Vulnerabilities of the Debian GNU/Linux operating system, which allow a remote attacker to compromise the integrity and accessibility of protected information

The multiple vulnerabilities in the selinux-policy-refpolicy-src package of the Debian GNU/Linux operating system may lead to a violation of the integrity and accessibility of protected information. These vulnerabilities can be exploited remotely...

The vulnerability of the Red Hat Enterprise Linux operating system allows malicious actors to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the libgcj-src-4.1.2 package of the Red Hat Enterprise Linux operating system can lead to violations of confidentiality, integrity, and accessibility of protected information. This vulnerability can be exploited locally...

Important: php54

Issue Overview: A use-after-free flaw was found in the way PHP's unserialize function processed data. If a remote attacker was able to pass crafted input to PHP's unserialize function, they could cause the PHP interpreter to crash or, possibly, execute arbitrary code. CVE-2015-0231 An integer...

libFLAC 'src/flac/encode.c' Buffer Overflow Vulnerability

Libflac is a free lossless audio compression encoding and decoding program library. LibFLAC version 1.3.1 suffers from a stack buffer overflow vulnerability in the implementation of src/flac/encode.c, which can be exploited by an attacker to execute arbitrary code in an affected application...

Debian DSA-3164-1 : typo3-src - security update

Pierrick Caillon discovered that the authentication could be bypassed in the Typo 3 content management system. Please refer to the upstream advisory for additional information : %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

[SECURITY] [DSA 3164-1] typo3-src security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3164-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff February 21, 2015 http://www.debian.org/security/faq -...

CVE-2014-8690

Multiple cross-site scripting XSS vulnerabilities in Exponent CMS before 2.1.4 patch 6, 2.2.x before 2.2.3 patch 9, and 2.3.x before 2.3.1 patch 4 allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO, the 2 src parameter in a none action to index.php, or the 3 "First...

CVE-2014-8690

Multiple cross-site scripting XSS vulnerabilities in Exponent CMS before 2.1.4 patch 6, 2.2.x before 2.2.3 patch 9, and 2.3.x before 2.3.1 patch 4 allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO, the 2 src parameter in a none action to index.php, or the 3 "First...

Updated libsndfile packages fix CVE-2014-9496

Updated libsndfile packages fix security vulnerabilities: libsndfile contains multiple buffer-overflow vulnerabilities in src/sd2.c because it fails to properly bounds-check user supplied input, which may allow an attacker to execute arbitrary code or cause a denial of service CVE-2014-9496...

phpThumb Server-Side Request Forgery Vulnerability

phpThumb is a PHP class used to generate thumbnails of images. Versions of phpThumb prior to 1.7.12 configure the disabledebug option with a default value of false, which allows remote attackers to perform server-side request forgery SSRF attacks via the src parameter...

UBUNTU-CVE-2014-4465

WebKit in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1 allows remote attackers to bypass the Same Origin Policy via crafted Cascading Style Sheets CSS token sequences within an SVG file in the SRC attribute of an IMG element...

Minix 3.3.0 - Remote TCPIP Stack Denial of Service

Minix 3.3.0 - Remote TCPIP Stack Denial of Service / ------------------------------------------------------- ||------+ MINIX =--|| ||--= Nov 2014 =--|| ||--= Mexico =--|| -- MINIX IS PRONE TO DENIAL OF SERVICE IN THE TCP/IP STACK /service/inet BY SENDING A SINGLE TCP PACKET WITH A MALFORMED TCP...

Cross site scripting

Cross-site scripting XSS vulnerability in timthumb.php in TimThumb 1.09 and earlier, as used in Mimbo Pro 2.3.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the src parameter...

CVE-2009-5142

Cross-site scripting XSS vulnerability in timthumb.php in TimThumb 1.09 and earlier, as used in Mimbo Pro 2.3.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the src parameter...

nginx < 1.6.1 / 1.7.4 SMTP STARTTLS Command Injection

The version of nginx installed on the remote host is 1.5.6 or higher, 1.6.x prior to 1.6.1, or 1.7.x prior to 1.7.4. It is, therefore, affected by a command injection vulnerability. A flaw exists in the function 'ngxmailsmtpstarttls' within the file 'src/mail/ngxmailsmtphandler.c' whereby input t...

RokBox <= 2.13 - thumb.php src Parameter XSS

The wprokbox WordPress plugin was affected by a thumb.php src Parameter XSS security vulnerability...

TimThumb 'timthumb.php' < 2.8.14 WebShot 'src' Parameter Remote Command Execution

The TimThumb 'timthumb.php' script installed on the remote host is prior to version 2.8.14. It is, therefore, affected by a remote command execution vulnerability due to a failure to properly sanitize user-supplied input to the 'src' parameter. A remote, unauthenticated attacker can leverage this...

OctavoCMS Cross Site Scripting

This proprietary content management software is vulnerable to reflected XSS on the file admin/viewer.php, src parameter. Current release on their demo site is vulnerable, same as other few sites I could find. PoC:...

Medium: php54

Issue Overview: acinclude.m4, as used in the configure script in PHP 5.5.13 and earlier, allows local users to overwrite arbitrary files via a symlink attack on the /tmp/phpglibccheck file. A denial of service flaw was found in the way the File Information fileinfo extension parsed certain...

Adobe SVG Viewer 3.0 ActiveX Control SRC Information Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/13490/info The Adobe SVG Viewer ActiveX control is prone to an information disclosure vulnerability. Reports indicate that the Adobe SVG Viewer ActiveX control may be employed to disclose the existence of a target file...