jsupload.cgi.pl 0.6.4 Directory Traversal

------------------------------------------------------------------------------------------------------------- Directory traversal vulnerabilities in jsupload.cgi.pl version 0.6.4 and before 29 November 2012 Sean de Regge seanderegge gmail.com...

CVE-2012-5918

razorCMS 1.2 allows remote authenticated users to access administrator directories and files by creating and deleting a directory...

CVE-2012-5453

SQL injection vulnerability in user/indexinlineeditorsubmit.php in ATutor AContent 1.2-1 allows remote authenticated users to execute arbitrary SQL commands via the field parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-5167...

CVE-2012-3149

CVE-2012-3149 affects Oracle MySQL Server, specifically the MySQL Server component in MySQL 5.5.26 and earlier. The vulnerability is described as unspecified but related to the MySQL Client and allows remote authenticated users to affect confidentiality. Connected advisories confirm the issue acr...

Videosmate Organizer 4.2 Authentication Bypass / Path Disclosure

===================================================================== Vulnerable software: Videosmate Organizer V 4.2 all versions Vendor: http://videosmate.com/ Software License: Commercial Vulns: Authentication Bypass & Path Disclosure Risk: Critical Dork: intext:Powered by Videosmate Organizer...

CVE-2012-3491

src/condorschedd.V6/schedd.cpp in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 does not properly check the permissions of jobs, which allows remote authenticated users to remove arbitrary idle jobs via unspecified vectors...

YingZhi Python 1.9 Arbitrary Traversal / Write

YingZhi Python Programming Language for iOS Vendor: XiaoWen Huang Version 1.9. Product Websites http://sosilen.blog.163.com http://www.iphoneappstorm.com/iphone-apps/utilities/com.yingzhi.python/yingzhipython.php?id=493505744 YingZhi Description: Python Interpreter is a native python development...

CVE-2011-4961

SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6 allows remote authenticated users with the EDITPERMISSIONS permission to gain administrator privileges via a TreeMultiselectField that includes admin groups when adding a user to the selected groups...

Slackware: Security Advisory (SSA:2009-290-02)

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2012-1649

CVE-2012-1649 affects the Drupal Cool Aid module prior to 6.x-1.9. The vulnerability is an access-control bypass that allows remote authenticated users with the administer coolaid permission to modify arbitrary pages via unspecified vectors. The root cause is insufficient access restriction enfor...

Mandrake Linux Security Advisory : pam (MDKSA-2000:029)

There is a problem with the pamconsole module that incorrectly identifies remote X logins for displays other than :0 for example, :1, :2, etc. as being local displays, thus giving control of the console to the remote user. Because the remote user has control of the console they are able to issue...

AST-2012-012: Asterisk Manager User Unauthorized Shell Access

Asterisk Project Security Advisory - AST-2012-012 Product Asterisk Summary Asterisk Manager User Unauthorized Shell Access Nature of Advisory Permission Escalation Susceptibility Remote Authenticated Sessions Severity Minor Exploits Known No Reported On July 13, 2012 Reported By Zubair Ashraf of...

FreeBSD : coppermine -- Multiple vulnerabilities (6dd5e45c-f084-11e1-8d0f-406186f3d89d)

The Coppermine Team reports : The release covers several path disclosure vulnerabilities. If unpatched, it's possible to generate an error that will reveal the full path of the script. A remote user can determine the full path to the web root directory and other potentially sensitive information...

CVE-2012-4579

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via a Table Operations 1 TRUNCATE or 2 DROP link for a crafted table name, 3 the Add Trigger popup within a Triggers page that references...

WordPress <= 3.4.1 - Multiple vulnerabilities

Multiple vulnerabilities are in the wp-admin/plugins.php. Because of that, remote authenticated users can make unintended plugin changes by leveraging the Administrator role. Solution Update WordPress...

PYSEC-2012-21

virt/disk/api.py in OpenStack Compute Nova 2012.1.x before 2012.1.2 and Folsom before Folsom-3 allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image that uses a symlink that is only readable by root. NOTE: this vulnerability exists because of an...

Scientific Linux Security Update : squid on SL6.x i386/x86_64

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. A buffer overflow flaw was found in the way Squid parsed replies from remote Gopher servers. A remote user allowed to send Gopher requests to a Squid proxy could possibly use this flaw...

PYSEC-2012-39

virt/disk/api.py in OpenStack Compute Nova Folsom 2012.2, Essex 2012.1, and Diablo 2011.3 allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image...

CVE-2011-4584

The MNET authentication functionality in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 allows remote authenticated users to impersonate other user accounts by using the Login As feature in conjunction with a remote MNET single sign-on capability, as demonstrated by a Maha...

CVE-2012-0795

Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 does not validate e-mail address settings, which allows remote authenticated users to have an unspecified impact via a crafted address...