Fedora 19 : drupal6-6.29-1.fc19 (2013-22507)

Update to upstream 6.29 release for security fixes - Upstream changelog for this release is available at https://drupal.org/drupal-6.29-release-notes - SA-CORE-2013-003 - Drupal core - Multiple vulnerabilities - http://drupal.org/SA-CORE-2013-003 Note that Tenable Network Security has extracted...

CVE-2013-6180

The CVE-2013-6180 issue affects EMC RSA Security Analytics (SA) 10.x prior to 10.3 and RSA NetWitness NextGen 9.8, where SA Core does not verify that requests originate from the SA REST UI, allowing untrusted user agents (e.g., web browsers) to bypass access restrictions. This could enable core-a...

[ MDVSA-2013:287 ] drupal

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:287 http://www.mandriva.com/en/support/security/ Package : drupal Date : November 26, 2013 Affected: Business Server 1.0 Problem Description: Multiple security issues was identified and fixed in drupal: Drup...

Fedora 19 : drupal7-7.24-1.fc19 (2013-21844)

Update to upstream 7.24 release for security fixes - Upstream changelog for this release is available at https://drupal.org/drupal-7.24-release-notes - SA-CORE-2013-003 - Drupal core - Multiple vulnerabilities - http://drupal.org/SA-CORE-2013-003 Note that Tenable Network Security has extracted...

Mandriva Linux Security Advisory : drupal (MDVSA-2013:287-1)

Multiple security issues was identified and fixed in drupal : Drupal core's Image module allows for the on-demand generation of image derivatives. This capability can be abused by requesting a large number of new derivatives which can fill up the server disk space, and which can cause a very high...

Kernel: net: information leak in AF_KEY notify

The 1 keynotifysaflush and 2 keynotifypolicyflush functions in net/key/afkey.c in the Linux kernel before 3.10 do not initialize certain structure members, which allows local users to obtain sensitive information from kernel heap memory by reading a broadcast message from the notify interface of ...

SA-CONTRIB-2013-095 - Organic Groups - Access bypass

Two issues exist within entity references and permissions relating to OG, allowing users potential access bypass. Posting content into groups where a user is not a member Organic Groups does not sufficiently check the group audience fields e.g. oggroupref field from being populated with invalid...

Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerability (cisco-sa-20131106-sip)

A vulnerability exists in the Session Initiation Protocol SIP implementation in Cisco IOS Software that could allow an unauthenticated, remote attacker to cause a reload of an affected device or cause memory leaks that may result in system instabilities. To exploit this vulnerability, affected...

Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers (cisco-sa-20131030-asr1000)

Cisco IOS XE Software for 1000 Series Aggregation Services Routers ASR contains the following denial of service DoS vulnerabilities : - Cisco IOS XE Software TCP Segment Reassembly Denial of Service Vulnerability CVE-2013-5543 - Cisco IOS XE Software Malformed EoGRE Packet Denial of Service...

SA-CONTRIB-2013-088 - Secure Pages - Missing Encryption of Sensitive Data

The Secure Pages module manages redirects between HTTP and HTTPS pages. A flaw in the URL path matching could lead some pages and forms to be transmitted via plain HTTP, even if the administrator intended those pages to use HTTPS. This flaw may surface either due to a malicious user enticing a us...

SA-CONTRIB-2013-085 - Feed Element Mapper - Cross Site Scripting

Feed Element Mapper is an add-on module for FeedAPI that maps elements on a feed item such as tags or the author name to taxonomy or CCK fields. The module doesn't sufficiently filter text when displaying options to users. This vulnerability is mitigated by the fact that an attacker must have a...

Mac OS X : Java for OS X 2013-005

The remote Mac OS X 10.7 or 10.8 host has a Java runtime that is missing the Java for OS X 2013-005 update, which updates the Java version to 1.6.065. It is, therefore, affected by multiple security vulnerabilities, the most serious of which may allow an untrusted Java applet to execute arbitrary...

Cisco Unity Connection Administrator Password Bypass (cisco-sa-20120229-cuc)

Cisco Unity Connection before 7.1.3bSu2 / 7.1.5 allows remote, authenticated users to change the administrative password by leveraging the Help Desk Administrator role, aka Bug ID CSCtd45141. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid70197; scriptversion"1.6";...

Code injection

The NTP implementation in Cisco IOS 12.0 through 12.4 and 15.0 through 15.1, and IOS XE 2.1 through 3.3, does not properly handle encapsulation of multicast NTP packets within MSDP SA messages, which allows remote attackers to cause a denial of service device reload by leveraging an MSDP peer...

Cisco Unity Remote Administration Authentication Bypass (cisco-sa-20081008-unity)

According to its self-reported version number, the installation of Cisco Unity on the remote host may be affected by an authentication bypass vulnerability. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. Additionally,...

Cisco Unified IP Phones Privilege Escalation (cisco-sa-20130109-uipphone)

According to its self-reported version, the version of the Cisco Unified IP Phone software running on the remote device has a local privilege escalation vulnerability. Local attackers can exploit this issue to gain elevated privileges. Successful exploits could result in the complete compromise o...

Cisco Unified Communications Manager UDP Memory Leak DoS (CSCub85597)

According to its self-reported version, the remote Cisco Unified Communications Manager CUCM device insufficiently limits the rate of traffic on certain UDP ports, allowing a remote attacker to cause a denial of service condition by sending UDP packets at a high rate. %NASLMINLEVEL 70300 C Tenabl...

Intel Xeon Baseboard Management Component (BMC) Privilege Escalation (INTEL-SA-00026)

The version of the Intel BIOS on the remote device indicates that the Baseboard Management Component BMC firmware it is running is affected by an unspecified privilege escalation vulnerability. A knowledgeable remote malicious attacker could leverage this issue to deny service to legitimate users...

CVE-2013-1042

WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-09-18-2...

Memory corruption

WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-09-18-2...