CVE-2014-3707

The curleasyduphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPTCOPYPOSTFIELDS option, does not properly copy HTTP POST data for an easy handle, which triggers an out-of-bounds read that allows remote web servers to read sensitive memory information...

CVE-2014-3707

The curleasyduphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPTCOPYPOSTFIELDS option, does not properly copy HTTP POST data for an easy handle, which triggers an out-of-bounds read that allows remote web servers to read sensitive memory information...

Monitor Networks for Rogue DHCP servers – DHCPSnoop

Monitor Networks for Rogue DHCP servers DHCPSnoop will listen on a network interface for DHCP replies from it’s own DHCP requests and any other requests it can see during the runtime. It will then verify the DHCP response parameters that are returned against the settings in it’s configuration fil...

RHEL 6 : Virtualization Manager (RHSA-2012:1506)

Red Hat Enterprise Virtualization Manager 3.1 is now available. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available for each vulnerability from the C...

[SECURITY] Fedora 19 Update: hostapd-2.0-5.fc19

hostapd is a user space daemon for access point and authentication servers. It implements IEEE 802.11 access point management, IEEE 802.1X/WPA/WPA2/EAP Authenticators and RADIUS authentication server. hostapd is designed to be a "daemon" program that runs in the back-ground a nd acts as the backe...

CVE-2014-7989: Improper Input Validation

Cisco Unified Computing System on B-Series blade servers allows local users to gain shell privileges via a crafted 1 ping6 or 2 traceroute6 command, aka Bug ID CSCuq38176...

PT-2014-8361

Name of the Vulnerable Software and Affected Versions Cisco Unified Computing System on B-Series blade servers affected versions not specified Description The issue allows local users to gain shell privileges through crafted commands, specifically via ping6 or traceroute6. Recommendations At the...

CVE-2014-8352

Cross-site scripting XSS vulnerability in json.php in French National Commission on Informatics and Liberty aka CNIL CookieViz allows remote we servers to inject arbitrary web script or HTML via the maxdate parameter...

CVE-2014-8351

SQL injection vulnerability in info.php in French National Commission on Informatics and Liberty aka CNIL CookieViz before 1.0.1 allows remote web servers to execute arbitrary SQL commands via the domain parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in json.php in French National Commission on Informatics and Liberty aka CNIL CookieViz allows remote we servers to inject arbitrary web script or HTML via the maxdate parameter...

Sql injection

SQL injection vulnerability in info.php in French National Commission on Informatics and Liberty aka CNIL CookieViz before 1.0.1 allows remote web servers to execute arbitrary SQL commands via the domain parameter...

CVE-2014-8351

SQL injection vulnerability in info.php in French National Commission on Informatics and Liberty aka CNIL CookieViz before 1.0.1 allows remote web servers to execute arbitrary SQL commands via the domain parameter...

CVE-2014-8351

CVE-2014-8351 concerns CNIL CookieViz (info.php) prior to 1.0.1, where a SQL injection via the domain parameter allows remote servers to execute arbitrary SQL commands. The vulnerability affects CookieViz’s handling of input in info.php, enabling attacker-controlled SQL execution. Public referenc...

Xxe

IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x through 7.0.0.8 allows remote authenticated users to read arbitrary files or send TCP requests to intranet servers via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity...

PT-2014-6110

Name of the Vulnerable Software and Affected Versions IBM WebSphere Commerce versions 6.x through 6.0.0.11 IBM WebSphere Commerce versions 7.x through 7.0.0.8 Description The issue allows remote authenticated users to read arbitrary files or send TCP requests to intranet servers via XML data...

Medium: wget

Issue Overview: Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicate...

CVE-2014-8474

CA Cloud Service Management CSM before Summer 2014 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service CPU and memory consumption via an XML document containing an external entity declaration in conjunction with an entity reference...

Xxe

CA Cloud Service Management CSM before Summer 2014 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service CPU and memory consumption via an XML document containing an external entity declaration in conjunction with an entity reference...

CVE-2014-8474

CA Cloud Service Management CSM before Summer 2014 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service CPU and memory consumption via an XML document containing an external entity declaration in conjunction with an entity reference...

FreeBSD : jenkins -- slave-originated arbitrary code execution on master servers (0dad9114-60cc-11e4-9e84-0022156e8794)

Kohsuke Kawaguchi from Jenkins team reports : Historically, Jenkins master and slaves behaved as if they altogether form a single distributed process. This means a slave can ask a master to do just about anything within the confinement of the operating system, such as accessing files on the maste...