(Feb 2) Christian Mainka and Vladislav Mladenov reported a vulnerability in the OpenID module of Drupal, a fully-featured content management framework. A malicious user could exploit this flaw to log in as other users on the site, including administrators, and hijack their accounts. [More…]
(Dec 31) An unsafe use of temporary files was discovered in Puppet, a tool for centralized configuration management. An attacker can exploit this vulnerability and overwrite an arbitrary file in the system. [More…]
(Aug 2) It was discovered that otrs2, the Open Ticket Request System, does not properly sanitise user-supplied data that is used on SQL queries. An attacker with a valid agent login could exploit this issue to craft SQL queries by injecting arbitrary SQL code through manipulated URLs. [More…]
The following bug has been fixed:
[-] Critical security enhancement. Removal of malware which is possible to exploit without authenticating. Infected nodes might be known to and exploited by hackers.
The following bug has been fixed:
[-] Critical security enhancement. Removal of malware which is possible to exploit without authenticating. Infected nodes might be known to and exploited by hackers.
The following bug has been fixed:
[-] Critical security enhancement. Removal of malware which is possible to exploit without authenticating. Infected nodes might be known to and exploited by hackers.
The following bug has been fixed:
[-] Critical security enhancement. Removal of malware which is possible to exploit without authenticating. Infected nodes might be known to and exploited by hackers.
The following bug has been fixed:
[-] Critical security enhancement. Removal of malware which is possible to exploit without authenticating. Infected nodes might be known to and exploited by hackers.
The following bug has been fixed:
[-] Critical security enhancement. Removal of malware which is possible to exploit without authenticating. Infected nodes might be known to and exploited by hackers.
The following bug has been fixed:
[-] Critical security enhancement. Removal of malware which is possible to exploit without authenticating. Infected nodes might be known to and exploited by hackers.
(Oct 26) It was discovered that Exim, a mail transport agent, is not properly handling the decoding of DNS records for DKIM. Specifically, crafted records can yield to a heap-based buffer overflow. An attacker can exploit this flaw to execute arbitrary code. [More…]
The following bug has been fixed:
[-] Critical security enhancement. Removal of malware which is possible to exploit without authenticating. Infected nodes might be known to and exploited by hackers.
The following bug has been fixed:
[-] Critical security enhancement. Removal of malware which is possible to exploit without authenticating. Infected nodes might be known to and exploited by hackers.
The following bug has been fixed:
[-] Critical security enhancement. Removal of malware which is possible to exploit without authenticating. Infected nodes might be known to and exploited by hackers.
The following bug has been fixed:
[-] Critical security enhancement. Removal of malware which is possible to exploit without authenticating. Infected nodes might be known to and exploited by hackers.
The following bug has been fixed:
[-] Critical security enhancement. Removal of malware which is possible to exploit without authenticating. Infected nodes might be known to and exploited by hackers.
The following bug has been fixed:
[-] Critical security enhancement. Removal of malware which is possible to exploit without authenticating. Infected nodes might be known to and exploited by hackers.
The following bug has been fixed:
[-] Critical security enhancement. Removal of malware which is possible to exploit without authenticating. Infected nodes might be known to and exploited by hackers.
(Sep 11) Timo Warns discovered that the EAP-TLS handling of freeradius, a high-performance and highly configurable RADIUS server, is not properly performing length checks on user-supplied input before copying to a local stack buffer. As a result, an unauthenticated attacker can exploit this [More…]
(Aug 12) Just Ferguson discovered that libotr, an off-the-record (OTR) messaging library, can be forced to perform zero-length allocations for heap buffers that are used in base64 decoding routines. An attacker can exploit this flaw by sending crafted messages to an application that is using libotr to [More…]
Inadequate permission checking allows unauthorised viewing of some administrative back end information.
Joomla! versions 2.5.3 and all earlier 2.5.x versions
Upgrade to version 2.5.4
Reported by Cyrille Barthelemy
The JSST at the Joomla! Security Center.
55 queries. 9 mb Memory usage. 1.286 seconds.