UBUNTU-CVE-2014-8960

Cross-site scripting XSS vulnerability in libraries/errorreport.lib.php in the error-reporting feature in phpMyAdmin 4.1.x before 4.1.14.7 and 4.2.x before 4.2.12 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename...

CVE-2014-8960

CVE-2014-8960 is a cross-site scripting flaw in phpMyAdmin’s error-reporting, exploitable by a remote authenticated user via a crafted filename. It affects phpMyAdmin 4.1.x prior to 4.1.14.7 and 4.2.x prior to 4.2.12, with the issue located in libraries/error_report.lib.php. The vulnerability all...

CVE-2014-8960

Cross-site scripting XSS vulnerability in libraries/errorreport.lib.php in the error-reporting feature in phpMyAdmin 4.1.x before 4.1.14.7 and 4.2.x before 4.2.12 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename...

phpMyAdmin -- XSS and information disclosure vulnerabilities

The phpMyAdmin development team reports: With a crafted database, table or column name it is possible to trigger an XSS attack in the table browse page. With a crafted ENUM value it is possible to trigger XSS attacks in the table print view and zoom search pages. With a crafted value for font siz...

Leakage of line count of an arbitrary file.

PMASA-2014-16 Announcement-ID: PMASA-2014-16 Date: 2014-11-20 Summary Leakage of line count of an arbitrary file. Description In the error reporting feature, a parameter specifying the file was not correctly validated, allowing the attacker to derive the line count of an arbitrary file. Severity ...

XSS vulnerability in error reporting functionality.

PMASA-2014-15 Announcement-ID: PMASA-2014-15 Date: 2014-11-20 Summary XSS vulnerability in error reporting functionality. Description With a crafted file name it is possible to trigger an XSS in the error reporting page. Severity We consider this vulnerability to be non critical. Mitigation facto...

Lame Duck Senate to Vote on NSA Reforming USA FREEDOM Act

The United States Senate will move to vote on the USA FREEDOM Act before the current congressional session closes at the end of the year, a move that pleases digital rights groups. In its current form, the bill would ban the bulk collection of Americans’ private records while granting the...

CentOS 6 : php (CESA-2013:1615)

Updated php packages that fix three security issues, several bugs, and add one enhancement are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which giv...

Retail Trade Groups Want Fair Data Breach Reporting Rules

The National Retail Federation and dozens of other related groups cosigned a letter PDF to top congressional leaders last week pleading that they consider the passage of a federal law imposing uniform data breach notification rules that are equally applicable to every organization that handles...

Webfwlog 1.01 - Web-Based Firewall Log Analysis and Reporting

Webfwlog is a flexible web-based firewall log analyzer and reporting tool. It supports standard system logs for linux, FreeBSD, OpenBSD, NetBSD, Solaris, Irix, OS X, etc. as well as Windows XP®. Supported log file formats are netfilter, ipfilter, ipfw, ipchains and Windows XP®. Webfwlog also...

Web Auditing Framework: GoLismero

GoLismero is an open source framework for security testing. It’s currently geared towards web security, but it can easily be expanded to other kinds of scans. Features: Real platform independence. Tested on Windows, Linux, BSD and OS X. No native library dependencies. All of the framework has bee...

F5 Networks BIG-IP : GnuTLS vulnerability (SOL15637)

The gnutlsciphertext2compressed function in lib/gnutlscipher.c in GnuTLS 2.12.23 allows remote attackers to cause a denial of service buffer over-read and crash via a crafted padding length. NOTE: this might be due to an incorrect fix for CVE-2013-0169. C Tenable Network Security, Inc. The...

[SECURITY] Fedora 21 Update: haproxy-1.5.4-1.fc21

HAProxy is a TCP/HTTP reverse proxy which is particularly suited for high availability environments. Indeed, it can: - route HTTP requests depending on statically assigned cookies - spread load among several servers while assuring server persistence through the use of HTTP cookies - switch to...

Veeam ONE 7.0 Patch 2 Release Notes

Challenge Release Notes for Veeam ONE 7.0 Patch 2. Cause Please confirm you are running Veeam ONE 7 or Veeam ONE 7R2 prior to installing this update. You can check this under Help | About in Veeam ONE Monitor Client, the build number should be 7.0.0.xxx. After upgrading, your version build will b...

IBM Rational License Key Server Administration and Reporting Tool Default Credentials

Nessus was able to login to the remote web interface for the IBM Rational License Key Server Administration and Reporting Tool using a default set of known credentials. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

IBM Rational License Key Server Administration and Reporting Tool 8.1.4.x < 8.1.4.4 Multiple Vulnerabilities

The remote host is running a version 8.1.4.x of IBM Rational License Key Server Administration and Reporting Tool RLKS that is prior to 8.1.4.4. It is, therefore, affected by multiple vulnerabilities : - The secure flag for session cookies is not properly set when in SSL mode. An attacker can...

CVE-2014-0909

The Administration and Reporting Tool in IBM Rational License Key Server RLKS 8.1.4.x before 8.1.4.4 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

Code injection

The Administration and Reporting Tool in IBM Rational License Key Server RLKS 8.1.4.x before 8.1.4.4 allows remote authenticated users to hijack sessions via unspecified vectors...

CVE-2014-3079

The Administration and Reporting Tool in IBM Rational License Key Server RLKS 8.1.4.x before 8.1.4.4 allows remote authenticated users to bypass authorization checks and visit unspecified URLs with license-usage data via a DESCRIBE clause in a SPARQL query...

Syslog LogAnalyzer 3.6.5 - Stored XSS Exploit

Exploit for multiple platform in category web applications Vulnerability title: Syslog LogAnalyzer 3.6.5 Stored XSS Author: Dolev Farhi Contact: dolevf at yahoo dot com @dolevff Application: LogAnalyzer 3.6.5 Date: 8.2.2014 Relevant CVEs: CVE-2014-6070 Vulnerable version: alert"xss", and sending ...