From 8dd49b61567a07f92e5043f0f25e801834e7a075 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sat, 3 May 2014 11:02:23 -0400 Subject: [PATCH] added local copies of the NVD CVE data to speed up some of the test cases Former-commit-id: 04f220ef62303f672afb10ba44fdb4c44af35a09 --- .../src/test/resources/nvdcve-modified.xml | 12297 ++++++++++++++++ 1 file changed, 12297 insertions(+) create mode 100644 dependency-check-core/src/test/resources/nvdcve-modified.xml diff --git a/dependency-check-core/src/test/resources/nvdcve-modified.xml b/dependency-check-core/src/test/resources/nvdcve-modified.xml new file mode 100644 index 000000000..afb559c91 --- /dev/null +++ b/dependency-check-core/src/test/resources/nvdcve-modified.xml @@ -0,0 +1,12297 @@ + + + + + The tempname_ensure function in lib/routines.h in a2ps 4.14 and earlier, as used by the spy_user function and possibly other functions, allows local users to modify arbitrary files via a symlink attack on a temporary file. + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1060630 + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737385 + DSA-2892 + [oss-security] 20140205 Re: CVE request: a2ps insecure temporary file use + [oss-security] 20140204 Re: CVE request: a2ps insecure temporary file use + [oss-security] 20140205 Re: CVE request: a2ps insecure temporary file use + http://pkgs.fedoraproject.org/cgit/a2ps.git/plain/a2ps-4.13-security.patch + + + + + + + + + + + + + + + The undo save quit routine in the kernel in Blender 2.5, 2.63a, and earlier allows local users to overwrite arbitrary files via a symlink attack on the quit.blend temporary file. NOTE: this issue might be a regression of CVE-2008-1103. + + + + + + + + + + https://developer.blender.org/T22509 + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584621 + [oss-security] 20120907 Re: CVE-2010 Request -- blender: Insecure temporary file use by creating file string in undo save quit Blender kernel routine (re-occurrence of CVE-2008-1103) + [oss-security] 20120906 CVE-2010 Request -- blender: Insecure temporary file use by creating file string in undo save quit Blender kernel routine (re-occurrence of CVE-2008-1103) + + + + + + + + + + DistUpgrade/DistUpgradeFetcherCore.py in Update Manager before 1:0.87.31.1, 1:0.134.x before 1:0.134.11.1, 1:0.142.x before 1:0.142.23.1, 1:0.150.x before 1:0.150.5.1, and 1:0.152.x before 1:0.152.25.5 on Ubuntu 8.04 through 11.10 does not verify the GPG signature before extracting an upgrade tarball, which allows man-in-the-middle attackers to (1) create or overwrite arbitrary files via a directory traversal attack using a crafted tar file, or (2) bypass authentication via a crafted meta-release file. + + + + + + + + + + https://bugs.launchpad.net/ubuntu/%2Bsource/update-manager/%2Bbug/881548 + ubuntu-update-gpg-sec-bypass(71494) + USN-1284-1 + 50833 + 77642 + 47024 + + + + + + + + + + + + + + + + + + + + + Directory traversal vulnerability in device-linux.c in the router advertisement daemon (radvd) before 1.8.2 allows local users to overwrite arbitrary files, and remote attackers to overwrite certain files, via a .. (dot dot) in an interface name. NOTE: this can be leveraged with a symlink to overwrite arbitrary files. + + + + + + + + + + https://github.com/reubenhwk/radvd/commit/92e22ca23e52066da2258df8c76a2dca8a428bcc + USN-1257-1 + [oss-security] 20111007 radvd 1.8.2 released with security fixes + http://www.litech.org/radvd/CHANGES + DSA-2323 + + + + + + + + + + The router advertisement daemon (radvd) before 1.8.2 does not properly handle errors in the privsep_init function, which causes the radvd daemon to run as root and has an unspecified impact. + Per http://thread.gmane.org/gmane.comp.security.oss.general/5973/focus=6015, this vulnerablity is being assigned a CVSS base metric of AV:L/AC:M/Au:N/C:P/I:P/A:P = 4.4 + + + + + + + + + + + https://access.redhat.com/security/cve/CVE-2011-3603 + [oss-security] 20111007 radvd 1.8.2 released with security fixes + http://www.litech.org/radvd/CHANGES + + + + + + + + + + ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-2401. Reason: This candidate is a duplicate of CVE-2012-2401. Notes: All CVE users should reference CVE-2012-2401 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. + + + + + + The bbcode plugin in TinyMCE 3.5.8 does not properly enforce the TinyMCE security policy for the (1) encoding directive and (2) valid_elements attribute, which allows attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors, as demonstrated using a textarea element. + + + + + + + + + + tinymce-htmlentities-xss(82744) + 58424 + http://www.madirish.net/554 + 20130311 XSS Vulnerability in TinyMCE + http://packetstormsecurity.com/files/120750/TinyMCE-3.5.8-Cross-Site-Scripting.html + 91130 + + + + + + + + + + ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none. + + + + + + Race condition in pigz before 2.2.5 uses permissions derived from the umask when compressing a file before setting that file's permissions to match those of the original file, which might allow local users to bypass intended access permissions while compression is occurring. + + + + + + + + + + + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=700608 + [oss-security] 20130215 Re: CVE# request: pigz creates temp file with insecure permissions + [oss-security] 20130215 CVE# request: pigz creates temp file with insecure permissions + [pigz-announce] 20120728 pigz version 2.2.5 released + openSUSE-SU-2013:0540 + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to inject arbitrary web script or HTML via the (1) highlight parameter to forum/viewthread.php; or remote authenticated users with certain permissions to inject arbitrary web script or HTML via the (2) user_list or (3) user_types parameter to messages.php; (4) message parameter to infusions/shoutbox_panel/shoutbox_admin.php; (5) message parameter to administration/news.php; (6) panel_list parameter to administration/panel_editor.php; (7) HTTP User Agent string to administration/phpinfo.php; (8) "__BBCODE__" parameter to administration/bbcodes.php; errorMessage parameter to (9) article_cats.php, (10) download_cats.php, (11) news_cats.php, or (12) weblink_cats.php in administration/, when error is 3; or (13) body or (14) body2 parameter to administration/articles.php. + + + + + + + + + + http://www.waraxe.us/advisory-97.html + http://www.php-fusion.co.uk/news.php?readmore=569 + [oss-security] 20130302 Re: CVE request: PHP-Fusion waraxe-2013-SA#097 + [oss-security] 20130303 CVE request: PHP-Fusion waraxe-2013-SA#097 + 52403 + 20130228 [waraxe-2013-SA#097] - Multiple Vulnerabilities in PHP-Fusion 7.02.05 + http://packetstormsecurity.com/files/120598/PHP-Fusion-7.02.05-XSS-LFI-SQL-Injection.html + 90708 + 90707 + + + + + + + + + + + + + + ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-1806. Reason: This issue was MERGED into CVE-2013-1806 in accordance with CVE content decisions, because it is the same type of vulnerability and affects the same versions. Notes: All CVE users should reference CVE-2013-1806 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. + + + + + + Multiple directory traversal vulnerabilities in PHP-Fusion before 7.02.06 allow remote authenticated users to include and execute arbitrary files via a .. (dot dot) in the (1) user_theme parameter to maincore.php; or remote authenticated administrators to delete arbitrary files via the (2) enable parameter to administration/user_fields.php or (3) file parameter to administration/db_backup.php. + + + + + + + + + + + http://www.php-fusion.co.uk/news.php?readmore=569 + http://www.waraxe.us/advisory-97.html + 90696 + 90694 + 90692 + [oss-security] 20130302 Re: CVE request: PHP-Fusion waraxe-2013-SA#097 + [oss-security] 20130303 CVE request: PHP-Fusion waraxe-2013-SA#097 + 20130228 [waraxe-2013-SA#097] - Multiple Vulnerabilities in PHP-Fusion 7.02.05 + http://packetstormsecurity.com/files/120598/PHP-Fusion-7.02.05-XSS-LFI-SQL-Injection.html + + + + + + + + + + + + + + PHP-Fusion before 7.02.06 stores backup files with predictable filenames in an unrestricted directory under the web document root, which might allow remote attackers to obtain sensitive information via a direct request to the backup file in administration/db_backups/. + + + + + + + + + http://www.php-fusion.co.uk/news.php?readmore=569 + http://www.waraxe.us/advisory-97.html + 90691 + [oss-security] 20130302 Re: CVE request: PHP-Fusion waraxe-2013-SA#097 + [oss-security] 20130303 CVE request: PHP-Fusion waraxe-2013-SA#097 + 20130228 [waraxe-2013-SA#097] - Multiple Vulnerabilities in PHP-Fusion 7.02.05 + http://packetstormsecurity.com/files/120598/PHP-Fusion-7.02.05-XSS-LFI-SQL-Injection.html + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in Ushahidi Platform 2.5.x through 2.6.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + https://wiki.ushahidi.com/display/WIKI/1+May+2013+-+CVE-2013-2025 + https://github.com/rjmackay/Ushahidi_Web/commit/593719ff805a302e3ab2f2e535c875f90a04ea56 + https://github.com/ushahidi/Ushahidi_Web/pull/1056 + https://github.com/ushahidi/Ushahidi_Web/issues/1009 + 59410 + + + + + + + + + + + + Transifex command-line client before 0.9 does not validate X.509 certificates, which allows man-in-the-middle attackers to spoof a Transifex server via an arbitrary certificate. + + + + + + + + + [oss-security] 20130522 CVE-2013-2073 transifex-client: Does not validate HTTPS server certificate (fixed in transifex-client v0.9) + http://blog.transifex.com/post/51072109836/new-version-of-the-transifex-client-has-been-released + https://bugzilla.redhat.com/show_bug.cgi?id=952194 + + + + + + + + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities in NETGEAR WNDR4700 with firmware 1.0.0.34 allow remote authenticated users to inject arbitrary web script or HTML via the (1) UserName or (2) Password to the NAS User Setup page, (3) deviceName to USB_advanced.htm, or (4) Network Key to the Wireless Setup page. + + + + + + + + + + http://securityevaluators.com/knowledge/case_studies/routers/Vulnerability_Catalog.pdf + 92557 + + + + + + + + + + + + + ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was a site-specific issue. Notes: none. + + + + + + ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-3414. Reason: This candidate is a duplicate of CVE-2012-3414. Notes: All CVE users should reference CVE-2012-3414 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. + + + + + + A certain Gentoo patch for the PAM S/Key module does not properly clear credentials from memory, which allows local users to obtain sensitive information by reading system memory. + + + + + + + + + GLSA-201402-12 + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the admin page in the Flag module 7.x-3.x before 7.x-3.1 for Drupal allows remote authenticated users with the "Administer flags" permission to inject arbitrary web script or HTML via the flag name. + + + + + + + + + + https://drupal.org/node/2076221 + https://drupal.org/node/2075287 + [oss-security] 20130911 Re: CVE request for Drupal contrib modules + + + + + + + + + + + ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-5965. Reason: This candidate is a duplicate of CVE-2013-5965. Notes: All CVE users should reference CVE-2013-5965 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. + + + + + + Heap-based buffer overflow in the __OLEdecode function in ppthtml 0.5.1 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted .ppt file. + + + + + + + + + + + + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=729279 + ppthtml-cve20134565-bo(88885) + [oss-security] 20131113 Re: CVE request: ppthtml heap-based buffer overflow + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities in Admin/login/default.asp in DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions allow remote attackers to inject arbitrary web script or HTML via the (1) username, (2) url, (3) qstr parameter. + + + + + + + + + + http://www.digitalsec.net/stuff/explt+advs/CM3.AcoraCMS.v6.txt + http://packetstormsecurity.com/files/122954/CM3-AcoraCMS-XSS-CSRF-Redirection-Disclosure.html + 96661 + + + + + + + + + + + + + Open redirect vulnerability in DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the l parameter to track.aspx. + + + + + + + + + + + http://www.digitalsec.net/stuff/explt+advs/CM3.AcoraCMS.v6.txt + http://packetstormsecurity.com/files/122954/CM3-AcoraCMS-XSS-CSRF-Redirection-Disclosure.html + 96662 + + + + + + + + + + + + + Cross-site request forgery (CSRF) vulnerability in DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. + + + + + + + + + + + + http://www.digitalsec.net/stuff/explt+advs/CM3.AcoraCMS.v6.txt + http://packetstormsecurity.com/files/122954/CM3-AcoraCMS-XSS-CSRF-Redirection-Disclosure.html + 96665 + + + + + + + + + + + + + Integer underflow in Picasa3.exe in Google Picasa before 3.9.0 Build 137.69 allows remote attackers to execute arbitrary code via a crafted JPEG tag that triggers a heap-based buffer overflow, as demonstrated using a Canon RAW CR2 file with a large JPEG tag value and a small size. + + + + + + + + + + + https://support.google.com/picasa/answer/53209 + 1029527 + http://secunia.com/secunia_research/2013-14/ + 55555 + + + + + + + + + + Integer overflow in Picasa3.exe in Google Picasa before 3.9.0 Build 137.69 allows remote attackers to execute arbitrary code via a long TIFF tag that triggers a heap-based buffer overflow, as demonstrated using a Canon RAW CR2 file with a long TIFF StripByteCounts tag. + + + + + + + + + + + https://support.google.com/picasa/answer/53209 + 1029527 + http://secunia.com/secunia_research/2013-14/ + 55555 + + + + + + + + + + Picasa3.exe in Google Picasa before 3.9.0 Build 137.69 allows remote attackers to trigger memory corruption via a crafted TIFF tag, as demonstrated using a KDC file with a DSLR-A100 model and certain sequences of tags. + + + + + + + + + + + https://support.google.com/picasa/answer/53209 + 1029527 + http://secunia.com/secunia_research/2013-14/ + 55555 + + + + + + + + + + Stack-based buffer overflow in Picasa3.exe in Google Picasa before 3.9.0 Build 137.69 might allow remote attackers to execute arbitrary code via a crafted RAW file, as demonstrated using a KDC file with a certain size. + + + + + + + + + + + https://support.google.com/picasa/answer/53209 + 1029527 + http://secunia.com/secunia_research/2013-14/ + 55555 + + + + + + + + + + Buffer overflow in Power Software WinArchiver 3.2 allows remote attackers to execute arbitrary code via a crafted .zip file. + + + + + + + + + + + + 59626 + 20130902 list of vulnerabilities discovered by realpentesting + http://realpentesting.blogspot.com.es/p/blog-page_3.html + http://packetstormsecurity.com/files/121512/Winarchiver-3.2-Buffer-Overflow.html + 92992 + http://osvdb.org/ref/92/winarchiver-overflow.txt + + + + + + + + + + Multiple cross-site request forgery (CSRF) vulnerabilities in OpenX 2.8.11 and earlier allow remote attackers to hijack the authentication of administrators for requests that delete (1) users via admin/agency-user-unlink.php, (2) advertisers via admin/advertiser-delete.php, (3) banners via admin/banner-delete.php, (4) campaigns via admin/campaign-delete.php, (5) channels via admin/channel-delete.php, (6) affiliate websites via admin/affiliate-delete.php, or (7) zones via admin/zone-delete.php. + + + + + + + + + + + + openx-cve20135954-csrf(91889) + 66251 + 20140315 [CVE-2013-5954] Multiple Cross Site Request Forgery Vulnerabilities in OpenX 2.8.11 + http://packetstormsecurity.com/files/125735 + + + + + + + + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in includes/flvthumbnail.php in the Youtube Gallery (com_youtubegallery) component 3.4.0 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the videofile parameter. + + + + + + + + + + 20140315 Re: XSS Vulnerability in the Youtube Gallery 3.4.0 Component + 20140315 XSS Vulnerability in the Youtube Gallery 3.4.0 Component + http://packetstormsecurity.com/files/125732/Joomla-Youtube-Gallery-3.4.0-Cross-Site-Scripting.html + + + + + + + + + + OpenJPEG 1.5.1 allows remote attackers to obtain sensitive information via unspecified vectors that trigger a heap-based out-of-bounds read. + + + + + + + + + https://code.google.com/p/openjpeg/issues/detail?id=297 + https://bugzilla.redhat.com/show_bug.cgi?id=1036493 + 64121 + [oss-security] 20131204 Fwd: [vs] multiple issues in openjpeg + http://openjpeg.googlecode.com/svn/tags/version.1.5.2/NEWS + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Application Server (WAS) 7.x before 7.0.0.33, 8.x before 8.0.0.9, and 8.5.x before 8.5.5.2, and WebSphere Virtual Enterprise 7.x before 7.0.0.5, allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. + + + + + + + + + + ibm-was-cve20136323-xss(88903) + http://www-01.ibm.com/support/docview.wss?uid=swg21669554 + PI04880 + PI04777 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, uses the DES-based crypt function to hash passwords, which makes it easier for attackers to obtain sensitive information via a brute-force attack. + + + + + + + + + 1030158 + RHSA-2014:0441 + RHSA-2014:0440 + + + + + + + + + + OpenJPEG 1.5.1 allows remote attackers to cause a denial of service via unspecified vectors that trigger NULL pointer dereferences, division-by-zero, and other errors. + + + + + + + + + + 57285 + [oss-security] 20131204 Fwd: [vs] multiple issues in openjpeg + http://openjpeg.googlecode.com/svn/tags/version.1.5.2/NEWS + + + + + + + + + + FortiGuard FortiAuthenticator before 3.0 allows remote administrators to gain privileges via the command line interface. + + + + + + + + + + + + http://www.fortiguard.com/advisory/FG-IR-13-016/ + + + + + + + + + + Products/CMFPlone/FactoryTool.py in Plone 3.3 through 4.3.2 allows remote attackers to obtain the installation path via vectors related to a file object for unspecified documentation which is initialized in class scope. + + + https://plone.org/security/20131210/path-leak + [oss-security] 20131211 Re: CVE request for Plone + [oss-security] 20131210 CVE request for Plone + + + + + Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive information via an unspecified search API. + + + https://plone.org/security/20131210/catalogue-exposure + [oss-security] 20131211 Re: CVE request for Plone + [oss-security] 20131210 CVE request for Plone + + + + + The Invitation module 7.x-2.x for Drupal does not properly check permissions, which allows remote attackers to obtain sensitive information via unspecified default views. + + + + + + + + + https://drupal.org/node/2140097 + [oss-security] 20131211 Re: CVE request for Drupal core, and contributed modules + [oss-security] 20131206 CVE request for Drupal core, and contributed modules + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the EU Cookie Compliance module 7.x-1.x before 7.x-1.12 for Drupal allows remote authenticated administrators with the "Administer EU Cookie Compliance popup" permission to inject arbitrary web script or HTML via unspecified configuration values. + + + + + + + + + + https://drupal.org/node/2140123 + https://drupal.org/node/2139875 + [oss-security] 20131211 Re: CVE request for Drupal core, and contributed modules + [oss-security] 20131206 CVE request for Drupal core, and contributed modules + + + + + + + + + + + + + + + + + + + The Organic Groups (OG) module 7.x-2.x before 7.x-2.3 for Drupal allows remote attackers to bypass access restriction and post to arbitrary groups via a group audience field, as demonstrated by the og_group_ref field. + + + + + + + + + + https://drupal.org/node/2140217 + https://drupal.org/node/2140209 + [oss-security] 20131211 Re: CVE request for Drupal core, and contributed modules + [oss-security] 20131206 CVE request for Drupal core, and contributed modules + + + + + + + + + + + + + + + + + + + + + + + + The Entity reference module 7.x-1.x before 7.x-1.1-rc1 for Drupal allows remote attackers to read private nodes titles by leveraging edit permissions to a node that references a private node. + + + + + + + + + https://drupal.org/node/2140237 + https://drupal.org/node/2140229 + + + + + + + + + + + + + + + + + + + + + + + The Organic Groups (OG) module 7.x-2.x before 7.x-2.3 for Drupal allows remote authenticated users to bypass group restrictions on nodes with all groups set to optional input via an empty group field. + + + + + + + + + + https://drupal.org/node/2140217 + https://drupal.org/node/2140209 + [oss-security] 20131211 Re: CVE request for Drupal core, and contributed modules + [oss-security] 20131206 CVE request for Drupal core, and contributed modules + + + + + + + + + + + + + + + + + + + + + + + + Transifex command-line client before 0.10 does not validate X.509 certificates for data transfer connections, which allows man-in-the-middle attackers to spoof a Transifex server via an arbitrary certificate. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-2073. + + + + + + + + + https://github.com/transifex/transifex-client/issues/42 + [oss-security] 20131215 Re: CVE-2013-2073 transifex-client: Does not validate HTTPS server certificate (fixed in transifex-client v0.9) + [oss-security] 20131213 Re: CVE-2013-2073 transifex-client: Does not validate HTTPS server certificate (fixed in transifex-client v0.9) + + + + + + + + + + + + + + + + + + The put_call function in the API client (api/api_client.rb) in the BaseSpace Ruby SDK (aka bio-basespace-sdk) gem 0.1.7 for Ruby uses the API_KEY on the command line, which allows remote attackers to obtain sensitive information by listing the processes. + + + + + + + + + http://www.vapid.dhs.org/advisories/bio-basespace-sdk.html + [oss-security] 20131215 Re: Bio Basespace SDK 0.1.7 Ruby Gem exposes API Key via command line + [oss-security] 20131214 Bio Basespace SDK 0.1.7 Ruby Gem exposes API Key via command line + + + + + + + + + + Juvia uses the same secret key for all installations, which allows remote attackers to have unspecified impact by leveraging the secret key in app/config/initializers/secret_token.rb, related to cookies. + + + + + + + + + + + https://github.com/phusion/juvia/issues/55 + [oss-security] 20131217 Re: CVE request: Juvia secret token handling + [oss-security] 20131216 CVE request: Juvia secret token handling + + + + + + + + + + js/ui/screenShield.js in GNOME Shell (aka gnome-shell) before 3.8 allows physically proximate attackers to execute arbitrary commands by leveraging an unattended workstation with the keyboard focus on the Activities search. + Per: https://cwe.mitre.org/data/definitions/77.html + +"CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')" + + + + + + + + + + + https://github.com/o2platform/DefCon_RESTing/tree/master/Live-Demos/Neo4j + https://bugzilla.redhat.com/show_bug.cgi?id=1030431 + https://bugzilla.gnome.org/show_bug.cgi?id=686740 + [oss-security] 20131227 Re: Two CVE request for gnome-shell/screensaver issues + [oss-security] 20131227 Re: Two CVE request for gnome-shell/screensaver issues + [oss-security] 20131227 Two CVE request for gnome-shell/screensaver issues + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The automatic screen lock functionality in GNOME Shell (aka gnome-shell) before 3.10 does not prevent access to the "Enter a Command" dialog, which allows physically proximate attackers to execute arbitrary commands by leveraging an unattended workstation. + + + + + + + + + + + https://git.gnome.org/browse/gnome-shell/commit/js/ui/main.js?id=efdf1ff755943fba1f8a9aaeff77daa3ed338088 + https://bugzilla.gnome.org/show_bug.cgi?id=708313 + [oss-security] 20131227 Re: Two CVE request for gnome-shell/screensaver issues + [oss-security] 20131227 Two CVE request for gnome-shell/screensaver issues + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Simple Machines Forum (SMF) before 1.1.19 and 2.x before 2.0.6 allows remote attackers to conduct clickjacking attacks via an X-Frame-Options header. + + + + + + + + + + [oss-security] 20131229 Re: CVE request: SMF 1.1.19, 2.0.6 + [oss-security] 20131230 CVE request: SMF 1.1.19, 2.0.6 + http://www.jakoblell.com/blog/2013/12/13/multiple-vulnerabilities-in-smf-forum-software/ + 20131213 Multiple vulnerabilities in SMF forum software + http://download.simplemachines.org/index.php?thanks;filename=smf_2-0-6_changelog.txt + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Simple Machines Forum (SMF) before 1.1.19 and 2.x before 2.0.6 allows remote attackers to impersonate arbitrary users via multiple space characters characters. + + + + + + + + + + + [oss-security] 20131229 Re: CVE request: SMF 1.1.19, 2.0.6 + [oss-security] 20131230 CVE request: SMF 1.1.19, 2.0.6 + http://www.jakoblell.com/blog/2013/12/13/multiple-vulnerabilities-in-smf-forum-software/ + 20131213 Multiple vulnerabilities in SMF forum software + http://download.simplemachines.org/index.php?thanks;filename=smf_2-0-6_changelog.txt + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Simple Machines Forum (SMF) 2.0.6, 1.1.19, and earlier allows remote attackers to impersonate arbitrary users via a Unicode homoglyph character in a username. + + + + + + + + + + + [oss-security] 20131229 Re: CVE request: SMF 1.1.19, 2.0.6 + [oss-security] 20131230 CVE request: SMF 1.1.19, 2.0.6 + http://www.jakoblell.com/blog/2013/12/13/multiple-vulnerabilities-in-smf-forum-software/ + 20131213 Multiple vulnerabilities in SMF forum software + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary code, as demonstrated by a request to (1) db/data/ext/GremlinPlugin/graphdb/execute_script or (2) db/manage/server/console/. + + + + + + + + + + https://github.com/o2platform/DefCon_RESTing/tree/master/Live-Demos/Neo4j + [oss-security] 20140103 Re: Neo4J CSRF: Potential CVE candidate + [oss-security] 20140103 Neo4J CSRF: Potential CVE candidate + http://blog.diniscruz.com/2013/08/neo4j-csrf-payload-to-start-processes.html + + + + + + + + + + Multiple stack-based buffer overflows in RealNetworks RealPlayer before 17.0.4.61 on Windows, and Mac RealPlayer before 12.0.1.1738, allow remote attackers to execute arbitrary code via a long (1) version number or (2) encoding declaration in the XML declaration of an RMP file, a different issue than CVE-2013-6877. + + + + + + + + + + + VU#698278 + realplayer-cve20137260-bo(90160) + 30468 + http://service.real.com/realplayer/security/12202013_player/en/ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + GNOME Display Manager (gdm) 3.4.1 and earlier, when disable-user-list is set to true, allows local users to cause a denial of service (unable to login) by pressing the cancel button after entering a user name. + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1050745 + https://bugzilla.gnome.org/show_bug.cgi?id=704284 + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=683338 + [oss-security] 20140107 CVE Re: request: lightdm-gtk-greeter - local DOS due to NULL pointer dereference + [oss-security] 20140107 CVE Re: request: lightdm-gtk-greeter - local DOS due to NULL pointer dereference + + + + + + + + + + + + + + + + + + + + + + + + + The PlRPC module, possibly 0.2020 and earlier, for Perl uses the Storable module, which allows remote attackers to execute arbitrary code via a crafted request, which is not properly handled when it is deserialized. + + + + + + + + + + + https://rt.cpan.org/Public/Bug/Display.html?id=90474 + https://bugzilla.redhat.com/show_bug.cgi?id=1051108 + https://bugzilla.redhat.com/show_bug.cgi?id=1030572 + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=734789 + [oss-security] 20140109 Re: PlRPC Perl module: pre-auth remote code execution, weak crypto + [oss-security] 20140109 PlRPC Perl module: pre-auth remote code execution, weak crypto + + + + + + + + + + + + + + + + + + + + + + + Session fixation vulnerability in the Ubercart module 6.x-2.x before 6.x-2.13 and 7.x-3.x before 7.x-3.6 for Drupal, when the "Log in new customers after checkout" option is enabled, allows remote attackers to hijack web sessions by leveraging knowledge of the original session ID. + + + + + + + + + + + https://drupal.org/node/2158651 + https://drupal.org/node/2158567 + https://drupal.org/node/2158565 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The engineNextBytes function in classlib/modules/security/src/main/java/common/org/apache/harmony/security/provider/crypto/SHA1PRNG_SecureRandomImpl.java in the SecureRandom implementation in Apache Harmony through 6.0M3, as used in the Java Cryptography Architecture (JCA) in Android before 4.4 and other products, when no seed is provided by the user, uses an incorrect offset value, which makes it easier for attackers to defeat cryptographic protection mechanisms by leveraging the resulting PRNG predictability, as exploited in the wild against Bitcoin wallet applications in August 2013. + + + + + + + + + https://android.googlesource.com/platform/libcore/+/kitkat-release/luni/src/main/java/org/apache/harmony/security/provider/crypto/SHA1PRNG_SecureRandomImpl.java + http://android-developers.blogspot.com.au/2013/08/some-securerandom-thoughts.html + https://bitcoin.org/en/alert/2013-08-11-android + http://www.nds.rub.de/media/nds/veroeffentlichungen/2013/03/25/paper_2.pdf + + + + + + + + + + + + + + + + + + + + + + + + Android before 4.4 does not properly arrange for seeding of the OpenSSL PRNG, which makes it easier for attackers to defeat cryptographic protection mechanisms by leveraging use of the PRNG within multiple applications. + + + + + + + + + + + http://www.reddit.com/r/Android/comments/1k6f03/due_to_a_serious_encryptionrng_flaw_in_android/cblvum5 + [openssl-dev] 20110416 Re: recycled pids causes PRNG to repeat + [openssl-dev] 20110415 recycled pids causes PRNG to repeat + http://emboss.github.io/blog/2013/08/21/openssl-prng-is-not-really-fork-safe/ + http://android-developers.blogspot.com.au/2013/08/some-securerandom-thoughts.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The Ubuntu Date and Time Indicator (aka indicator-datetime) 13.10.0+13.10.x before 13.10.0+13.10.20131023.2-0ubuntu1.1 does not properly restrict access to Evolution, which allows local users to bypass the greeter screen restrictions by clicking the date. + + + + + + + + + + + https://bugs.launchpad.net/ubuntu/%2Bsource/indicator-datetime/%2Bbug/1246812 + USN-2186-1 + [oss-security] 20140430 Re: CVE Request: indicator-datetime issue + [oss-security] 20140429 CVE Request: indicator-datetime issue + http://bazaar.launchpad.net/~indicator-applet-developers/indicator-datetime/trunk.13.10/revision/282 + + + + + + + + + + The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 5.00 before 7.1.8 beta2 allows remote attackers to cause a denial of service (crash) via vectors related to "a NULL pointer of the username." + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1059903 + https://bugzilla.redhat.com/show_bug.cgi?id=1056767 + [oss-security] 20140131 Security Flaw CVE-2014-0037 + MDVSA-2014:044 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 7.1.8, 6.20.0, and earlier, when using certain build conditions, allows remote attackers to cause a denial of service (crash) via vectors related to "a NULL pointer of the password." + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1059903 + MDVSA-2014:044 + + + + + + + + + + + + + + + + + + + + + + + + The SPDY implementation in the ngx_http_spdy_module module in nginx 1.5.10 before 1.5.11, when running on a 32-bit platform, allows remote attackers to execute arbitrary code via a crafted request. + + + + + + + + + + + [nginx-announce] 20140304 nginx security advisory (CVE-2014-0088) + 1030150 + + + + + + + + + + ParametersInterceptor in Apache Struts before 2.3.16.2 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094. + + + + + + + + + + + https://cwiki.apache.org/confluence/display/WW/S2-021 + https://bugzilla.redhat.com/show_bug.cgi?id=1091939 + JVNDB-2014-000045 + JVN#19294237 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + CookieInterceptor in Apache Struts before 2.3.16.2, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094. + + + + + + + + + + + https://cwiki.apache.org/confluence/display/WW/S2-021 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The ActionForm object in Apache Struts 1.x through 1.3.10 allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, which is passed to the getClass method. + + + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1091938 + + + + + + + + + + + + + + + + + + + + + + + + + The Sheepdog backend in OpenStack Image Registry and Delivery Service (Glance) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote authenticated users with permission to insert or modify an image to execute arbitrary commands via a crafted location. + + + + + + + + + + + https://launchpad.net/bugs/1298698 + [oss-security] 20140410 [OSSA 2014-012] Remote code execution in Glance Sheepdog backend (CVE-2014-0162) + + + + + + + + + + + + + + + + The Netlink implementation in the Linux kernel through 3.14.1 does not provide a mechanism for authorizing socket operations based on the opener of a socket, which allows local users to bypass intended access restrictions and modify network configurations by using a Netlink socket for the (1) stdout or (2) stderr of a setuid program. + + + + + + + + + https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=90f62cf30a78721641e08737bda787552428061e + [oss-security] 20140423 Re: CVE-2014-0181: Linux network reconfiguration due to incorrect netlink checks + [netdev] 20140423 [PATCH 0/5]: Preventing abuse when passing file descriptors + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The openvswitch-agent process in OpenStack Neutron 2013.1 before 2013.2.4 and 2014.1 before 2014.1.1 allows remote authenticated users to bypass security group restrictions via an invalid CIDR in a security group rule, which prevents further rules from being applied. + + + + + + + + + + + https://bugs.launchpad.net/neutron/+bug/1300785 + [oss-security] 20140422 [OSSA 2014-014] Neutron security groups bypass through invalid CIDR (CVE-2014-0187) + + + + + + + + + + + + + + + + + + + + virt-who uses world-readable permissions for /etc/sysconfig/virt-who, which allows local users to obtain password for hypervisors by reading the file. + + + https://bugzilla.redhat.com/show_bug.cgi?id=1088732 + https://bugzilla.redhat.com/show_bug.cgi?id=1081286 + 67089 + [oss-security] 20140428 CVE-2014-0189: /etc/sysconfig/virt-who is world-readable (contains unencrypted passwords) + + + + + The Poco::Net::X509Certificate::verify method in the NetSSL library in POCO C++ Libraries before 1.4.6p4 allows man-in-the-middle attackers to spoof SSL servers via crafted DNS PTR records that are requested during comparison of a server name to a wildcard domain name in an X.509 certificate. + + + + + + + + + + VU#118748 + https://raw.githubusercontent.com/pocoproject/poco/poco-1.4.6p4-release/CHANGELOG + + + + + + + + + + + + + + The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraints and nameConstraints in X.509 certificate chains from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate chain. + Per: http://cwe.mitre.org/data/definitions/358.html + +"CWE-358: Improperly Implemented Security Check for Standard" + + + + + + + + + + VU#489228 + http://issues.igniterealtime.org/browse/SMACK-410 + http://community.igniterealtime.org/blogs/ignite/2014/04/17/asmack-400-rc1-has-been-released + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify the from attribute of a roster-query IQ stanza, which allows remote attackers to spoof IQ responses via a crafted attribute. + Per: http://cwe.mitre.org/data/definitions/345.html + +"CWE-345: Insufficient Verification of Data Authenticity" + + + + + + + + + VU#489228 + http://community.igniterealtime.org/blogs/ignite/2014/04/17/asmack-400-rc1-has-been-released + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + super.c in Super 3.30.0 does not check the return value of the setuid function when the -F flag is set, which allows local users to gain privileges via unspecified vectors, aka an RLIMIT_NPROC attack. + + + + + + + + + + + + [oss-security] 20140428 super unchecked setuid (CVE-2014-0470) + DSA-2917 + + + + + + + + + + Directory traversal vulnerability in the unpacking functionality in dpkg before 1.15.9, 1.16.x before 1.16.13, and 1.17.x before 1.17.8 allows remote attackers to write arbitrary files via a crafted source package, related to "C-style filename quoting." + + + + + + + + + + + + USN-2183-1 + DSA-2915 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Buffer overflow in Adobe Flash Player before 11.7.700.279 and 11.8.x through 13.0.x before 13.0.0.206 on Windows and OS X, and before 11.2.202.356 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in April 2014. + + + Per: http://helpx.adobe.com/security/products/flash-player/apsb14-13.html + +"Affected software versions + + Adobe Flash Player 13.0.0.182 and earlier versions for Windows + Adobe Flash Player 13.0.0.201 and earlier versions for Macintosh + Adobe Flash Player 11.2.202.350 and earlier versions for Linux" + + + + + + + + + + + http://helpx.adobe.com/security/products/flash-player/apsb14-13.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The runtime WS component in the server in EMC RSA Access Manager 6.1.3 before 6.1.3.39, 6.1.4 before 6.1.4.22, 6.2.0 before 6.2.0.11, and 6.2.1 before 6.2.1.03, when INFO logging is enabled, allows local users to discover cleartext passwords by reading log files. + + + + + + + + + + + 20140430 ESA-2014-029: RSA Access Manager Sensitive Information Disclosure Vulnerability + + + + + + + + + + + + + The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion provide an undocumented access method involving the FTP protocol, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors. + + + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01 + + + + + + + + + + + + + + + + + + + The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion do not require authentication for connections to certain TCP ports, which allows remote attackers to (1) modify the configuration via a request to the debug service on port 4000 or (2) delete log entries via a request to the log service on port 4001. + + + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01 + + + + + + + + + + + + + + + + + + + Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests. + + + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-107-02 + + + + + + + + + + + + Ecava IntegraXor before 4.1.4393 allows remote attackers to read cleartext credentials for administrative accounts via SELECT statements that leverage the guest role. + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-091-01 + http://www.integraxor.com/blog/category/security/vulnerability-note/ + + + + + + + + + + + + + + + IBM WebSphere Application Server (WAS) 8.x before 8.0.0.9 and 8.5.x before 8.5.5.2 allows remote attackers to read arbitrary files via a crafted URL. + + + + + + + + + ibm-was-cve20140823-viewfiles(90498) + http://www-01.ibm.com/support/docview.wss?uid=swg21669554 + PI05324 + + + + + + + + + + + + + + + + + + + + + + + The Administrative Console in IBM WebSphere Application Server (WAS) 8.x before 8.0.0.9 and 8.5.x before 8.5.5.2 allows remote authenticated users to obtain sensitive information via a crafted request. + + + + + + + + + ibm-was-cve20140857-info-disc(90863) + http://www-01.ibm.com/support/docview.wss?uid=swg21669554 + PI07808 + + + + + + + + + + + + + + + + + + + + + + + The web-server plugin in IBM WebSphere Application Server (WAS) 7.x before 7.0.0.33, 8.x before 8.0.0.9, and 8.5.x before 8.5.5.2, when POST retries are enabled, allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors. + + + + + + + + + ibm-was-cve20140859-retry(90879) + http://www-01.ibm.com/support/docview.wss?uid=swg21669554 + PI08892 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + IBM WebSphere Application Server (WAS) Liberty Profile 8.5.x before 8.5.5.2 allows remote attackers to obtain sensitive information via a crafted request. + + + + + + + + + ibm-was-cve20140896-info-disc(91326) + http://www-01.ibm.com/support/docview.wss?uid=swg21669554 + PI10134 + + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in webtop/eventviewer/eventViewer.jsp in the Web GUI in IBM Netcool/OMNIbus 7.4.0 before FP2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2014-0942. + + + + + + + + + + ibm-netcoolomnibus-cve20140941-xss(92400) + http://www-01.ibm.com/support/docview.wss?uid=swg21671686 + + + + + + + + + + Cross-site scripting (XSS) vulnerability in webtop/eventviewer/eventViewer.jsp in the Web GUI in IBM Netcool/OMNIbus 7.4.0 before FP2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2014-0941. + + + + + + + + + + ibm-netcoolomnibus-cve20140942-xss(92401) + http://www-01.ibm.com/support/docview.wss?uid=swg21671686 + + + + + + + + + + Livetecs Timelive before 6.2.8 does not properly restrict access to systemsetting.aspx, which allows remote attackers to change configurations and obtain the database connection string and credentials via unspecified vectors. + + + + + + + + + + + https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1217/ + 67043 + 20140423 CVE-2014-1217 - Unauthenticated access to sensitive information and functionality in Livetecs Timelive + 20140423 CVE-2014-1217 - Unauthenticated access to sensitive information and functionality in Livetecs Timelive + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Core FTP Server 1.2 before build 515 allows remote attackers to cause a denial of service (reachable assertion and crash) via an AUTH SSL command with malformed data, as demonstrated by pressing the enter key twice. + + + + + + + + + 102966 + 56850 + 20140205 Core FTP Server Vulnerabilities + http://packetstormsecurity.com/files/125073/Core-FTP-Server-1.2-DoS-Traversal-Disclosure.html + http://coreftp.com/forums/viewtopic.php?t=2985707 + + + + + + + + + + Directory traversal vulnerability in Core FTP Server 1.2 before build 515 allows remote authenticated users to determine the existence of arbitrary files via a /../ sequence in an XCRC command. + + + + + + + + + 102967 + 56850 + 20140205 Core FTP Server Vulnerabilities + http://packetstormsecurity.com/files/125073/Core-FTP-Server-1.2-DoS-Traversal-Disclosure.html + http://coreftp.com/forums/viewtopic.php?t=2985707 + + + + + + + + + + Core FTP Server 1.2 before build 515 allows remote authenticated users to obtain sensitive information (password for the previous user) via a USER command with a specific length, possibly related to an out-of-bounds read. + + + + + + + + + 102968 + 56850 + 20140205 Core FTP Server Vulnerabilities + http://packetstormsecurity.com/files/125073/Core-FTP-Server-1.2-DoS-Traversal-Disclosure.html + http://coreftp.com/forums/viewtopic.php?t=2985707 + + + + + + + + + + Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=993546 + https://bugzilla.mozilla.org/show_bug.cgi?id=992968 + https://bugzilla.mozilla.org/show_bug.cgi?id=991471 + https://bugzilla.mozilla.org/show_bug.cgi?id=986843 + https://bugzilla.mozilla.org/show_bug.cgi?id=986678 + https://bugzilla.mozilla.org/show_bug.cgi?id=980537 + https://bugzilla.mozilla.org/show_bug.cgi?id=966630 + https://bugzilla.mozilla.org/show_bug.cgi?id=952022 + https://bugzilla.mozilla.org/show_bug.cgi?id=944353 + http://www.mozilla.org/security/announce/2014/mfsa2014-34.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=996883 + https://bugzilla.mozilla.org/show_bug.cgi?id=995607 + https://bugzilla.mozilla.org/show_bug.cgi?id=990794 + https://bugzilla.mozilla.org/show_bug.cgi?id=986864 + https://bugzilla.mozilla.org/show_bug.cgi?id=977955 + https://bugzilla.mozilla.org/show_bug.cgi?id=953104 + https://bugzilla.mozilla.org/show_bug.cgi?id=946658 + https://bugzilla.mozilla.org/show_bug.cgi?id=919592 + http://www.mozilla.org/security/announce/2014/mfsa2014-34.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + maintenservice_installer.exe in the Maintenance Service Installer in Mozilla Firefox before 29.0 and Firefox ESR 24.x before 24.5 on Windows allows local users to gain privileges by placing a Trojan horse DLL file into a temporary directory at an unspecified point in the update process. + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=961676 + http://www.mozilla.org/security/announce/2014/mfsa2014-35.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The mozilla::dom::OscillatorNodeEngine::ComputeCustom function in the Web Audio subsystem in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read, memory corruption, and application crash) via crafted content. + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=995289 + http://www.mozilla.org/security/announce/2014/mfsa2014-36.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Heap-based buffer overflow in the read_u32 function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG image. + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=969226 + http://www.mozilla.org/security/announce/2014/mfsa2014-37.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The nsXBLProtoImpl::InstallImplementation function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 does not properly check whether objects are XBL objects, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via crafted JavaScript code that accesses a non-XBL object as if it were an XBL object. + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=989183 + http://www.mozilla.org/security/announce/2014/mfsa2014-38.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The mozilla::dom::TextTrack::AddCue function in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 does not properly perform garbage collection for Text Track Manager variables, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and heap memory corruption) via a crafted VIDEO element in an HTML document. + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=989210 + http://www.mozilla.org/security/announce/2014/mfsa2014-39.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The XrayWrapper implementation in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allows user-assisted remote attackers to bypass intended access restrictions via a crafted web site that is visited in the debugger, leading to unwrapping operations and calls to DOM methods on the unwrapped objects. + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=988106 + http://www.mozilla.org/security/announce/2014/mfsa2014-47.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Mozilla Firefox before 29.0 on Android allows remote attackers to spoof the address bar via crafted JavaScript code that uses DOM events to prevent the reemergence of the actual address bar after scrolling has taken it off of the screen. + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=960146 + http://www.mozilla.org/security/announce/2014/mfsa2014-40.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The sse2_composite_src_x888_8888 function in Pixman, as used in Cairo in Mozilla Firefox 28.0 and SeaMonkey 2.25 on Windows, allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write and application crash) by painting on a CANVAS element. + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=963962 + http://www.mozilla.org/security/announce/2014/mfsa2014-41.html + + + + + + + + + + + + + The Web Notification API in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to bypass intended source-component restrictions and execute arbitrary JavaScript code in a privileged context via a crafted web page for which Notification.permission is granted. + + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=987003 + http://www.mozilla.org/security/announce/2014/mfsa2014-42.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The docshell implementation in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to trigger the loading of a URL with a spoofed baseURI property, and conduct cross-site scripting (XSS) attacks, via a crafted web site that performs history navigation. + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=895557 + http://www.mozilla.org/security/announce/2014/mfsa2014-43.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Use-after-free vulnerability in the nsGenericHTMLElement::GetWidthHeightForImage function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving an imgLoader object that is not properly handled during an image-resize operation. + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=987140 + http://www.mozilla.org/security/announce/2014/mfsa2014-44.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Use-after-free vulnerability in the nsHostResolver::ConditionallyRefreshRecord function in libxul.so in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors related to host resolution. + + + + + + + + + + + https://bugzilla.mozilla.org/show_bug.cgi?id=966006 + http://www.mozilla.org/security/announce/2014/mfsa2014-46.html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Google V8, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly store internationalization metadata, which allows remote attackers to bypass intended access restrictions by leveraging "type confusion" and reading property values, related to i18n.js and runtime.cc. + + + + + + + + + https://code.google.com/p/v8/source/detail?r=20595 + https://code.google.com/p/v8/source/detail?r=20593 + https://code.google.com/p/v8/source/detail?r=20388 + https://code.google.com/p/v8/source/detail?r=20377 + https://code.google.com/p/v8/source/detail?r=20375 + https://code.google.com/p/chromium/issues/detail?id=354967 + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html + + + + + + + + + + + core/html/HTMLSelectElement.cpp in the DOM implementation in Blink, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly check renderer state upon a focus event, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion" for SELECT elements. + + + + + + + + + + + https://src.chromium.org/viewvc/blink?revision=171216&view=revision + https://code.google.com/p/chromium/issues/detail?id=349903 + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html + + + + + + + + + + + Use-after-free vulnerability in browser/ui/views/speech_recognition_bubble_views.cc in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux allows remote attackers to cause a denial of service or possibly have unspecified other impact via an INPUT element that triggers the presence of a Speech Recognition Bubble window for an incorrect duration. + + + + + + + + + + + https://src.chromium.org/viewvc/chrome?revision=261737&view=revision + https://code.google.com/p/chromium/issues/detail?id=352851 + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html + + + + + + + + + + + The PointerCompare function in codegen.cc in Seccomp-BPF, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly merge blocks, which might allow remote attackers to bypass intended sandbox restrictions by leveraging renderer access. + + + + + + + + + + + https://src.chromium.org/viewvc/chrome?revision=260157&view=revision + https://code.google.com/p/chromium/issues/detail?id=351103 + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html + + + + + + + + + + + Multiple unspecified vulnerabilities in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux allow attackers to cause a denial of service or possibly have other impact via unknown vectors. + + + + + + + + + + + https://code.google.com/p/chromium/issues/detail?id=367314 + https://code.google.com/p/chromium/issues/detail?id=357382 + https://code.google.com/p/chromium/issues/detail?id=356181 + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html + + + + + + + + + + + Multiple unspecified vulnerabilities in Google V8 before 3.24.35.33, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, allow attackers to cause a denial of service or possibly have other impact via unknown vectors. + + + + + + + + + + + https://src.chromium.org/viewvc/blink?revision=171127&view=revision + https://src.chromium.org/viewvc/blink?revision=171077&view=revision + https://code.google.com/p/v8/source/detail?r=20624 + https://code.google.com/p/v8/source/detail?r=20622 + https://code.google.com/p/v8/source/detail?r=20501 + https://code.google.com/p/chromium/issues/detail?id=360429 + https://code.google.com/p/chromium/issues/detail?id=359525 + https://code.google.com/p/chromium/issues/detail?id=359130 + http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html + + + + + + + + + + + Unspecified vulnerability in Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code with medium-integrity privileges and bypass a sandbox protection mechanism via unknown vectors, as demonstrated by ZDI during a Pwn4Fun competition at CanSecWest 2014. + + + + + + + + + + + http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/ + http://twitter.com/thezdi/statuses/443810610958958592 + + + + + + + + + + Use-after-free vulnerability in Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014. + + + + + + + + + + + http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/ + http://twitter.com/thezdi/statuses/443855973673754624 + + + + + + + + + + Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism by leveraging "object confusion" in a broker process, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014. + + + + + + + + + + + http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/ + http://twitter.com/thezdi/statuses/443855973673754624 + + + + + + + + + + Multiple use-after-free vulnerabilities in Microsoft Internet Explorer 11 allow remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by Sebastian Apelt and Andreas Schmidt during a Pwn2Own competition at CanSecWest 2014. + + + + + + + + + + + http://www.pwn2own.com/2014/03/pwn2own-results-thursday-day-two/ + http://twitter.com/thezdi/statuses/444216845734666240 + + + + + + + + + + Unspecified vulnerability in the kernel in Microsoft Windows 8.1 allows local users to gain privileges via unknown vectors, as demonstrated by Sebastian Apelt and Andreas Schmidt during a Pwn2Own competition at CanSecWest 2014. + + + + + + + + + + + http://www.pwn2own.com/2014/03/pwn2own-results-thursday-day-two/ + http://twitter.com/thezdi/statuses/444216845734666240 + + + + + + + + + + Use-after-free vulnerability in VGX.DLL in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, as exploited in the wild in April 2014. + + + + + + + + + + + https://technet.microsoft.com/library/security/2963983 + http://www.fireeye.com/blog/uncategorized/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.html + + + + + + + + + + + + + + + Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to copy an arbitrary user's home folder via a Move action with a .. (dot dot) in the src parameter. + + + + + + + + + 20140210 Titan FTP Server Directory Traversal Vulnerabilities - [CVE-2014-1841 / CVE-2014-1842 / CVE-2014-1843] + + + + + + + + + + + + + Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to list all usernames via a Go action with a .. (dot dot) in the search-bar value. + + + + + + + + + 20140210 Titan FTP Server Directory Traversal Vulnerabilities - [CVE-2014-1841 / CVE-2014-1842 / CVE-2014-1843] + + + + + + + + + + + + + Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to obtain the property information of an arbitrary home folder via a Properties action with a .. (dot dot) in the src parameter. + + + + + + + + + 20140210 Titan FTP Server Directory Traversal Vulnerabilities - [CVE-2014-1841 / CVE-2014-1842 / CVE-2014-1843] + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in Citrix NetScaler Gateway (formerly Citrix Access Gateway Enterprise Edition) 9.x before 9.3.66.5 and 10.x before 10.1.123.9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + https://support.citrix.com/article/CTX140291 + + + + + Cross-site scripting (XSS) vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + http://www.fortiguard.com/advisory/FG-IR-13-009/ + + + + + + + + + + CRLF injection vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors. + CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') "http://cwe.mitre.org/data/definitions/113.html" + + + + + + + + + + + http://www.fortiguard.com/advisory/FG-IR-13-009/ + + + + + + + + + + FortiGuard FortiWeb before 5.0.3 allows remote authenticated users to gain privileges via unspecified vectors. + + + + + + + + + + + + http://www.fortiguard.com/advisory/FG-IR-13-009/ + + + + + + + + + + The Phone Messages feature in Cybozu Garoon 2.0.0 through 3.7 SP2 allows remote authenticated users to cause a denial of service (resource consumption) via unspecified vectors. + + + + + + + + + https://support.cybozu.com/ja-jp/article/8105 + JVNDB-2014-000042 + JVN#90519014 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cybozu Garoon 3.0 through 3.7 SP3 allows remote authenticated users to bypass intended access restrictions and delete schedule information via unspecified API calls. + + + + + + + + + + + https://support.cybozu.com/ja/article/5264 + JVNDB-2014-000043 + JVN#31230946 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Unrestricted file upload vulnerability in the Manage Project functionality in Livetecs Timelive before 6.5.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in a predictable directory in Uploads/. + Per: http://cwe.mitre.org/data/definitions/434.html + +"CWE-434: Unrestricted Upload of File with Dangerous Type" + + + + + + + + + + + 20140423 CVE-2014-2042 - Unrestricted file upload in Livetecs Timelive + 20140423 CVE-2014-2042 - Unrestricted file upload in Livetecs Timelive + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCty45739. + + + Per: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-mxp + +" Vulnerable Products +The following products running a version of Cisco TelePresence System MXP Series Software prior to F9.3.1 are affected by the vulnerabilities described in this advisory: + + Cisco TelePresence System 1700 MXP + Cisco TelePresence System 1000 MXP + Cisco TelePresence System Edge 75 MXP + Cisco TelePresence System Edge 85 MXP + Cisco TelePresence System Edge 95 MXP + Cisco TelePresence System Codec 3000 MXP + Cisco TelePresence System Codec 6000 MXP + Tandberg 550 MXP + Tandberg 770 MXP + Tandberg 880 MXP + Tandberg 990 MXP + Tandberg 2000 MXP" + + + + + + + + + + 20140430 Multiple Vulnerabilities in Cisco TelePresence System MXP Series + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCty45733. + + + Per: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-mxp + +" Vulnerable Products +The following products running a version of Cisco TelePresence System MXP Series Software prior to F9.3.1 are affected by the vulnerabilities described in this advisory: + + Cisco TelePresence System 1700 MXP + Cisco TelePresence System 1000 MXP + Cisco TelePresence System Edge 75 MXP + Cisco TelePresence System Edge 85 MXP + Cisco TelePresence System Edge 95 MXP + Cisco TelePresence System Codec 3000 MXP + Cisco TelePresence System Codec 6000 MXP + Tandberg 550 MXP + Tandberg 770 MXP + Tandberg 880 MXP + Tandberg 990 MXP + Tandberg 2000 MXP" + + + + + + + + + 20140430 Multiple Vulnerabilities in Cisco TelePresence System MXP Series + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCty45720. + + + + + + + + + 20140430 Multiple Vulnerabilities in Cisco TelePresence System MXP Series + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The H.225 subsystem in Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted packets, aka Bug ID CSCtq78722. + + + + + + + + + 20140430 Multiple Vulnerabilities in Cisco TelePresence System MXP Series + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The H.225 subsystem in Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted packets, aka Bug ID CSCty45745. + + + + + + + + + 20140430 Multiple Vulnerabilities in Cisco TelePresence System MXP Series + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The H.225 subsystem in Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted packets, aka Bug ID CSCty45731. + + + + + + + + + 20140430 Multiple Vulnerabilities in Cisco TelePresence System MXP Series + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCud29566. + + + + + + + + + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCua64961. + + + + + + + + + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCuj94651. + + + + + + + + + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCtq72699. + + + + + + + + + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The SIP implementation in Cisco TelePresence TC Software 4.x and TE Software 4.x allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCto70562. + + + + + + + + + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + + + + + + + + + + + + + + + + + + + + + + + + The SIP implementation in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCua86589. + + + + + + + + + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Buffer overflow in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows remote attackers to execute arbitrary code via crafted DNS response packets, aka Bug ID CSCty44804. + + + + + + + + + + + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cisco TelePresence TC Software 4.x through 6.x before 6.2.0 and TE Software 4.x and 6.0 allow remote authenticated users to execute arbitrary commands by using the commands as arguments to internal system scripts, aka Bug ID CSCue60211. + + + + + + + + + + + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cisco TelePresence TC Software 4.x and 5.x before 5.1.7 and 6.x before 6.0.1 and TE Software 4.x and 6.0 allow remote authenticated users to execute arbitrary commands by using the commands as arguments to tshell (aka tcsh) scripts, aka Bug ID CSCue60202. + + + + + + + + + + + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Heap-based buffer overflow in Cisco TelePresence TC Software 4.x through 6.x before 6.0.1 and TE Software 4.x and 6.0.x before 6.0.2 allows remote attackers to execute arbitrary code via crafted SIP packets, aka Bug ID CSCud81796. + + + + + + + + + + + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Buffer overflow in Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allows local users to gain privileges by leveraging improper handling of the u-boot compiler flag for internal executable files, aka Bug ID CSCub67693. + + + + + + + + + + + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 do not properly restrict access to the serial port, which allows local users to gain privileges via unspecified commands, aka Bug ID CSCub67692. + + + + + + + + + + + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Cisco TelePresence TC Software 4.x and 5.x and TE Software 4.x and 6.0 allow remote attackers to cause a denial of service (memory consumption) via crafted H.225 packets, aka Bug ID CSCtq78849. + + + + + + + + + 20140430 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The Document Management component in Cisco Unified Contact Center Express does not properly validate a parameter, which allows remote authenticated users to upload files to arbitrary pathnames via a crafted HTTP request, aka Bug ID CSCun74133. + + + + + + + + + 20140428 Cisco Unified Contact Center Express Arbitrary File Upload Vulnerability + + + + + + + + + + + + + Cisco Adaptive Security Appliance (ASA) Software, when DHCPv6 replay is configured, allows remote attackers to cause a denial of service (device reload) via a crafted DHCPv6 packet, aka Bug ID CSCun45520. + + + + + + + + + 20140428 Cisco ASA DHCPv6 Denial of Service Vulnerability + + + + + + + + + + The L2TP module in Cisco IOS XE 3.10S(.2) and earlier on ASR 1000 routers allows remote authenticated users to cause a denial of service (ESP card reload) via a malformed L2TP packet, aka Bug ID CSCun09973. + + + + + + + + + http://tools.cisco.com/security/center/viewAlert.x?alertId=33971 + 20140428 Cisco IOS XE Software Malformed L2TP Packet Vulnerability + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The IP Manager Assistant (IPMA) component in Cisco Unified Communications Manager (Unified CM) allows remote attackers to obtain sensitive information via a crafted URL, aka Bug ID CSCun74352. + + + + + + + + + 20140428 Cisco Unified Communications Manager Sensitive Information Disclosure Vulnerability + + + + + + + + + + The Call Detail Records (CDR) Management component in Cisco Unified Communications Manager (Unified CM) allows remote authenticated users to obtain sensitive information by reading extraneous fields in an HTML document, aka Bug ID CSCun74374. + + + + + + + + + 20140428 Cisco Unified Communications Manager CDR Management Vulnerability + + + + + + + + + + Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco WebEx Meetings Server allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuj81777. + + + + + + + + + + + + 20140429 Cisco WebEx Meetings Server Cross-Site Request Forgery Vulnerability + + + + + + + + + + Cross-site scripting (XSS) vulnerability in plugins/main/content/js/ajenti.coffee in Eugene Pankov Ajenti 1.2.13 allows remote authenticated users to inject arbitrary web script or HTML via the command field in the Cron functionality. + + + + + + + + + + https://github.com/Eugeny/ajenti/commit/3270fd1d78391bb847b4c9ce37cf921f485b1310 + https://github.com/Eugeny/ajenti/issues/233 + 64982 + 102174 + http://packetstormsecurity.com/files/124804/Ajenti-1.2.13-Cross-Site-Scripting.html + + + + + + + + + + The perl_trapd_handler function in perl/TrapReceiver/TrapReceiver.xs in Net-SNMP 5.7.3.pre3 and earlier, when using certain Perl versions, allows remote attackers to cause a denial of service (snmptrapd crash) via an empty community string in an SNMP trap, which triggers a NULL pointer dereference within the newSVpv function in Perl. + + + + + + + + + https://bugzilla.redhat.com/show_bug.cgi?id=1072778 + https://bugzilla.redhat.com/show_bug.cgi?id=1072044 + http://www.nntp.perl.org/group/perl.perl5.porters/2006/09/msg116250.html + http://sourceforge.net/p/net-snmp/patches/1275/ + openSUSE-SU-2014:0399 + openSUSE-SU-2014:0398 + [oss-security] 20140305 CVE request for two net-snmp remote DoS flaws + + + + + + + + + + lib/string_utf_support.rb in the Arabic Prawn 0.0.1 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) downloaded_file or (2) url variable. + + + http://www.vapid.dhs.org/advisories/arabic-ruby-gem.html + [oss-security] 20140312 Re: Remote Command Injection in Arabic Prawn 0.0.1 Ruby Gem + [oss-security] 20140310 Remote Command Injection in Arabic Prawn 0.0.1 Ruby Gem + + + + + dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the input_file parameter. + + + + + + + + + https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2383/ + https://github.com/dompdf/dompdf/commit/23a693993299e669306929e3d49a4a1f7b3fb028 + 20140423 CVE-2014-2383 - Arbitrary file read in dompdf + 20140423 CVE-2014-2383 - Arbitrary file read in dompdf + + + + + + + + + + TIBCO Managed File Transfer Internet Server before 7.2.2, Managed File Transfer Command Center before 7.2.2, Slingshot before 1.9.1, and Vault before 1.0.1 allow remote attackers to obtain sensitive information via a crafted HTTP request. + + + + + + + + + http://www.tibco.com/multimedia/mft_advisory_20140429_tcm8-21013.txt + http://www.tibco.com/mk/advisory.jsp + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The commandline interface in Blue Coat Content Analysis System (CAS) 1.1 before 1.1.4.2 allows remote administrators to execute arbitrary commands via unspecified vectors, related to "command injection." + + + + + + + + + + + https://kb.bluecoat.com/index?page=content&id=SA78&actp=LIST + + + + + + + + + + + + + + + Multiple cross-site request forgery (CSRF) vulnerabilities in XCloner Standalone 3.5 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) change the administrator password via the config task to index2.php or (2) when the enable_db_backup and sql_mem options are enabled, access the database backup functionality via the dbbackup_comp parameter in the generate action to index2.php. NOTE: vector 2 might be a duplicate of CVE-2014-2340, which is for the XCloner Wordpress plugin. NOTE: remote attackers can leverage CVE-2014-2996 with vector 2 to execute arbitrary commands. + + + + + + + + + + + https://www.htbridge.com/advisory/HTB23207 + 20140409 &ETH;&iexcl;ross-Site Request Forgery (CSRF) in XCloner Standalone + 32790 + + + + + + + + + + The server in HP Integrated Lights-Out 2 (aka iLO 2) 2.23 and earlier allows remote attackers to cause a denial of service via crafted HTTPS traffic, as demonstrated by traffic from a CVE-2014-0160 vulnerability-assessment tool. + + + + + + + + + SSRT101509 + HPSBHF03006 + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in the print release functionality in PaperCut MF 14.1 (Build 26983) has unknown impact and remote vectors, related to embedded MFPs. + + + + + + + + + + + papercut-cve20142657-unspec(92650) + http://www.papercut-mf.com/release-history/ + + + + + + + + + + Unspecified vulnerability in Papercut MF and NG before 14.1 (Build 26983) allows attacker to cause a denial of service via unknown vectors. + + + + + + + + + papercut-cve20142658-dos(92649) + http://www.papercut.com/release-history/ + http://www.papercut-mf.com/release-history/ + 58037 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities in vwrooms\templates\logout.tpl.php in the VideoWhisper Webcam plugins for Drupal 7.x allow remote attackers to inject arbitrary web script or HTML via the (1) module or (2) message parameter to index.php. + + + + + + + + + + 20140425 [CVE-2014-2715] Cross-site scripting (XSS) vulnerability in Videowhisper + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in content.aspx in Ektron CMS 8.7 before 8.7.0.055 allows remote authenticated users to inject arbitrary web script or HTML via the category0 parameter, which is not properly handled when displaying the Subjects tab in the View Properties menu option. + + + + + + + + + + 20140416 [SECURITY] Stored Cross Site Scripting in Ektron CMS 8.7 + 20140416 [Security Advisory] Stored Cross Site Scripting in Ektron CMS 8.7 + http://packetstormsecurity.com/files/126187/Ektron-CMS-8.7-Cross-Site-Scripting.html + + + + + + + + + + The openssl extension in Ruby 2.x does not properly maintain the state of process memory after a file is reopened, which allows remote attackers to spoof signatures within the context of a Ruby script that attempts signature verification after performing a certain sequence of filesystem operations. + + + + + + + + + + https://gist.github.com/10446549 + 20140416 Ruby OpenSSL private key spoofing ~ CVE-2014-2734 with PoC + http://packetstormsecurity.com/files/126218/Ruby-OpenSSL-Private-Key-Spoofing.html + + + + + + + + + + + + + + + + + + + + Directory traversal vulnerability in opt/arkeia/wui/htdocs/index.php in the WD Arkeia virtual appliance (AVA) with firmware before 10.2.9 allows remote attackers to read arbitrary files and execute arbitrary PHP code via a ..././ (dot dot dot slash dot slash) in the lang Cookie parameter, as demonstrated by a request to login/doLogin. + + + + + + + + + + + 20140423 SEC Consult SA-20140423-0 :: Path Traversal/Remote Code Execution in WD Arkeia Network Backup Appliances + 20140423 SEC Consult SA-20140423-0 :: Path Traversal/Remote Code Execution in WD Arkeia Network Backup Appliances + + + + + + + + + + + + + Cross-site scripting (XSS) vulnerability in includes/actions/InfoAction.php in MediaWiki before 1.21.9 and 1.22.x before 1.22.6 allows remote attackers to inject arbitrary web script or HTML via the sort key in an info action. + + + + + + + + + + https://www.mediawiki.org/wiki/Release_notes/1.22#Changes_since_1.22.5 + https://www.mediawiki.org/wiki/Release_notes/1.21#Changes_since_1.21.8 + https://github.com/wikimedia/mediawiki-core/commit/0b695ae09aada343ab59be4a3c9963995a1143b6 + https://bugzilla.wikimedia.org/show_bug.cgi?id=63251 + https://bugzilla.redhat.com/show_bug.cgi?id=1091967 + 67068 + 58262 + [MediaWiki-announce] 20140424 MediaWiki Security and Maintenance Releases: 1.22.6 and 1.21.9 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Unspecified vulnerability in the Diffie-Hellman key agreement implementation in the management GUI Java applet in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 9.3-66.5 and 10.x before 10.1-122.17 has unknown impact and vectors. + + + + + + + + + + + 1030180 + http://support.citrix.com/article/CTX140651 + + + + + + + + + + + + + + + Unspecified vulnerability in the management GUI in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 9.3-66.5 and 10.x before 10.1-122.17 has unspecified impact and vectors, related to certificate validation. + + + + + + + + + + + 1030180 + http://support.citrix.com/article/CTX140651 + + + + + + + + + + + + + + + Off-by-one error in the bpf_jit_compile function in arch/x86/net/bpf_jit_comp.c in the Linux kernel before 3.1.8, when BPF JIT is enabled, allows local users to cause a denial of service (system crash) or possibly gain privileges via a long jump after a conditional jump. + + + + + + + + + + + https://github.com/torvalds/linux/commit/a03ffcf873fe0f2565386ca8ef832144c42e67fa + [oss-security] 20140418 Re: CVE request Linux kernel: arch: x86: net: bpf_jit: an off-by-one bug in x86_64 cond jump target + http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.1.8 + http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a03ffcf873fe0f2565386ca8ef832144c42e67fa + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly check the credentials, which allows local users to gain privileges via the universal variable socket, related to /tmp/fishd.socket.user permissions. + + + https://github.com/fish-shell/fish-shell/issues/1436 + [oss-security] 20140428 Upcoming security release of fish 2.1.1 + + + + + Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-114-02 + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-892012.pdf + + + + + + + + + + + + + + + + + + + + + + + + + + + CRLF injection vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inject arbitrary HTTP headers via unspecified vectors. + + + + + + + + + + + http://ics-cert.us-cert.gov/advisories/ICSA-14-114-02 + http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-892012.pdf + + + + + + + + + + + + + + + + + + + + + + + + + + + Tools/gdomap.c in gdomap in GNUstep Base 1.24.6 and earlier, when run in daemon mode, does not properly handle the file descriptor for the logger, which allows remote attackers to cause a denial of service (abort) via an invalid request. + + + + + + + + + http://svn.gna.org/viewcvs/gnustep/libs/base/trunk/Tools/gdomap.c?r1=37756&r2=37755&pathrev=37756 + https://savannah.gnu.org/bugs/?41751 + gnustep-cve20142980-dos(92688) + 66992 + http://svn.gna.org/viewcvs/gnustep/libs/base/trunk/ChangeLog?r1=37756&r2=37755&pathrev=37756 + 58104 + [oss-security] 20140421 Re: CVE request / advisory: gdomap (GNUstep core package <= 1.24.6) + [oss-security] 20140419 CVE request / advisory: gdomap (GNUstep core package <= 1.24.6) + + + + + + + + + + ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-2650. Reason: This candidate is a reservation duplicate of CVE-2014-2650. Notes: All CVE users should reference CVE-2014-2650 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. + + + + + + The vgic_distr_mmio_write function in the virtual guest interrupt controller (GIC) distributor (arch/arm/vgic.c) in Xen 4.4.x, when running on an ARM system, allows local guest users to cause a denial of service (NULL pointer dereference and host crash) via unspecified vectors. + + + + + + + + + http://xenbits.xen.org/xsa/advisory-94.html + 1030146 + 67047 + [oss-security] 20140423 Xen Security Advisory 94 (CVE-2014-2986) - ARM hypervisor crash on guest interrupt controller access + [oss-security] 20140423 Re: Xen Security Advisory 94 - ARM hypervisor crash on guest interrupt controller access + [oss-security] 20140423 Xen Security Advisory 94 - ARM hypervisor crash on guest interrupt controller access + + + + + + + + + + + The Misli.com application for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. + + + + + + + + + + http://sceptive.com/p/mislicom-android-app-ssl-certificate-validation-weakness- + 20140424 Misli.com Android App SSL certificate validation weakness + + + + + + + + + + The Birebin.com application for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. + + + + + + + + + + http://sceptive.com/p/birebincom-android-app-ssl-certificate-validation-weakness- + 20140424 Birebin.com Android App SSL certificate validation weakness + + + + + + + + + + Stack-based buffer overflow in Acunetix Web Vulnerability Scanner (WVS) 8 build 20120704 allows remote attackers to execute arbitrary code via an HTML file containing an IMG element with a long URL (src attribute). + + + + + + + + + + + https://www.youtube.com/watch?v=RHaMx8K1GeM + 32997 + http://www.acunetix.com/blog/news/misleading-reports-0-day-acunetix-wvs/ + http://packetstormsecurity.com/files/126307/Acunetix-8-Scanner-Buffer-Overflow.html + http://packetstormsecurity.com/files/126306/Acunetix-8-Stack-Buffer-Overflow.html + http://osandamalith.wordpress.com/2014/04/24/pwning-script-kiddies-acunetix-buffer-overflow/ + http://an7isec.blogspot.co.il/2014/04/pown-noobs-acunetix-0day.html + + + + + + + + + + XCloner Standalone 3.5 and earlier, when enable_db_backup and sql_mem are enabled, allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the dbbackup_comp parameter in a generate action to index2.php. NOTE: it is not clear whether this issue crosses privilege boundaries, since administrators might already have the privileges to execute code. NOTE: this can be leveraged by remote attackers using CVE-2014-2579. + + + + + + + + + + + https://www.htbridge.com/advisory/HTB23207 + 20140409 &ETH;&iexcl;ross-Site Request Forgery (CSRF) in XCloner Standalone + 32790 + + + + + + + + + + The TCP reassembly function in the inet module in FreeBSD 8.3 before p16, 8.4 before p9, 9.1 before p12, 9.2 before p5, and 10.0 before p2 allows remote attackers to cause a denial of service (undefined memory access and system crash) or possibly read system memory via multiple crafted packets, related to moving a reassemble queue entry to the segment list when the queue is full. + + + 1030172 + 67153 + FreeBSD-SA-14:08 + 58293 + + + + + The device file system (aka devfs) in FreeBSD 10.0 before p2 does not load default rulesets when booting, which allows context-dependent attackers to bypass intended restrictions by leveraging a jailed device node process. + + + 1030171 + 67158 + FreeBSD-SA-14:07 + + + + + Sitepark Information Enterprise Server (IES) 2.9 before 2.9.6, when upgraded from an earlier version, does not properly restrict access, which allows remote attackers to change the manager account password and obtain sensitive information via a request to install/. + + + https://www.lsexperts.de/advisories/lse-2014-04-10.txt + 67165 + 20140430 LSE Leading Security Experts GmbH - LSE-2014-04-10 - Sitepark IES - Unauthenticated Access + 20140430 LSE Leading Security Experts GmbH - LSE-2014-04-10 - Sitepark IES - Unauthenticated Access + + + + + Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py. + + + + + + + + + + + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059 + http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-1932.html + + + + + + + + + + + + + Unitrends Enterprise Backup 7.3.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the comm parameter to recoveryconsole/bpl/snmpd.php. + + + + + + + + + + + https://gist.github.com/brandonprry/10745756 + unitrends-snmpod-command-exec(92642) + 66928 + 32885 + 58001 + 20140415 Unitrends enterprise backup remote unauthenticated root + + + + + + + + + + Xen 4.4.x, when running on an ARM system, does not properly context switch the CNTKCTL_EL1 register, which allows local guest users to modify the hardware timers and cause a denial of service (crash) via unspecified vectors. + + + http://xenbits.xen.org/xsa/advisory-91.html + 1030184 + 67157 + [oss-security] 20140430 Xen Security Advisory 91 - Hardware timer context is not properly context switched on ARM + [oss-security] 20140430 Re: Xen Security Advisory 91 - Hardware timer context is not properly context switched on ARM + 58347 + + + + + The Java Server Pages in the Software Lifecycle Manager (SLM) in SAP NetWeaver allows remote attackers to obtain sensitive information via a crafted request, related to SAP Solution Manager 7.1. + + + + + + + + + https://service.sap.com/sap/support/notes/1894049 + 1030157 + http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-005 + 20140428 [Onapsis Security Advisory 2014-005] Information disclosure in SAP Software Lifeclycle Manager + http://scn.sap.com/docs/DOC-8218 + + + + + + + + + + The ABAP Help documentation and translation tools (BC-DOC-HLP) in Basis in SAP Netweaver ABAP Application Server does not properly restrict access, which allows local users to gain privileges and execute ABAP instructions via crafted help messages. + + + + + + + + + + + + https://service.sap.com/sap/support/notes/1910914 + http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-009 + 20140428 [Onapsis Security Advisory 2014-009] SAP BASIS Missing Authorization Check + http://scn.sap.com/docs/DOC-8218 + + + + + + + + + + SAP Profile Maintenance does not properly restrict access, which allows remote authenticated users to obtain sensitive information via an unspecified RFC function, related to SAP Solution Manager 7.1. + + + + + + + + + https://service.sap.com/sap/support/notes/1917381 + http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-007 + 20140428 [Onapsis Security Advisory 2014-007] Missing authorization check in SAP Profile Maintenance + http://scn.sap.com/docs/DOC-8218 + + + + + + + + + + SAP Background Processing does not properly restrict access, which allows remote authenticated users to obtain sensitive information via an unspecified RFC function, related to SAP Solution Manager 7.1. + + + + + + + + + https://service.sap.com/sap/support/notes/1918333 + http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-006 + 20140428 [Onapsis Security Advisory 2014-006] Missing authorization check in SAP Background Processing RFC + http://scn.sap.com/docs/DOC-8218 + + + + + + + + + + SAP Netweaver Java Application Server does not properly restrict access, which allows remote attackers to obtain the list of SAP systems registered on an SLD via an unspecified webdynpro, related to SystemSelection. + + + + + + + + + https://service.sap.com/sap/support/notes/1922547 + http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-008 + 20140428 [Onapsis Security Advisory 2014-008] SAP NW Portal WD Information Disclosure + http://scn.sap.com/docs/DOC-8218 + + + + + + + + + + Cross-site scripting (XSS) vulnerability in the InfoView application in SAP BusinessObjects allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + + + + + + + + + + https://service.sap.com/sap/support/notes/1931399 + http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-010 + 20140428 [Onapsis Security Advisory 2014-010] SAP BusinessObjects InfoView Reflected Cross Site Scripting + http://scn.sap.com/docs/DOC-8218 + + + + + + + + + + Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 5.1.1 Alpha 9 allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO to privatemessage/new/, (2) the folderid parameter to a private message in privatemessage/view, (3) a fragment indicator to /help, or (4) the view parameter to a topic, as demonstrated by a request to forum/anunturi-importante/rst-power/67030-rst-admin-restore. + + + + + + + + + + vbulletin-multiple-scripts-xss(92664) + 66972 + http://packetstormsecurity.com/files/126226/vBulletin-5.1-Cross-Site-Scripting.html + + + + + + + + + + SQL injection vulnerability in Xerox DocuShare before 6.53 Patch 6 Hotfix 2, 6.6.1 Update 1before Hotfix 24, and 6.6.1 Update 2 before Hotfix 3 allows remote authenticated users to execute arbitrary SQL commands via the PATH_INFO to /docushare/dsweb/ResultBackgroundJobMultiple/. NOTE: some of these details are obtained from third party information. + + + + + + + + + + + xerox-docushare-sql-injection(92548) + http://www.xerox.com/download/security/security-bulletin/a72cd-4f7a54ce14460/cert_XRX14-003_V1.0.pdf + 66922 + 105972 + 32886 + 57996 + 20140415 Xerox DocuShare authenticated SQL injection + http://packetstormsecurity.com/files/126171/Xerox-DocuShare-SQL-Injection.html + + + + + + + + + + + + + + recoveryconsole/bpl/snmpd.php in Unitrends Enterprise Backup 7.3.0 allows remote attackers to bypass authentication by setting the auth parameter to a certain string. + + + + + + + + + + + https://gist.github.com/brandonprry/10745756 + 32885 + 20140415 Unitrends enterprise backup remote unauthenticated root + + + + + + + + \ No newline at end of file