Memory corruption

WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-09-18-2...

Memory corruption

WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-09-18-2...

Cisco Digital Media Manager < 5.3 Privilege Escalation

The remote device is running a version of Cisco Digital Media Manager prior to 5.3. As such, it is affected by a privilege escalation vulnerability. A remote, authenticated attacker could leverage this to execute arbitrary code on the device. TRUSTED...

Cisco Network Admission Control Guest Server System Software Authentication Bypass (cisco-sa-20110330-nac)

The remote Cisco Network Admission Control NAC Manager may be affected by an access restriction bypass vulnerability in the RADIUS authentication software. This vulnerability could allow a remote/unauthenticated attacker access to a protected network. C Tenable Network Security, Inc...

Mac OS X : Apple Safari < 5.1.10 Memory Corruptions

The version of Apple Safari installed on the remote Mac OS X 10.6 host is earlier than 5.1.10. It is, therefore, potentially affected by two memory corruption vulnerabilities in JavaScriptCore's JSArray::sort method. By tricking a user into visiting a malicious website, an attacker could leverage...

Fedora 18 : drupal7-theme-zen-5.4-1.fc18 (2013-15142)

Update to upstream 5.4 release for security and bug fixes - SA-CONTRIB-2013-070 https://drupal.org/node/2071157 - Upstream changelog for this release is available at https://drupal.org/node/2071055 Note that Tenable Network Security has extracted the preceding description block directly from the...

Fedora 18 : drupal7-entity-1.2-1.fc18 (2013-14930)

Update to upstream 1.2 release for security and bug fixes - Upstream changelog for this release is available at https://drupal.org/node/2065197 - SA-CONTRIB-2013-068 https://drupal.org/node/2065207 Note that Tenable Network Security has extracted the preceding description block directly from the...

Fedora 19 : drupal7-theme-zen-5.4-1.fc19 (2013-15147)

Update to upstream 5.4 release for security and bug fixes - SA-CONTRIB-2013-070 https://drupal.org/node/2071157 - Upstream changelog for this release is available at https://drupal.org/node/2071055 Note that Tenable Network Security has extracted the preceding description block directly from the...

FreeBSD-SA-13:10.sctp

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-13:10.sctp Security Advisory The FreeBSD Project Topic: Kernel memory disclosure in sctp4 Category: core Module: sctp Announced: 2013-08-22 Credits: Julian Seward...

SA-CONTRIB-2013-069 - Password Policy - XSS

This module enables you to specify a certain level of password complexity aka. "password hardening" for user passwords in Drupal by defining a password policy. When viewing and editing a password policy, the module doesn't sufficiently filter the form text field input and display for the "Passwor...

SA-CONTRIB-2013-064 - Persona - Cross site request forgery (CSRF)

This module enables users to sign into a Drupal website using Mozilla Persona. The module uses a security token to ensure that a sign-in request is made from a web page that is participating in the current session. It was possible for a security token that was not of type "string" to be accepted ...

Cisco Secure Access Control System TACACS+ Authentication Bypass (cisco-sa-20121107-acs)

The version of Cisco Secure Access Control ACS running on the remote host has an authentication bypass vulnerability. When the system is configured with an LDAP external identity store and TACACS+ is the authentication protocol, the user-supplied password is not properly validated. A remote...

FreeBSD : bind -- denial of service vulnerability (7943e521-f648-11e2-8607-3c970e169bc2)

ISC reports : A specially crafted query that includes malformed rdata can cause named to terminate with an assertion failure while rejecting the malformed query. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the...

Kernel: sa_restorer information leak

The flushsignalhandlers function in kernel/signal.c in the Linux kernel before 3.8.4 preserves the value of the sarestorer field across an exec operation, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application containing a sigaction system call...

Kernel: sa_restorer information leak

The flushsignalhandlers function in kernel/signal.c in the Linux kernel before 3.8.4 preserves the value of the sarestorer field across an exec operation, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application containing a sigaction system call...

Oracle Linux 6 : krb5 (ELSA-2011-0200)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0200 advisory. - add upstream patches to fix standalone kpropd exiting if the per-client child process exits with an error, and hang or crash in the KDC when using th...

Oracle Linux 5 : krb5 (ELSA-2010-0926)

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2010-0926 advisory. 1.6.1-36.el55.6 - incorporate candidate patch for checksum acceptance issues from MITKRB5-SA-2010-007 CVE-2010-1323, 652307 Tenable has extracted the preceding...

Oracle Linux 5 : krb5 (ELSA-2012-0306)

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2012-0306 advisory. - add upstream patch for telnetd buffer overflow CVE-2011-4862, 770351 - ftpd: add backported patch to check for errors when calling setegid MITKRB5-SA-2011-005...

Oracle Linux 6 : krb5 (ELSA-2011-1790)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2011-1790 advisory. 1.9-22.1 - add candidate patch to fix a NULL pointer dereference while processing TGS requests MITKRB5-SA-2011-007, 754046 Tenable has extracted the preceding...

SA-CONTRIB-2013-057 - TinyBox - Cross Site Scripting (XSS)

TinyBox module uses TinyBox, a lightweight and standalone modal window script. The main purpose of this module is to provide Splash Screen/Window as simple as possible. The module doesn't filter user-supplied text prior to display. The vulnerability is mitigated by the fact that an attacker must...