661 matches found
Default configuration
Apple Mac OS X before 10.9 does not preserve a certain administrative system-preferences setting across software updates, which allows context-dependent attackers to bypass intended access restrictions in opportunistic circumstances by leveraging an unintended security configuration after the...
CVE-2013-5189
Apple Mac OS X before 10.9 does not preserve a certain administrative system-preferences setting across software updates, which allows context-dependent attackers to bypass intended access restrictions in opportunistic circumstances by leveraging an unintended security configuration after the...
Apache Rave 0.11 0.20 - User Information Disclosure
Apache Rave 0.11 0.20 - User Information Disclosure CVE-2013-1814: Apache Rave exposes User over API Severity: Important Vendor: The Apache Software Foundation Versions Affected: Rave 0.11 to 0.20 Description: Rave returns the full user object, including the salted and hashed password, via the Us...
Emergency Zero-Day Patch Does Not Quiet Calls to Disable Java
Oracle’s emergency Java update this weekend for a zero-day sandbox bypass vulnerability hasn’t exactly kicked off a love-fest for the company among security experts. Researchers are still cautious about recommending users re-enable the ubiquitous software, despite the availability of the fix for...
DataArmor / DriveArmor Privilege Escalation / Decryption Vulnerability
DataArmor and DriveArmor versions prior to 3.0.12.861 suffer from restricted environment breakout, privilege escalation, and full disk decryption vulnerabilities. ======= Summary ======= Name: DataArmor Full Disk Encryption - Restricted Environment breakout, Privilege Escalation and Full Disk...
IBM WebSphere MQ 7.1 < 7.1.0.1 MQ SVRCONN Channels Security Configuration Bypass
The version of IBM WebSphere MQ server 7.1 installed on the remote Windows host is missing fix pack 7.1.0.1 or later. It is, therefore, affected by a vulnerability where client applications can bypass the security configuration setup on an MQ SVRCONN channel, allowing unauthorized users access to...
CVE-2012-3295
IBM WebSphere MQ 7.1, when an SVRCONN channel is used, allows remote attackers to bypass the security-configuration setup step and obtain queue-manager access via unspecified vectors...
websudo does not work with Confluence when it's integrated with Crowd SSO
h5. Steps to reproduce Integrate with Crowd with SSO|http://confluence.atlassian.com/display/DOC/Connecting+to+Crowd+or+JIRA+for+User+Management Go to Confluence Admin, it does not prompt to enter password websudo Go to Security Configuration. Note that it will look something like this:...
websudo does not work with Confluence when it's integrated with Crowd SSO
h5. Steps to reproduce Integrate with Crowd with SSO|http://confluence.atlassian.com/display/DOC/Connecting+to+Crowd+or+JIRA+for+User+Management Go to Confluence Admin, it does not prompt to enter password websudo Go to Security Configuration. Note that it will look something like this:...
websudo does not work with Confluence when it's integrated with Crowd SSO
h5. Steps to reproduce Integrate with Crowd with SSO|http://confluence.atlassian.com/display/DOC/Connecting+to+Crowd+or+JIRA+for+User+Management Go to Confluence Admin, it does not prompt to enter password websudo Go to Security Configuration. Note that it will look something like this:...
Digitalus 1.10.0 Alpha2 - Arbitrary File Upload
Digitalus 1.10.0 Alpha2 - Arbitrary File Upload Digitalus 1.10.0 Alpha2 Arbitrary File Upload vulnerability /\ \ /\ \ /\ /\ \ \ \ \L\ \ \ /'\ /\ \ \ ,\ \ \ \ \ /\ /\ \ /'\ \ , /\ \ /' \ /' \ \ \ /\ \ \ /'\ \ \ /\ \ \ /\ /\ \ \\ \ /\ /\ /\ \L\ \ \ \ \ \ \ \ /\ / \ \ \ /\ \\ \...
Access Point Web-browser Interface Vulnerability
The Cisco web-browser interface for Cisco access points and Cisco 3200 Series Wireless Mobile Interface Card WMIC, contains a vulnerability that could, under certain circumstances, remove the default security configuration from the managed access point and allow administrative access without...
List an Verify umask entrys in /etc/profile and ~/.profile
This plugin uses ssh to List an Verify umask entrys in /etc/profile and /.profile. OpenVAS Vulnerability Test $Id: GSHBSSHumask.nasl 7061 2017-09-05 11:50:40Z teissa $ List an Verify umask entrys in /etc/profile and /.profile Authors: Thomas Rotter Copyright: Copyright c 2010 Greenbone Networks...
Breakthrough anti-tampering continue to upload-vulnerability warning-the black bar safety net
Author: nuanfan The original author didn't post the picture out, so reprint this article in no picture. Technical points: breakthrough iGuard fckeditor upload tips 1. Foreword Following theSQL injectionprevailed, many of the home incurring malicious tampering, people urgently need a solution to...
Master of advanced clever change settings enhanced 3 3 8 9 intrusion-vulnerability warning-the black bar safety net
Many of my friends using the input by 3 3 8 9 port someone else's Server, be found in connection to the other machine, not like the network computer that can pass each file, which to a large extent, so that after the attack greatly reduced, in fact, hit on Microsoft's own“patch”can fix this...
1 4 3 3 sa weak password related command-and-vulnerability warning-the black bar safety net
A. Change the sa password methods: With sql integrated the use of the tool connected, perform the command: exec sppassword NULL,'newPassword','sa' Hint: with caution! II. Simple patch sa weak passwords. Method 1:query separator connected after the execution: if exists select from dbo. sysobjects...
BT Home Hub 6.2.2.6 - Login procedure Authentication Bypass
BT Home Hub 6.2.2.6 - Login procedure Authentication Bypass source: https://www.securityfocus.com/bid/26333/info BT Home Hub is prone to an authentication-bypass vulnerability. An attacker could exploit this issue to gain unauthorized access to the affected device. BT Home Hub firmware 6.2.2.6 is...
Unwanted Access to File System via Import Pages Functionality
security vulnerability found in Confluence 2.5.6 Space administrator can use the "Import Pages from Disk" feature to browse the server file system by pointing the importer at "/" folder or any other folder. Because this folder doesn't contain expected files, an error message is displayed,...
Information disclosure
MoveSortedContentAction in C1 Financial Services Contelligent 9.1.4 does not check "the additional environment security configuration," which allows remote attackers with write permissions to reorder components...
CVE-2007-1249
CVE-2007-1249 affects C1 Financial Services Contelligent 9.1.4, specifically the MoveSortedContentAction. The root cause is failure to validate the "additional environment security configuration," enabling remote attackers with write permissions to reorder components. The available document detai...