Vincent Danen

The issue is related to an insecure plugin update mechanism, which could allow remote attackers to perform man-in-the-middle attacks and execute arbitrary code with the permissions of the user running the software.

The issue allows local users to obtain sensitive information by reading the log when audit logging is enabled. This occurs because the Directory Manager password (`nsslapd-rootpw`) is logged in cleartext when changing `cn=config:nsslapd-rootpw`.

Name of the Vulnerable Software and Affected Versions: Symfony versions 2.0.X through 2.3.X before 2.0.24, 2.1.12, 2.2.5, and 2.3.3 Symfony version 2.0.X before 2.0.24 Symfony version 2.1.X before 2.1.12 Symfony version 2.2.X before 2.2.5 Symfony version 2.3.X before 2.3.3 However, to follow the instructions and consolidate the ranges into the most concise form, the above can be simplified to: Symfony versions 2.0.X through 2.3.X before their respective versions 2.0.24, 2.1.12, 2.2.5, and 2.3.3 Description: The issue lies in the HttpFoundation component where the Host header can be manipulated by an attacker when the framework is generating an absolute URL. A remote attacker could exploit this to inject malicious content into the Web application page and conduct various attacks. Recommendations: For Symfony version 2.0.X, update to version 2.0.24 or later. For Symfony version 2.1.X, update to version 2.1.12 or later. For Symfony version 2.2.X, update to version 2.2.5 or later. For Symfony version 2.3.X, update to version 2.3.3 or later.

A security issue was reported, but the patch applied to version 0.0.3-6.fc18 was improper and did not fix the issue.

The issue arises when a new wireless network is created with WPA/WPA2 security in AdHoc mode, resulting in the creation of an open or insecure network.

The issue is related to the suid helper in ecryptfs-utils, which does not properly restrict mounting filesystems with nosuid and nodev options. This oversight creates a possible privilege escalation scenario.

A security bypass issue exists due to a weak encryption error when generating Diffie-Hellman values and RSA keys. This affects the generation of secure keys, potentially compromising the encryption.

The issue is related to the creation of world-writable pid files in /var/run by mom. This could potentially allow unauthorized access or modification of these files.

The issue affects the /webtools/control/xmlrpc endpoint in the OFBiz XML-RPC event handler, making it vulnerable to External Entity Injection. This is achieved by passing DOCTYPE declarations with executable payloads, which can disclose the contents of files in the filesystem. Additionally, it can be used to probe for open network ports and determine whether a file exists or not based on returned error messages.

The issue arises from improper server identity verification before transmitting credential-containing cookies.

The issue concerns a cookie jar in the surf application that has read access from other local users.

The issue is related to a denial of service vulnerability that occurs when parsing #iferror magic functions.

The issue allows execution of arbitrary IRC commands by passing a specially crafted argument to the 'privmsg' handler, potentially causing the client to disconnect from the server. This can be achieved by including carriage returns and line feeds in the argument, such as "some textrQUIT".

The issue allows extremely long passwords to crash Keystone by exhausting stack space.

The issue occurs when a large message is sent and the Digest-MD5 mechanism with a security layer is in use, causing qpid-cpp to crash.

The issue allows attackers to cause a denial of service via a crafted search query, resulting in a NULL pointer dereference. This is due to a problem in the ` ger parse control` function.

The issue is related to an insecure temporary file vulnerability. It is associated with the /tmp/redis.ds file in Redis.

The issue concerns the loss of information during serialization when using the Validator component with caching enabled, specifically with `SymfonyComponentValidatorMappingCacheApcCache` or any other cache implementing `SymfonyComponentValidatorMappingCacheCacheInterface`. This results in the loss of the `collectionCascaded` and `collectionCascadedDeeply` fields. As a consequence, arrays or traversable objects stored in fields using the `@Valid` constraint are not traversed by the validator once the validator configuration is loaded from the cache.

The issue is related to Bitlbee not dropping extra group privileges correctly in the unix.c file. This could potentially lead to security problems, although specific details about exploitation or affected devices are not provided.

The issue allows deleted text to be exposed.