S3 Video <= 0.97 - VideoJS Cross Site Scripting

The s3-video WordPress plugin was affected by a VideoJS Cross Site Scripting security vulnerability...

openSUSE Security Update : samba (openSUSE-SU-2012:0507-1)

" - Add the ldapsmb sources as else patches against them have no chance to apply. - Samba pre-3.6.4 are affected by a vulnerability that allows remote code exe- cution as the 'root' user; PIDL based autogenerated code allows overwriting beyond of allocated array; CVE-2012-1182; bso8815...

openssl: freelist misuse causing a possible use-after-free

Race condition in the ssl3readbytes function in s3pkt.c in OpenSSL through 1.0.1g, when SSLMODERELEASEBUFFERS is enabled, allows remote attackers to inject data across sessions or cause a denial of service use-after-free and parsing error via an SSL connection in a multithreaded environment...

OpenStack Nova RBAC安全绕过漏洞

Bugtraq ID:65753 CVE ID:CVE-2014-0167 OpenStack是由Rackspace和NASA共同开发的云计算平台，帮助服务商和企业内部实现类似于Amazon EC2和S3的云基础架构。OpenStack Nova提供虚拟计算服务。 OpenStack Nova EC2 API安全组实现存在安全漏洞，如addrules, removerules 和destroy方法，受限用户可使用EC2 API绕过限制对安全组进行未授权操作。 0 OpenStack Nova 2013.1 - 2013.2.3 用户可参考如下厂商提供的安全补丁以修复该漏洞：...

OpenStack python-keystoneclient Cache安全绕过漏洞

OpenStack是由Rackspace和NASA共同开发的云计算平台，帮助服务商和企业内部实现类似于Amazon EC2和S3的云基础架构。 缓存处理多个，多次请求时存在错误，可被利用以另一个用户身份进行认证操作。 0 OpenStack python-keystoneclient 0.x OpenStack python-keystoneclient 0.7.0及之后版本以修复此漏洞，建议用户下载使用： https://launchpad.net/python-keystoneclient...

Slack: Data exports stored on S3 can be scraped easily

The URLs that are used to download the exports can be guessed easily by an attacker. The location of the export file is based on a date, a team ID and a team name: http://s3-us-west-2.amazonaws.com/slack-files2//export//%20Slack%20export%20.zip The information an attacker needs, is the team its...

CVE-2013-7279

Cross-site scripting XSS vulnerability in views/video-management/previewvideo.php in the S3 Video plugin before 0.983 for WordPress allows remote attackers to inject arbitrary web script or HTML via the base parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in views/video-management/previewvideo.php in the S3 Video plugin before 0.983 for WordPress allows remote attackers to inject arbitrary web script or HTML via the base parameter...

CVE-2013-7279

Cross-site scripting XSS vulnerability in views/video-management/previewvideo.php in the S3 Video plugin before 0.983 for WordPress allows remote attackers to inject arbitrary web script or HTML via the base parameter...

CVE-2013-7279

Summary: CVE-2013-7279 is an XSS flaw in the WordPress S3 Video plugin (pre-0.983) where the base parameter of preview_video.php is not sanitized, allowing remote attackers to inject arbitrary script/HTML. Affected software: S3 Video WordPress plugin before 0.983. The vulnerability is triggered v...

PT-2014-3328

Name of the Vulnerable Software and Affected Versions S3 Video plugin versions prior to 0.983 Description The issue is related to a cross-site scripting XSS vulnerability. This allows remote attackers to inject arbitrary web script or HTML. The vulnerability is specifically in the base parameter ...

CVE-2013-7279: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in views/video-management/previewvideo.php in the S3 Video plugin before 0.983 for WordPress allows remote attackers to inject arbitrary web script or HTML via the base parameter...

WordPress S3 Video Plugin <= 0.982 - XSS

Because of this vulnerability in views/video-management/previewvideo.php, the attackers can inject arbitrary web script or HTML via the "base" parameter. Solution Update the plugin...

PT-2013-1153

Name of the Vulnerable Software and Affected Versions OpenSSL versions 1.0.0 through 1.0.0p OpenSSL versions 1.0.1 through 1.0.1k openssl-1.0.1e openssl-devel-1.0.1e openssl-static-1.0.1e openssl-libs-1.0.1e openssl-debuginfo-1.0.1e Description The issue allows remote attackers to obtain access...

CVE-2012-6087

repository/s3/S3.php in the Amazon S3 library in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows...

CVE-2012-6087

repository/s3/S3.php in the Amazon S3 library in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows...

Code injection

repository/s3/S3.php in the Amazon S3 library in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows...

CVE-2012-6087

repository/s3/S3.php in the Amazon S3 library in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows...

CVE-2012-6087

CVE-2012-6087 affects Moodle’s repository/s3/S3.php in affected Moodle branches (up to 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, 2.5.x before 2.5.2). The issue is that the code does not verify that the server hostname matches the CN or SAN in the SSL certificate, allowing MITM attackers to ...

CVE-2012-6087

repository/s3/S3.php in the Amazon S3 library in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows...