CVE-2014-1155

CVE-2014-1155 is the cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) r561, exploitable by remote attackers injecting arbitrary HTML/Script via the Description field of a file upload. Note: CVE-2014-1155 was historically mis-mapped to CVE-2014-9580; both entries reference t...

CVE-2014-1004

This CVE entry is rejected and not used; reference CVE-2014-9456 instead.

CVE-2014-1137

CVE-2014-1137 entry is rejected/not used; reference CVE-2014-9445, CVE-2014-9581, or CVE-2014-9582 instead.

[SECURITY] Fedora 20 Update: mingw-pcre-8.33-4.fc20

Cross compiled Perl-compatible regular expression library for use with ming w32. PCRE has its own native API, but a set of "wrapper" functions that are base d on the POSIX API are also supplied in the library libpcreposix. Note that this just provides a POSIX calling interface to PCRE: the regula...

[SECURITY] Fedora 19 Update: pcre-8.32-12.fc19

Perl-compatible regular expression library. PCRE has its own native API, but a set of "wrapper" functions that are base d on the POSIX API are also supplied in the library libpcreposix. Note that this just provides a POSIX calling interface to PCRE: the regular expressions themselves still follow...

Updated nail package fixes security vulnerabilities

Updated nail package fixes security vulnerabilities: A flaw was found in the way mailx handled the parsing of email addresses. A syntactically valid email address could allow a local attacker to cause mailx to execute arbitrary shell commands through shell meta-characters and the direct command...

Debian DSA-3105-1 : heirloom-mailx - security update

Two security vulnerabilities were discovered in Heirloom mailx, an implementation of the 'mail' command : - CVE-2004-2771 mailx interprets shell meta-characters in certain email addresses. - CVE-2014-7844 An unexpected feature of mailx treats syntactically valid email addresses as shell commands ...

Debian DSA-3104-1 : bsd-mailx - security update

It was discovered that bsd-mailx, an implementation of the 'mail' command, had an undocumented feature which treats syntactically valid email addresses as shell commands to execute. Users who need this feature can re-enable it using the 'expandaddr' in an appropriate mailrc file. This update also...

[SECURITY] Fedora 21 Update: pcre-8.35-8.fc21

Perl-compatible regular expression library. PCRE has its own native API, but a set of "wrapper" functions that are base d on the POSIX API are also supplied in the library libpcreposix. Note that this just provides a POSIX calling interface to PCRE: the regular expressions themselves still follow...

CVE-2014-7192

Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rational Application Developer and other products, allows remote attackers to execute arbitrary code via a crafted file...

CVE-2014-7192

Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rational Application Developer and other products, allows remote attackers to execute arbitrary code via a crafted file...

UBUNTU-CVE-2014-7192

Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rational Application Developer and other products, allows remote attackers to execute arbitrary code via a crafted file...

CVE-2014-7192

CVE-2014-7192 affects the syntax-error npm module (before 1.1.1) used with Node.js 0.10.x, including in IBM Rational Application Developer and related IBM/RSA products. The vulnerability stems from improper input handling in the syntax-error/index.js file, enabling remote attackers to execute arb...

CVE-2014-7192

Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rational Application Developer and other products, allows remote attackers to execute arbitrary code via a crafted file...

CVE-2014-7192

Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rational Application Developer and other products, allows remote attackers to execute arbitrary code via a crafted file...

PT-2014-7827

Name of the Vulnerable Software and Affected Versions syntax-error versions prior to 1.1.1 Description The issue allows remote attackers to execute arbitrary code via a crafted file, potentially leading to a cross-site scripting vulnerability. This may enable a malicious file to execute code when...

CVE-2014-7192: Improper Control of Generation of Code

Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rational Application Developer and other products, allows remote attackers to execute arbitrary code via a crafted file...

OracleVM 3.3 : nss (OVMSA-2014-0014)

The remote OracleVM system is missing necessary patches to address critical security updates : - Added nss-vendor.patch to change vendor - Update some patches on account of the rebase - Resolves: Bug 1099619 - Backport nss-3.12.6 upstream fix required by Firefox 31 - Resolves: Bug 1099619 - Remov...

Debian Security Advisory DSA 3056-1 (libtasn1-3 - security update)

Several vulnerabilities were discovered in libtasn1-3, a library that manages ASN1 Abstract Syntax Notation One structures. An attacker could use those to cause a denial-of-service via out-of-bounds access or NULL pointer dereference. OpenVAS Vulnerability Test $Id: deb3056.nasl 6750 2017-07-18...

nss: RSA PKCS#1 signature verification forgery flaw (MFSA 2014-73)

A flaw was found in the way NSS parsed ASN.1 Abstract Syntax Notation One input from certain RSA signatures. A remote attacker could use this flaw to forge RSA certificates by providing a specially crafted signature to an application using NSS...