Matthew Daley

It is possible to retrieve site keys used for securing MIFARE Plus and Desfire using debug ports on T Series readers.

An issue in Xen allows 64-bit PV guest OS users to cause a denial of service, resulting in a host OS crash. This occurs because a non-canonical address can be passed to the TLB flushing code, leading to a #GP[0] exception. The issue exists due to an incorrect mitigation of a previous problem.

The issue allows remote attackers to bypass authentication by leveraging knowledge of the LDAP bind user DN.

The issue concerns multiple cross-site request forgery (CSRF) vulnerabilities. CSRF is a type of attack where an attacker tricks a user into performing unintended actions on a web application that the user is authenticated to.

An issue was discovered in the ` gnttab cache flush` function, which handles GNTTABOP cache flush grant table operations. The function checks if the calling domain is the owner of the page to be operated on and if a grant mapping exists in the owner's grant table. However, it does not verify if the owning domain has a grant table. Special domains like `DOMID XEN`, `DOMID IO`, and `DOMID COW` are created without grant tables, leading to a NULL pointer dereference when ` gnttab cache flush` operates on a page owned by these domains.

The issue allows remote authenticated users to execute arbitrary PHP code by storing a crafted string in a user configuration file, due to improper sanitization of input strings.

The issue allows remote authenticated users to execute arbitrary PHP code by injecting scripts via the `path`, `filename`, and `period` parameters to "scheduled.php", and making requests to injected scripts. Additionally, it is possible to inject PHP into a PHP configuration variable via a PHP variable variable.

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the `swf` parameter in the SWF panel.

The issue allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect. This is due to a problem in the `resolve redirects` function in sessions.py.

The issue allows remote attackers to cause a denial of service, resulting in an abort, by sending a crafted chunk-encoded body.

The issue allows remote attackers to cause a denial of service, resulting in an invalid read and crash, through vectors related to an HTTP time header.

The issue allows remote attackers to cause a denial of service by consuming file descriptors via an HTTP request that triggers an error message, when the File Descriptor Table (FDT) is enabled and custom error messages are set.

The issue allows remote attackers to execute arbitrary SQL commands via several parameters, including the `login` parameter in `send pw by email` or `generate new password` actions, `iDisplayStart` and `iDisplayLength` parameters to files in `datatable/`, or the `sSortDir ` parameter to files in `datatable/` for remote authenticated users.

The issue allows remote attackers to bypass access restrictions. This can be achieved via the language file path in a request to "index.php" or a "change user language" request to "sources/main.queries.php".

The issue allows remote attackers to bypass access restrictions. This can be achieved by sending a request to "index.php" followed by a direct request to a file that calls the `session start()` function before checking the `CPM` key. An example of such a request is a call to "sources/upload/upload.files.php".

The issue allows remote attackers to inject arbitrary web script or HTML via the `group` parameter, which is not properly handled in a (1) `hid cat` or (2) `open folder` form element, or (3) `id` parameter, which is not properly handled in the `open id` form element. This occurs in the `items.php` file.

The issue concerns the cherokee validator ldap check function in validator ldap.c. When LDAP is used, it does not properly consider unauthenticated-bind semantics. This allows remote attackers to bypass authentication by using an empty password.

The issue is related to the raw cmd copyout function in drivers/block/floppy.c, which does not properly restrict access to certain pointers during processing of an FDRAWCMD ioctl call. This allows local users to obtain sensitive information from kernel heap memory by leveraging write access to a /dev/fd device. The problem is due to a lack of input sanitization in the FDRAWCMD ioctl system call, which can lead to information leakage and potentially elevate privileges.

Multiple integer overflows in unspecified suboperations in the flask hypercall in Xen 3.2.x and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1891, CVE-2014-1892, and CVE-2014-1893.

Multiple integer overflows in the (1) FLASK GETBOOL, (2) FLASK SETBOOL, (3) FLASK USER, and (4) FLASK CONTEXT TO SID suboperations in the flask hypercall in Xen 4.3.x, 4.2.x, 4.1.x, 3.2.x, and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1892, CVE-2014-1893, and CVE-2014-1894.