Oracle Linux 5 / 6 : xinetd (ELSA-2013-1409)

The remote Oracle Linux 5 / 6 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2013-1409 advisory. 2:2.3.14-39 - Honor user and group directives - Resolves: CVE-2013-4342 Tenable has extracted the preceding description block directly from the Oracle Linux...

Cisco Unified Computing System Fabric Interconnect create certreq Command Injection Vulnerability

A vulnerability in the create certreq command of the Cisco Unified Computing System fabric interconnect could allow an authenticated, local attacker to execute commands and obtain an interactive Linux shell as the root user. The vulnerability is due to a failure to properly sanitize user input. A...

Cisco Unified Computing System Fabric Interconnect clear sshkey Command Injection Vulnerability

A vulnerability in the clear sshkey command of the Cisco Unified Computing System fabric interconnect could allow an authenticated, local attacker to execute commands and obtain an interactive Linux shell as the root user. The vulnerability is due to a failure to properly sanitize user input. An...

Cisco Unified Computing System Fabric Interconnect run-script Command Injection Vulnerability

A vulnerability in the run-script command of the Cisco Unified Computing System fabric interconnect could allow an authenticated, local attacker to execute commands and obtain an interactive Linux shell as the root user. The vulnerability is due to a failure to properly sanitize user input. An...

Cisco Unified Computing System Fabric Interconnect activate firmware Command Injection Vulnerability

A vulnerability in the activate firmware command of the Cisco Unified Computing System fabric interconnect could allow an authenticated, local attacker to execute commands and obtain an interactive Linux shell as the root user. The vulnerability is due to a failure to properly sanitize user input...

HP LeftHand Virtual SAN Appliance hydra Ping Hostname Overflow

Added: 09/19/2013 CVE: CVE-2012-3285 BID: 57754 OSVDB: 89919 Background HP LeftHand Virtual SAN Appliance VSA software is a VMware certified SAN/storage device and virtual appliance that provides complete SAN functionality for VMware Infrastructure without external SAN hardware. Problem HP LeftHa...

PineApp Mail-SeCure ldapsyncnow.php Remote Command Execution

A remote command execution vulnerability has been reported in PineApp Mail-SeCure. The vulnerability is due to exposing of the ldapsyncnow.php file of the administration web interface. A remote attacker can exploit this vulnerability by sending a specially crafted request to the vulnerable server...

IBM 1754 GCM16 and GCM32 Global Console Managers Multiple Command Execution Vulnerabilities

IBM 1754 GCM16 and GCM32 Global Console Managers are prone to multiple command-execution vulnerabilities because they fail to sanitize user-supplied input. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

FreeBSD Security Advisory FreeBSD-SA-13:08.nfsserver

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-13:08.nfsserver Security Advisory The FreeBSD Project Topic: Incorrect privilege validation in the NFS server Category: core Module: nfsserver Announced: 2013-07-...

Symantec Web Gateway 5.1.0 - Multiple Vulnerabilities

Exploit for php platform in category web applications ======================================================================= title: Multiple vulnerabilities - Surveillance via Symantec Web Gateway product: Symantec Web Gateway vulnerable version: = 5.1.0. fixed version: 5.1.1 CVE number:...

Hewlett-Packard LeftHand Virtual SAN Appliance Hydra Login Remote Command Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP LeftHand Virtual SAN Appliance. Authentication is not required to exploit this vulnerability. The flaw exists within the hydra service, specifically with the LHNSessionManager component. This...

DD-WRT 24-sp2 CSRF / Command Injection

DD-WRT v24-sp2 is prone to command injection from specially crafted configuration values containing shell meta-characters. A remote attacker can potentially use CSRF from an authenticated client to execute commands on the router as the root user. Successful exploitation can result in system wide...

Fedora 17 : livecd-tools-17.17-1.fc17 (2013-9111)

The livecd-tools package provides support for reading and executing Kickstart files in order to create a system image. It was discovered that livecd-tools gave the root user an empty password rather than leaving the password locked in situations where no 'rootpw' directive was used or when the...

AIX 6.1 TL 7 : tftp (IV42932)

A non-root user can read and overwrite files owned by others including root via tftp client. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text in the description was extracted from AIX Security Advisory tftpadvisory.asc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

AIX 7.1 TL 0 : tftp (IV42934)

A non-root user can read and overwrite files owned by others including root via tftp client. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text in the description was extracted from AIX Security Advisory tftpadvisory.asc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

AIX 6.1 TL 8 : tftp (IV42933)

A non-root user can read and overwrite files owned by others including root via tftp client. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text in the description was extracted from AIX Security Advisory tftpadvisory.asc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

tftp Security Vulnerability

IBM SECURITY ADVISORY First Issued: Wed Jul 3 09:33:57 CDT 2013 | Updated: Mon Oct 14 20:17:56 CDT 2013 | Update: Fixed vulnerable fileset levels | Update: More workarounds and CVSS Vector | Update: Includes VIOS in the vulnerability summary | Updated: Thu Dec 12 12:55:11 CST 2013 | Update: 1...

Sprite Software Android Race Condition

Subject: Race condition in Sprite Software's backup software, installed by OEM on LG Android devices. CVE ID: CVE-2013-3685 Initial disclosure: https://plus.google.com/110348415484169880343/posts/Me2yea2PgwE Source: https://github.com/CunningLogic/LGPwn Effect: Locally exploited vulnerability wit...

MobileIron Virtual Smartphone Platform Privilege Escalation

MobileIron Virtual Smartphone Platform Privilege Escalation Exploit 0day ======================================================================== The MobileIron Virtual Smartphone Platform is the first solution to combine data-driven smartphone and tablet management with real-time wireless cost...

MobileIron Virtual Smartphone Platform - Privilege Escalation

MobileIron Virtual Smartphone Platform Privilege Escalation Exploit 0day ======================================================================== The MobileIron Virtual Smartphone Platform is the first solution to combine data-driven smartphone and tablet management with real-time wireless cost...