Vulnerability in puppetlabs-rabbitmq

Puppet is the United States Puppet Labs a set of client/server C / S architecture based on the configuration management tools , it can be used to manage configuration files , users , cron tasks , packages , system services and so on. puppetlabs-stdlib is one of the implementation of the Advanced...

Symantec Encryption Management Server < 3.3.2 MP7 Multiple Vulnerabilities

The version of Symantec Encryption Management Server listening on the remote host is prior to version 3.3.2 MP7. It is, therefore, affected by multiple vulnerabilities : - A flaw exists in the handling of specially formatted PGP keys to the integrated key management server. This allows a remote...

HackerOne: In markdown, parsing things like @danlec and #46072 after links is unsafe

Let me preface this by saying that I haven't worked out an actual exploit for this, and there may not be one, but when 46072 is disclosed, folks will probably be taking a closer look at HackerOne's markdown parsing and may find a way to turn this bug into something It looks like the links for...

CVE-2014-6572

Unspecified vulnerability in the Oracle Customer Interaction History component in Oracle E-Business Suite 12.0.4, 12.0.5, 12.0.6, 12.1.1, 12.1.2, 12.1.3, 12.2.2, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality and integrity via unknown vectors related to List of Values...

Buffer overflow

Unspecified vulnerability in the Oracle Customer Interaction History component in Oracle E-Business Suite 12.0.4, 12.0.5, 12.0.6, 12.1.1, 12.1.2, 12.1.3, 12.2.2, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality and integrity via unknown vectors related to List of Values...

CVE-2014-6572

Unspecified vulnerability in the Oracle Customer Interaction History component in Oracle E-Business Suite 12.0.4, 12.0.5, 12.0.6, 12.1.1, 12.1.2, 12.1.3, 12.2.2, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality and integrity via unknown vectors related to List of Values...

Cisco WebEx Meetings Server Password Encryption Vulnerability

A vulnerability in the OutlookAction LI of Cisco WebEx Meetings Server could allow an authenticated, remote attacker to generate sensitive encrypted values. The vulnerability is due to the return of a user's encrypted password. An attacker could exploit this vulnerability by generating these...

Memcached Extractor

This module extracts the slabs from a memcached instance. It then finds the keys and values stored in those slabs. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Memcached Extractor',...

CVE-2015-0222

ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when showhiddeninitial is set to True, allows remote attackers to cause a denial of service by submitting duplicate values, which triggers a large number of SQL queries...

CVE-2014-1425

CVE-2014-1425 concerns cgmanager 0.32, where improper nesting when modifying cgroup properties allows a local attacker within a privileged container to set cgroup values for all cgroups. The Ubuntu security notice USN-2451-1 documents the fix, updating cgmanager to versions 0.32-4ubuntu1.1 (14.10...

USN-2451-1 cgmanager vulnerability

Serge Hallyn discovered that cgmanager did not consistently enforce proper nesting when modifying cgroup properties. A local attacker in a privileged container could use this to set cgroup values for all cgroups...

Exiv riffvideo.cpp Buffer Overflow Vulnerability

Exiv2 is a C++ class library for extracting EXIF, LPTC and XMP metadata information from images. A buffer overflow vulnerability in the RiffVideo::infoTagsHandler function in Exiv2 riffvideo.cpp allows an attacker to construct an AVI file containing extra-long IKEY INFO tagged values, tricking th...

Inmatrix-Ltd.-Zoom-Player-8.5-.jpeg

Exploit Title: Inmatrix Ltd. Zoom Player Crafted JPEG File Memory Corruption and Arbitrary Code Execution Exploit. Version: Zoom Player v8.5 Date: 09-1-2013 Author: Debasish Mandal. Blog : http://www.debasish.in/ d =...

Design/Logic Flaw

The web interface in BitTorrent allows remote attackers to execute arbitrary commands by leveraging knowledge of the pairing values and a crafted request to port 10000...

Cross site request forgery (csrf)

Apache Struts 2.0.0 through 2.3.x before 2.3.20 uses predictable values, which allows remote attackers to bypass the CSRF protection mechanism...

CVE-2014-8100

The Render extension in XFree86 4.0.1, X.Org X Window System aka X11 or X X11R6.7, and X.Org Server aka xserver and xorg-server before 1.16.3 allows remote authenticated users to cause a denial of service out-of-bounds read or write or possibly execute arbitrary code via a crafted length or index...

Microsoft Graphics Component Information Disclosure Vulnerability (3013126)

This host is missing an important security update according to Microsoft Bulletin MS14-085. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

UBUNTU-CVE-2014-8099

The XVideo extension in XFree86 4.0.0, X.Org X Window System aka X11 or X X11R6.7, and X.Org Server aka xserver and xorg-server before 1.16.3 allows remote authenticated users to cause a denial of service out-of-bounds read or write or possibly execute arbitrary code via a crafted length or index...

OracleVM 2.1 : ntp (OVMSA-2009-0011)

The remote OracleVM system is missing necessary patches to address critical security updates : CVE-2009-0159 Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response...

CVE-2014-7909

effects/SkDashPathEffect.cpp in Skia, as used in Google Chrome before 39.0.2171.65, computes a hash key using uninitialized integer values, which might allow remote attackers to cause a denial of service by rendering crafted data...