3993 matches found
Authentication flaw
IBM Tivoli Federated Identity Manager TFIM before 6.1.1.14, 6.2.0 before 6.2.0.12, and 6.2.1 before 6.2.1.4 allows context-dependent attackers to discover 1 a cleartext LDAP Bind Password, 2 keystore passwords, 3 a cleartext Basic Authentication password from a client, or 4 a cleartext user...
Chrome For Android API Exposure
CVE Number: CVE-2012-4907 Title: Chrome for Android - Android APIs exposed to JavaScript Affected Software: Confirmed on Chrome for Android v18.0.1025123 Credit: Takeshi Terada Issue Status: v18.0.1025308 was released which fixes this vulnerability Overview: By abusing Java objects exposed to...
Dolphin3D 1.52 / 1.60 Command Execution
Dolphin3D web browser ActiveX Remote Command Execution Date: Dez 9 2012 Author: Rh0 Affected Version: Dolphin3D 1.52 and 1.60 Tested on: Windows XP Professional SP3 EN require 'msf/core' class Metasploit3 'Dolphin3D web browser ActiveX Exec', 'Description' = %q This module exploits the default...
anwsion后台一个设置缺陷
简要描述： 这个应该是中。 详细说明： 程序在后台设置没有HASH来限制CSRF的防御,故导致一些可能出现的危害 http://127.0.0.1:8080/wenda/?/admin/setting/syssaveajax/...
PHPCMS V9 member table of contents feel free to modify the vulnerability and fix-vulnerability warning-the black bar safety net
A variable is not initialized causing the server setting registerglobal=On when members can freely modify their own member information. Due to the need registerglobal=On support, the impact is limited.. Vulnerability relates to members can modify their own balance lead to the website may have...
53KF企业在线平台某后台权限泄露
简要描述： 53KF企业在线平台某后台权限泄露 详细说明： 出问题的地方：主要留言 主页留言，为过滤清楚，导致后台权限信息泄露 漏洞证明： 系统设置...
Vanilla Forums version 2.1.a26 contains a parameter manipulation vulnerability
Overview Vanilla Forums version 2.1.a26 and possibly other versions is vulnerable to parameter manipulation via the "edit profile" page of authenticated users. Description CWE-280: Improper Handling of Insufficient Permissions or PrivilegesVanilla Forums version 2.1.a26 and possibly other version...
Fedora 18 : dracut-024-5.git20121019.fc18 (2012-16448)
fixed ifup exit code - fixed default 'rd.auto' parameter setting - only 'warn' not 'error', if we don't strip the initramfs - do not overwrite ifcfg from anaconda - ssh-client module fixes - strip binaries in the initramfs by default now - fixes for systemd and crypto - new dracut kernel command...
OpenJDK: disable Gopher support by default (Gopher, 7189567)
Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.238 and earlier allows remote authenticated users to have an unspecified impact via unknown vectors related to Networking...
Authorization
Eucalyptus before 3.1.1 does not properly restrict the binding of external SOAP web-services messages, which allows remote authenticated users to bypass unspecified authorization checks and obtain direct access to a 1 Cloud Controller or 2 Walrus service via a crafted message, as demonstrated by...
Apache Blocks IE 10 Do Not Track Privacy Setting
The co-founder of the Apache HTTP Server Project is under fire for a patch that instructs the world’s most popular Web server to ignore the Do Not Track privacy setting enabled by default in Internet Explorer 10. Do Not Track is a specification under consideration by the W3C and under development...
CVE-2011-4578
event.c in acpid aka acpid2 before 2.0.11 does not have an appropriate umask setting during execution of event-handler scripts, which might allow local users to 1 perform write operations within directories created by a script, or 2 read files created by a script, via standard filesystem system...
Scientific Linux Security Update : yum on SL5.x i386/x86_64
This updated yum package fixes the following bugs : - The nightly yum.cron will spew out alot of information during the add-ons section. The logging level for these information messages was turned up so that it doesn't happen during yum.cron - The kernel-module plugin now detects when yum has...
Scientific Linux Security Update : pidgin on SL 3.0.x , SL 4.x , SL 5.x
An integer overflow flaw was found in Pidgin's MSN protocol handler. If a user received a malicious MSN message, it was possible to execute arbitrary code with the permissions of the user running Pidgin. CVE-2008-2927 Note: the default Pidgin privacy setting only allows messages from users in the...
Scientific Linux Security Update : bash on SL4.x i386/x86_64
It was found that certain scripts bundled with the Bash documentation created temporary files in an insecure way. A malicious, local user could use this flaw to conduct a symbolic link attack, allowing them to overwrite the contents of arbitrary files accessible to the victim running the scripts...
CVE-2011-4285
The default configuration of Moodle 2.0.x before 2.0.2 has an incorrect setting of the moodle/course:delete capability, which allows remote authenticated users to delete arbitrary courses by leveraging the teacher role...
Design/Logic Flaw
Moodle 2.0.x before 2.0.3 does not recognize the configuration setting that makes e-mail addresses visible only to course members, which allows remote authenticated users to obtain sensitive address information by reading a full profile page...
Code injection
Moodle 2.0.x before 2.0.2 does not use the forceloginforprofiles setting for course-profiles access control, which makes it easier for remote attackers to obtain potentially sensitive information via vectors involving use of a search engine, as demonstrated by the search functionality of Google,...
CVE-2011-4289
Moodle 2.0.x before 2.0.3 does not recognize the configuration setting that makes e-mail addresses visible only to course members, which allows remote authenticated users to obtain sensitive address information by reading a full profile page...