.5 Django versions 1.7 before release candidate 3 Description The issue allows remote authenticated users to hijack web sessions via...

UBUNTU-CVE-2014-0482

The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors...

CVE-2014-3337

The SIP implementation in Cisco Unified Communications Manager CM 8.6.2 and earlier allows remote authenticated users to cause a denial of service process crash via a crafted SIP message that is not properly handled during processing of an XML document, aka Bug ID CSCtq76428...

WordPress Gravity Upload Ajax Plugin <= 1.1 - Arbitrary File Upload

This vulnerability allows remote unauthenticated user to upload files of any type. Solution Update the plugin...

WordPress Gravity Upload Ajax Plugin <= 1.1 - Arbitrary File Upload

This vulnerability allows remote unauthenticated user to upload files of any type. Solution Update the plugin...

Oracle JRockit R27 < R27.8.3.9 / R28 < R28.3.3.10 Multiple Vulnerabilities (July 2014 CPU)

The remote host has a version of Oracle JRockit that is affected by multiple vulnerabilities that could allow a remote user to affect the confidentiality of the system via : - A design flaw in the RSA 'blinding' security component of the 'RASCore' class. By performing operations requiring the use...

RHEL 6 : condor (RHSA-2013:1172)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2013:1172 advisory. HTCondor is a specialized workload management system for compute-intensive jobs. It provides a job queuing mechanism, scheduling policy, priority...

CVE-2014-4986

Multiple cross-site scripting XSS vulnerabilities in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.1, 4.1.x before 4.1.14.2, and 4.2.x before 4.2.6 allow remote authenticated users to inject arbitrary web script or HTML via a crafted 1 table name or 2 column name that is improperly handled...

CVE-2013-3993

IBM InfoSphere BigInsights before 2.1.0.3 allows remote authenticated users to bypass intended file and directory restrictions, or access untrusted data or code, via crafted parameters in unspecified API calls...

Jason Rahaim MP3Mystic 1.0.x Server Directory Traversal Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2699/info A vulnerability exists in Jason Rahaim's MP3Mystic Server which allows a remote user to traverse the directories of a target host. This may lead to the disclosure of file and directory contents. Arbitrary...