CA ARCserve D2D r15 Web Service Servlet Code Execution

No description provided by source. Computer Associates ARCserve D2D r15 Web Service Apache Axis2 World Accessible Servlet Code Execution Vulnerability Poc product homepage: https://support.ca.com/phpdocs/0/8363/support/arcserved2dsupport.html vulnerability: The Tomcat Server, which listens for...

Joe Text Editor 2.8 .joerc Arbitrary Command Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2437/info Joe is a text editor originally written by Joseph Allen. Joe offers a user-friendly interface, with key binding and configuration familiar to many users of Microsoft Word Processing tools. A problem in the...

World in Conflict 1.008 - NULL Pointer Remote Denial of Service Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/29888/info World in Conflict is prone to a remote denial-of-service vulnerability because the application fails to handle exceptional conditions. An attacker could exploit this issue to crash the affected application,...

Solaris <= 7.0 chkperm Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/295/info Solaris 2.4, 2.5, and 2.5.1 possibly other versions have a package called FACE Framed Access Command Environment installed. Included in the package is a program called chkperm which checks a file to see if the us...

Oracle <= 8 8.1.5 Intelligent Agent Vulnerability (2)

No description provided by source. source: http://www.securityfocus.com/bid/585/info A vulnerability in the Oracle Intelligent Agent allows local malicious users to execute arbitrary commands and to create world writable files as the root user. The problem lies in the dbsnmp program located in...

FIFA World Cup Security Team Accidentally Reveals their Wi-Fi Password

This FIFA World Cup, the security has been really going well and yet no calamitous incident reported so far, other than the security company who is responsible to keep an eye on the event’s security, itself tweeted a photograph of their state-of-the-art monitoring centre that exposed the World Cu...

CVE-2014-3431

Symantec PGP Desktop 10.x, and Encryption Desktop Professional 10.3.x before 10.3.2 MP2, on OS X uses world-writable permissions for temporary files, which allows local users to bypass intended restrictions on file reading, modification, creation, and permission changes via unspecified vectors...

Design/Logic Flaw

Symantec PGP Desktop 10.x, and Encryption Desktop Professional 10.3.x before 10.3.2 MP2, on OS X uses world-writable permissions for temporary files, which allows local users to bypass intended restrictions on file reading, modification, creation, and permission changes via unspecified vectors...

Symantec Encryption Desktop for OS X World-Writable Files Insecure File Handling

SUMMARY Symantecs Encryption Desktop for OS X installs some temporary files with world-writable attributes during installation. In a multi-user environment, a malicious user could manipulate these world-writable files to read and write files or create files with another users permissions. AFFECTE...

FIFA World Cup 2014, Big Opportunity for Cybercriminals

With the beginning of FIFA World Cup tournaments in Brazil, Football fever is going viral across the world. Soccer or Football is the most popular sport in the world with billions of fans who don’t even miss a single tournament. Now, this is the most awaited and rejoicing atmosphere for Football...

Low: perl-Capture-Tiny

Issue Overview: It was found 1 that the Capture::Tiny module, provided by the perl-Capture-Tiny package, used the File::temp::tmpnam module to generate temporary files: ./lib/Capture/Tiny.pm: $stash-flagfiles$which = scalar tmpnam; This module makes use of the mktemp function when called in the...

openSUSE Security Update : samba (openSUSE-SU-2013:1921-1)

" - Update to 4.1.3. + DCE-RPC fragment length field is incorrectly checked; CVE-2013-4408; bnc844720. + pamwinbind login without requiremembershipof restrictions; CVE-2012-6150; bnc853347. - Make use of the full gpg pub key file name including the key ID. - Add transparent file compression...

openSUSE Security Update : rocksndiamonds (openSUSE-SU-2012:0918-1)

The game rocksndiamonds created /.rocksndiamonds/ world writeable, allowing other users to save files in there or corrupt your game state. This was fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE...

openSUSE Security Update : gnash (openSUSE-SU-2012:0369-1)

gnash used predictable and world readable temporary file names to store HTTP cookies %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2012-164. The text description of this plugin is C...

CVE-2013-2563

Mambo CMS 4.6.5 uses world-readable permissions on configuration.php, which allows local users to obtain the admin password hash by reading the file...

Design/Logic Flaw

Mambo CMS 4.6.5 uses world-readable permissions on configuration.php, which allows local users to obtain the admin password hash by reading the file...

CVE-2013-2563

CVE-2013-2563 affects Mambo CMS 4.6.5. The issue is world-readable permissions on configuration.php, enabling local users to read the admin password hash. The connected documents confirm the affected product and the root cause, but do not provide a remediation or exploit details. Action: monitor ...

CVE-2013-2563

Mambo CMS 4.6.5 uses world-readable permissions on configuration.php, which allows local users to obtain the admin password hash by reading the file...

[ MDVSA-2014:087 ] php

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:087 http://www.mandriva.com/en/support/security/ Package : php Date : May 15, 2014 Affected: Business Server 1.0 Problem Description: A vulnerability has been discovered and corrected in php: PHP FPM in PHP...

CVE-2014-0201

ovirt-engine-reports, as used in the Red Hat Enterprise Virtualization reports package rhevm-reports before 3.3.3, uses world-readable permissions on configuration files, which allows local users to obtain sensitive information by reading the files...