UBUNTU-CVE-2014-0056

The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote authenticated users to plug ports into the routers of arbitrary tenants via the device id in a port-create command...

CVE-2014-2241

The 1 cf2initLocalRegionBuffer and 2 cf2initGlobalRegionBuffer functions in cff/cf2ft.c in FreeType before 2.5.3 do not properly check if a subroutine exists, which allows remote attackers to cause a denial of service assertion failure, as demonstrated by a crafted ttf file...

UBUNTU-CVE-2013-6385

The form API in Drupal 6.x before 6.29 and 7.x before 7.24, when used with unspecified third-party modules, performs form validation even when CSRF validation has failed, which might allow remote attackers to trigger application-specific impacts such as arbitrary code execution via...

Oracle Linux 6 : kdelibs (ELSA-2011-1364)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2011-1364 advisory. 6:4.3.4-11.4 - Resolves: bz743951, use ca-certificates' ca-bundle.crt 6:4.3.4-11.3 - Resolves: bz743515, CVE-2011-3365 - input validation failure Tenable has...

Oracle Linux 5 / 6 : kdelibs / and / kdelibs3 (ELSA-2011-1385)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2011-1385 advisory. 3.5.10-24.1 - Resolves: bz746160, CVE-2011-3365, input validation failure in KSSL Tenable has extracted the preceding description block directly from the...

Ubuntu 12.04 LTS : linux-lts-quantal vulnerabilities (USN-1768-1)

Andrew Cooper of Citrix reported a Xen stack corruption in the Linux kernel. An unprivileged user in a 32bit PVOPS guest can cause the guest kernel to crash, or operate erroneously. CVE-2013-0190 A failure to validate input was discovered in the Linux kernel's Xen netback network backend driver. ...

OpenJDK: image parser insufficient raster parameter checks (AWT, 8002325)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.240 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors relat...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication libsoup 2.32.2 and earlier does not validate certificates or clear the trust flag when the ssl-ca-file does not exist, which allows remote attackers to bypass authentication by connecting with a SSL connection...

Barracuda Email Security Service - Multiple HTML Injection Vulnerabilities

Barracuda Email Security Service - Multiple HTML Injection Vulnerabilities source: https://www.securityfocus.com/bid/54773/info Barracuda Email Security Service is prone to multiple HTML-injection vulnerabilities because it fails to properly validate user-supplied input. An attacker may leverage...

phpCollab 2.5 - Database Backup Information Disclosure

phpCollab 2.5 - Database Backup Information Disclosure source: https://www.securityfocus.com/bid/53656/info phpCollab is prone to an information-disclosure vulnerability because it fails to sufficiently validate user-supplied data. An attacker can exploit this issue to download backup files that...

JVN#45898075: Drupal Form API fails to validate the redirect URL

Drupal is a content management system CMS. Drupal's Form API fails to validate the redirect URL, which may lead to unintended information disclosure. Impact A remote attacker may change the redirect URL of a form. As a result, information such as authentication credentials may be disclosed...

FreeBSD : chromium -- multiple vulnerabilities (94c0ac4f-9388-11e1-b242-00262d5ed8ee)

Google Chrome Releases reports : 106413 High CVE-2011-3078: Use after free in floats handling. Credit to Google Chrome Security Team Marty Barbella and independent later discovery by miaubiz. 117627 Medium CVE-2011-3079: IPC validation failure. Credit to PinkiePie. 121726 Medium CVE-2011-3080: Ra...

op5 Monitor / Appliance < 5.5.3 Multiple RCE Vulnerabilities (Dec 2013)

op5 Monitor / Appliance is prone to multiple remote command execution RCE vulnerabilities because it fails to properly validate user-supplied input. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...

Multiple Products IASystemInfo.DLL ActiveX Control Buffer Overflow (CVE-2007-0348)

A remote code execution vulnerability has been reported in multiple products containing the IASystemInfo.DLL ActiveX control. The vulnerability is due to a data validation failure by the ActiveX control. A remote attacker may exploit this vulnerability by enticing an affected user to open a...

Multiple Products NCTAudioFile2 ActiveX Control Buffer Overflow (CVE-2007-0018)

A remote code execution vulnerability has been reported in the NCTAudioFile2 ActiveX control. The vulnerability is due to a data validation failure by the NCTAudioFile2 ActiveX control. A remote attacker may exploit this vulnerability by enticing an affected user to open a specially crafted...

Zenturi ProgramChecker ActiveX Components ActiveX Controls Buffer Overflows (CVE-2007-2987)

Multiple buffer overflow vulnerabilities have been reported in Zenturi ProgramChecker. The vulnerabilities are due to a data validation failure, resulting in a buffer overflow. A remote attacker may exploit these vulnerabilities by enticing a target user to open a specially crafted HTML file...

RHEL 4 / 5 / 6 : kdelibs and kdelibs3 (RHSA-2011:1385)

The remote Redhat Enterprise Linux 4 / 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:1385 advisory. - kdelibs: input validation failure in KSSL CVE-2011-3365 Note that Nessus has not tested for this issue but has instead relied only on the...

ezCourses 'admin.asp' Security Bypass Vulnerability

ezCourses is prone to a security-bypass vulnerability because it fails to properly validate user-supplied input. Attackers could exploit the issue to bypass certain security restrictions and add or change the 'admin' account password. OpenVAS Vulnerability Test $Id: gbezcourses49907.nasl 5769...

PT-2011-21: SQL injection vulnerability in OneOrZero AIMS

Positive Research Center has discovered multiply SQL injection vulnerabilities in OneOrZero AIMS. Application incorrectly validates input data. That allows attackers to conduct SQL injection attack. "SQL Injection" is a way to bypass network protection and attack the database. Settings transferre...

Input validation

The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, and Vista Gold does not perform the expected validation before creating a symbolic link, which allows local users to cause a denial of service reboot via a crafted application, aka "Windows Kernel Symbolic Link Value...