Cross-site scripting (XSS) vulnerability in EMC Isilon InsightIQ 2.x and 3.x before 3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Monthly Archives: December 2014
CVE-2014-4633
Cross-site scripting (XSS) vulnerability in EMC RSA Archer GRC Platform 5.x before 5.5.1.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2014-8134
The paravirt_ops_setup function in arch/x86/kernel/kvm.c in the Linux kernel through 3.18 uses an improper paravirt_enabled setting for KVM guest kernels, which makes it easier for guest OS users to bypass the ASLR protection mechanism via a crafted application that reads a 16-bit value.
Suricata IDPE 2.0.5
Suricata is a network intrusion detection and prevention engine developed by the Open Information Security Foundation and its supporting vendors. The engine is multi-threaded and has native IPv6 support. It’s capable of loading existing Snort rules and signatures and supports the Barnyard and Barnyard2 tools.
Tuleap PHP Unserialize Code Execution
This Metasploit module exploits a PHP object injection vulnerability in Tuelap <= 7.6-4 which could be abused to allow authenticated users to execute arbitrary code with the permissions of the web server. The dangerous unserialize() call exists in the ‘src/www/project/register.php’ file. The exploit abuses the destructor method from the Jabbex class in order to reach a call_user_func_array() call in the Jabbex class and call the fetchPostActions() method from the Transition_PostAction_FieldFactory class to execute PHP code through an eval() call. In order to work, the target must have the ‘sys_create_project_in_one_step’ option disabled.
RSA Authentication Manager 8.0 / 8.1 Unvalidated Redirect
A potential vulnerability in RSA Authentication Manager 8.0 and RSA Authentication Manager 8.1 may allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks.
RSA Archer GRC Platform 5.x Cross Site Scripting
RSA Archer GRC Platform version 5.x suffers from cross site scripting and various other Oracle JRE 7 vulnerabilities.
EMC Isilon InsightIQ Cross Site Scripting
EMC Isilon InsightIQ may be potentially affected by a cross-site scripting vulnerability that could be exploited by malicious users to compromise the affected system. EMC Isilon InsightIQ versions 3.0.1, 3.0.0, 2.5.2, 2.5.1, 2.5.0, 2.1.0, 2.0.1, and 2.0.0 are affected.
Docker Privilege Escalation / Path Traversal / Spoofing
Docker version 1.3.3 has been released to address privilege escalation, path traversal, and spoofing vulnerabilities.
Red Hat Security Advisory 2014-1985-01
Red Hat Security Advisory 2014-1985-01 – The Berkeley Internet Name Domain is an implementation of the Domain Name System protocols. BIND includes a DNS server ; a resolver library ; and tools for verifying that the DNS server is operating correctly. A denial of service flaw was found in the way BIND followed DNS delegations. A remote attacker could use a specially crafted zone containing a large number of referrals which, when looked up and processed, would cause named to use excessive amounts of memory or crash.