Ruby Programming Language 1.7 File Upload

TITLE: Unauthenticated Remote File Upload via HTTP for ruby-Programming language 1.7 on iOS Date: 8/1/2013 Author: Larry W. Cashdollar, @larry0 Download: https://itunes.apple.com/us/app/ruby-programming-language/id581732143?mt=8&ls=1 http://www.tayutec.com/indexen.html Description: "This is an io...

RedHat Update for spice-server RHSA-2013:1192-01

Check for the Version of spice-server OpenVAS Vulnerability Test RedHat Update for spice-server RHSA-2013:1192-01 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

RedHat Update for spice-server RHSA-2013:1192-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CentOS 6 : spice-server (CESA-2013:1192)

An updated spice-server package that fixes one security issue is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating...

Amazon Linux AMI : cyrus-imapd (ALAS-2011-27)

An authentication bypass flaw was found in the cyrus-imapd NNTP server, nntpd. A remote user able to use the nntpd service could use this flaw to read or post newsgroup messages on an NNTP server configured to require user authentication, without providing valid authentication credentials...

Fedora 18 : lighttpd-1.4.32-1.fc18 (2013-15344)

One important denial of service in 1.4.31 fix: CVE-2012-5533. A flaw was found in lighttpd version 1.4.31 that could be exploited by a remote user to cause a denial of service condition in lighttpd. A client could send a malformed Connection header to lighttpd such as 'Connection: TE,,Keep-Alive'...

Fedora 19 : lighttpd-1.4.32-1.fc19 (2013-15345)

One important denial of service in 1.4.31 fix: CVE-2012-5533. A flaw was found in lighttpd version 1.4.31 that could be exploited by a remote user to cause a denial of service condition in lighttpd. A client could send a malformed Connection header to lighttpd such as 'Connection: TE,,Keep-Alive'...

SQL Injection in vtiger CRM

High-Tech Bridge Security Research Lab discovered SQL injection vulnerability in vtiger CRM, which can be exploited to execute arbitrary SQL commands in application's database. 1 SQL Injection in vtiger CRM: CVE-2013-5091 The vulnerability exists due to insufficient validation of "onlyforuser" HT...

CVE-2013-5001

Cross-site scripting XSS vulnerability in libraries/plugins/transformations/abstract/TextLinkTransformationsPlugin.class.php in phpMyAdmin 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted object name associated with a...

Design/Logic Flaw

mod/chat/guisockets/index.php in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 does not consider the mod/chat:chat capability before authorizing daemon-mode chat, which allows remote authenticated users to bypass intended access...

CVE-2013-3751

Unspecified vulnerability in the XML Parser component in Oracle Database Server 11.2.0.2, 11.2.0.3, and 12.1.0.1 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors...

Design/Logic Flaw

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Data Manipulation Language...

CVE-2013-3763

The CVE-2013-3763 vector is a command-injection vulnerability in Oracle Endeca Server (Oracle Fusion Middleware) affecting 7.4.0 and 7.5.1.1 via the controlSoapBinding createDataStore method. Connected advisories (CPAIs) describe remote command execution with a flaw that can be exploited by sendi...

CVE-2013-3742

Cross-site scripting XSS vulnerability in viewcreate.php aka the Create View page in phpMyAdmin 4.x before 4.0.3 allows remote authenticated users to inject arbitrary web script or HTML via an invalid SQL CREATE VIEW statement with a crafted name that triggers an error message...

CentOS 4 : util-linux (CESA-2007:0235)

An updated util-linux package that corrects a security issue and fixes several bugs is now available. This update has been rated as having low security impact by the Red Hat Security Response Team. The util-linux package contains a collection of basic system utilities. A flaw was found in the way...

CVE-2013-4633

Huawei Seco Versatile Security Manager VSM before V200R002C00SPC300 allows remote authenticated users to gain privileges via a certain change to a group configuration setting...

Ruby on Rails exploit could hijack unpatched servers for botnet

Server Administrators are being urged to update their Ruby on Rails servers following the discovery of an active malware campaign targeting vulnerable versions of the web development framework. According to security researcher Jeff Jarmoc, Hackers are exploiting a known and patched vulnerability ...

Ruby on Rails exploit could hijack unpatched servers for botnet

Server Administrators are being urged to update their Ruby on Rails servers following the discovery of an active malware campaign targeting vulnerable versions of the web development framework. According to security researcher Jeff Jarmoc, Hackers are exploiting a known and patched vulnerability ...

ESA-2013-037: EMC AlphaStor Buffer Overflow Vulnerability

ESA-2013-037.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-037: EMC AlphaStor Buffer Overflow Vulnerability EMC Identifier: ESA-2013-037 EMC Identifier: NW150511 CVE Identifier: CVE-2013-0946 Severity Rating: CVSS v2 Base Score: 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C Affected product: • EMC...

CVE-2013-3057

Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote authenticated users to bypass intended privilege requirements and list the privileges of arbitrary users via unspecified vectors...