CVE-2015-2296

CVE-2015-2296 affects the Python requests project: the resolve_redirects implementation in sessions.py in versions 2.1.0 through 2.5.3 allows a remote attacker to perform session fixation via a redirect that carries a cookie without a host value. The connected data confirms the vulnerability in r...

CVE-2014-7824

CVE-2014-7824 affects D-Bus: vulnerable versions are D-Bus 1.3.0 through 1.6.x before 1.6.26, 1.8.x before 1.8.10, and 1.9.x before 1.9.2. The issue allows local users to cause a denial of service by queuing the maximum number of file descriptors, due to an incomplete fix for CVE-2014-3636. Affec...

CVE-2014-3533

CVE-2014-3533 affects the D-Bus project (dbus) components where dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6 allow local users to cause a denial of service by sending a crafted sequence that leads the dbus-daemon to forward a message containing an invalid file descriptor. The impact is a local...

CVE-2014-3422

CVE-2014-3422 affects GNU Emacs 24.3 and earlier. The vulnerability allows local users to overwrite arbitrary files via a symlink attack on a temporary file under /tmp/esrc/. Public documents (OpenVAS/Nessus/EulerOS advisories) confirm the existence and nature of the issue but do not specify a ve...

CVE-2014-3421

CVE-2014-3421 affects GNU Emacs 24.3 and earlier. The vulnerability is in lisp/gnus/gnus-fun.el, enabling local users to overwrite arbitrary files via a symlink attack on /tmp/gnus.face.ppm. Connected sources (EMACS advisories) confirm the affected versions and the symlink-based overwrite vector;...

CVE-2014-9037

CVE-2014-9037 affects WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1, where an improper PHP dynamic type comparison for an MD5 hash could allow remote attackers to obtain access to an account idle since 2008. Root cause: faulty MD5 hash comparison in PHP dyna...

CVE-2014-9039

CVE-2014-9039 affects WordPress versions prior to 4.0.1 for the 4.x line and older 3.x branches: remote password resets could be triggered if an attacker gains access to the email account that received the reset message. The explicit vulnerable ranges are WordPress before 3.7.5, 3.8.x before 3.8....

CVE-2014-4668

CVE-2014-4668 affects Cherokee 1.2.103 and earlier when using LDAP: the cherokee_validator_ldap_check function does not properly handle unauthenticated-bind semantics, allowing authentication bypass via an empty password. Connected advisories confirm that updates were released across multiple dis...

CVE-2014-9274

UnRTF (a command-line RTF converter) is affected by CVE-2014-9274 and CVE-2014-9275. The issues include out-of-bounds memory accesses and other crashes that could lead to denial of service or, potentially, arbitrary code execution when processing crafted RTF files (e.g., malformed color tables). ...

CVE-2014-8764

DokuWiki (pre-2014-05-05a/b) is vulnerable to LDAP/Active Directory authentication bypass via a leading null byte in credentials. CVE-2014-8764 (anonymous bind) and related CVEs (e.g., CVE-2014-8763/8762/8761) are fixed in subsequent updates across distros (Debian DSA-3059, DLA-79-1; Mageia/MGASA...

CVE-2014-3423

CVE-2014-3423 affects GNU Emacs 24.3 and earlier, where lisp/net/browse-url.el allows local users to overwrite arbitrary files via a symlink attack on a /tmp/Mosaic temporary file. The connected sources confirm this local-privilege issue and describe the exact path and file involved, but do not p...

CVE-2014-8763

CVE-2014-8763 affects DokuWiki when using Active Directory/LDAP authentication. The issue allows bypassing authentication via a password that starts with a null byte, triggering an unauthenticated bind. Connected advisories confirm related CVEs (8761, 8762, 8763, 8764) and indicate fixes in DokuW...

CVE-2014-3424

CVE-2014-3424 affects GNU Emacs 24.3 and earlier. The vulnerability is in lisp/net/tramp-sh.el, where a symlink attack on a /tmp/tramp-XXXXX temporary file allows a local user to overwrite arbitrary files. CVSSv2 from NVD shows base score 3.3 (AV:L, AC:M, I:P, A:P; no confidentiality impact). Con...