Updated ansible package fixes multiple security issues

Updated ansible package fixes security vulnerabilities: The Ansible platform before version 1.6.7 suffers from input sanitization errors that allow arbitrary code execution as well as information leak, in case an attacker is able to control certain playbook variables CVE-2014-4678, CVE-2014-4966,...

Blackhat 2014 Arsenal Experience

Last week at Blackhat Arsenal 2014, Pete and I @willis presented on Serpico. Arsenal was a great experience and I would highly recommend to anyone as an attendee or presenter. We got some great feedback on the project, so thank you to anyone who stopped by. Here were the top 3 feature requests an...

USN-2306-2: GNU C Library regression

USN-2306-1 fixed vulnerabilities in the GNU C Library. On Ubuntu 10.04 LTS, the security update cause a regression in certain environments that use the Name Service Caching Daemon nscd, such as those configured for LDAP or MySQL authentication. In these environments, the nscd daemon may need to b...

Ubuntu 14.04 LTS : GNU C Library vulnerabilities (USN-2306-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2306-1 advisory. Maksymilian Arciemowicz discovered that the GNU C Library incorrectly handled the getaddrinfo function. An attacker could use this issue to cause a denia...

USN-2306-1: GNU C Library vulnerabilities

Maksymilian Arciemowicz discovered that the GNU C Library incorrectly handled the getaddrinfo function. An attacker could use this issue to cause a denial of service. This issue only affected Ubuntu 10.04 LTS. CVE-2013-4357 It was discovered that the GNU C Library incorrectly handled the...

Information disclosure

The Unified Task List UTL Portlet for IBM WebSphere Portal 7.x and 8.x through 8.0.0.1 CF12 allows remote attackers to obtain potentially sensitive information about environment variables and JAR versions via unspecified vectors...

CVE-2014-3056

The Unified Task List UTL Portlet for IBM WebSphere Portal 7.x and 8.x through 8.0.0.1 CF12 allows remote attackers to obtain potentially sensitive information about environment variables and JAR versions via unspecified vectors...

CVE-2014-3056

CVE-2014-3056: Affected product is IBM WebSphere Portal Unified Task List (UTL) Portlet on WebSphere Portal 7.x and 8.x up to 8.0.0.1 CF12. The issue is information disclosure exposing environment variables and certain JAR versions via unspecified vectors. This is an information disclosure vulner...

DEBIAN-CVE-2014-0475

Multiple directory traversal vulnerabilities in GNU C Library aka glibc or libc6 before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. dot dot in a 1 LC, 2 LANG, or other locale environment variable...

UBUNTU-CVE-2014-0475

Multiple directory traversal vulnerabilities in GNU C Library aka glibc or libc6 before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. dot dot in a 1 LC, 2 LANG, or other locale environment variable...

UBUNTU-CVE-2014-4721

The phpinfo implementation in ext/standard/info.c in PHP before 5.4.30 and 5.5.x before 5.5.14 does not ensure use of the string data type for the PHPAUTHPW, PHPAUTHTYPE, PHPAUTHUSER, and PHPSELF variables, which might allow context-dependent attackers to obtain sensitive information from process...

CVE-2014-3074

The runtime linker in IBM AIX 6.1 and 7.1 and VIOS 2.2.x allows local users to create a mode-666 root-owned file, and consequently gain privileges, by setting crafted MALLOCOPTIONS and MALLOCBUCKETS environment-variable values and then executing a setuid program. Recent assessments: timb-machine ...

M-TECH P-Synch 6.2.5 nph-psa.exe css Parameter Remote File Inclusion

No description provided by source. source: http://www.securityfocus.com/bid/7747/info A remote file include vulnerability has been reported for P-Synch. Due to insufficient sanitization of some user-supplied URI variables, it is possible for a remote attacker to include a malicious file in a URL...

Debian GNU/Linux 3.1 top Format String Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1895/info top is a program used to display system usage statistics in real time written by GoupSys Consulting but shipped by default as a core component with many operating systems. On BSD systems, top is installed setgid...

Simple Free PHP Forum Script <= SQL Injection Vulnerability

No description provided by source. Exploit Title: Simple Free PHP Forum Script = 1 SQL Injection Vulnerability Date: 2011-10-19 Author: Skraps, Jackie Craig Sparksjackie.craig.sparksatlive.com jackie.craig.sparksatgmail.com @skrapsfoo Software Link: http://www.phpforumscript.com/?pageid=11 Versio...

Ipswitch WS_FTP Server 1.0.x/2.0.x 'STAT' Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/3507/info WSFTP Server, a popular FTP server for Microsoft Windows platforms, is vulnerable to a buffer overflow condition when a user submits a specially crafted legitimate FTP command. WSFTP Server by default runs as a...

Sun Solaris Netscape Portable Runtime API 4.6.1 - Local Privilege Escalation Vulnerability (1)

No description provided by source. source: http://www.securityfocus.com/bid/20471/info The Netscape Portable Runtime API running on Sun Solaris 10 operating system is prone to a local privilege-escalation vulnerability. A successful exploit of this issue allows an attacker to gain superuser...

Solaris 2.6/7.0 DTMail Mail Environment Variable Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/3081/info dtmail is an application included with the Common Desktop Environment, one of the X Window Managers included with Solaris. A buffer overflow in dtmail makes it possible for a local user to gain elevated...

Content-Builder (CMS) 0.7.5 - Multiple Include Vulnerabilities

No description provided by source. ----------------------------------------------------- Advisory id: FSA:012 Author: Federico Fazzi Date: 11/06/2006, 22:30 Sinthesis: Content-Builder CMS 0.7.5, Remote command execution Type: high Product: http://www.content-builder.de/ Patch: unavailable...

Jason Maloney's Guestbook 3.0 - Remote Command Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/9139/info A vulnerability has been reported in Jason Maloney's Guestbook that could result in remote command execution with the privileges of the web server. The problem occurs due to the application failing to sanitize...