USN-1903-1: Apache HTTP Server vulnerabilities

It was discovered that the modrewrite module incorrectly sanitized non- printable characters before writing data to log files. A remote attacker could possibly use this flaw to execute arbitrary commands by injecting escape sequences in the log file. CVE-2013-1862 It was discovered that the modda...

CVE-2013-2704

The CVE-2013-2704 entry concerns the WordPress plugin Dropdown Menu Widget (version 1.9.1). The vulnerability is described as a Cross-Site Request Forgery (CSRF) that allows remote attackers to hijack the authentication of arbitrary users for requests that insert Cross-Site Scripting (XSS) sequen...

Oracle Linux 3 / 4 : 4Suite (ELSA-2009-1572)

From Red Hat Security Advisory 2009:1572 : An updated 4Suite package that fixes one security issue is now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The 4Suite package contains XML-related...

MGASA-2013-0174 Updated apache packages fix security vulnerabilities

It was found that modrewrite did not filter terminal escape sequences from its log file. If modrewrite was configured with the RewriteLog directive, a remote attacker could use specially-crafted HTTP requests to inject terminal escape sequences into the modrewrite log file. If a victim viewed the...

Apache Tomcat Denial Of Service Vulnerability - Windows

Apache Tomcat Server is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Apache HTTP Server mod_rewrite Log File Manipulation Vulnerability

A vulnerability in the dorewritelog function of Apache HTTP Server could allow an unauthenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper handling of certain escape sequences by the affected software. An unauthenticated, remote attacker could...

httpd, mod_ssl security update

CentOS Errata and Security Advisory CESA-2013:0815 Updated httpd packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS...

httpd: mod_rewrite allows terminal escape sequences to be written to the log file

modrewrite.c in the modrewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Noma component in GroundWork Monitor Enterprise 6.7.0 allow remote attackers to hijack the authentication of unspecified victims for requests that 1 store XSS sequences or 2 delete entries...

CVE-2013-3513

Multiple cross-site request forgery CSRF vulnerabilities in the Noma component in GroundWork Monitor Enterprise 6.7.0 allow remote attackers to hijack the authentication of unspecified victims for requests that 1 store XSS sequences or 2 delete entries...

CVE-2013-2709

Cross-site request forgery CSRF vulnerability in the FourSquare Checkins plugin before 1.3 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the FourSquare Checkins plugin before 1.3 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences...

CVE-2013-2709

CVE-2013-2709 is a CSRF vulnerability in the WordPress plugin Foursquare Checkins prior to version 1.3. The issue allows remote attackers to hijack the authentication of arbitrary users by issuing requests that insert XSS sequences. The root cause is insufficient CSRF protection in the plugin’s h...

CVE-2013-2696

Cross-site request forgery CSRF vulnerability in the All in One Webmaster plugin before 8.2.4 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences...

CVE-2013-2696

Cross-site request forgery CSRF vulnerability in the All in One Webmaster plugin before 8.2.4 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the WP-DownloadManager plugin before 1.61 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences...

CVE-2013-2697

Cross-site request forgery CSRF vulnerability in the WP-DownloadManager plugin before 1.61 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences...

CVE-2013-2697

CVE-2013-2697 is a CSRF vulnerability in the WP-DownloadManager WordPress plugin prior to 1.61. The issue allows remote attackers to hijack the authentication of arbitrary users by sending requests that insert XSS sequences, as described across multiple sources. Affected product: WordPress plugin...

[Acunetix Web Vulnerability Scanner 8] Automated Web Application Security Testing Tool

Acunetix W eb V ulnerability S canner WVS is an automated web application security testing tool that audits your web applications by checking for exploitable hacking vulnerabilities. Automated scans may be supplemented and cross-checked with the variety of manual tools to allow for comprehensive...

CVE-2013-0252

The CVE-2013-0252 entry concerns Boost.Locale’s boost::locale::utf::utf_traits, where Boost versions 1.48–1.52 fail to detect certain invalid UTF-8 sequences. This could allow bypassing input validation via crafted trailing bytes. Connected advisories (openSUSE, SUSE, Mandriva/MDVSA-2013:065, Fed...