nodejs-connect: XSS via HTTP request with a crafted method containing JavaScript

node-connect before 2.8.1 has XSS in the Sencha Labs Connect middleware

Bayeux: Reflected Cross-Site Scripting (XSS)

JBossWeb Bayeux has reflected XSS

rubygem-nokogiri: DoS while parsing XML entities

Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits

rubygem-nokogiri: DoS while parsing XML documents

Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents

Framework: org.spring.web.util.JavaScriptUtils.javaScriptEscape insufficient escaping of characters

The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket.

DNS response rate limiting can simplify cache poisoning attacks

Cache Poisoning issue exists in DNS Response Rate Limiting.

python-pip: insecure software download with mirroring support

The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.

php-symfony2-Validator has loss of information during serialization

openshift-origin-msg-node-mcollective: /etc/cron.minutely/openshift-facts tmp file creation

In a openshift node, there is a cron job to update mcollective facts that mishandles a temporary file. This may lead to loss of confidentiality and integrity.

qemu: virtio: insufficient validation of num_sg when mapping

An user able to alter the savevm data (either on the disk or over the wire during migration) could use this flaw to to corrupt QEMU process memory on the (destination) host, which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process.

qemu: virtio: insufficient validation of num_sg when mapping

The virtqueue_map_sg function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary files via a crafted savevm image, related to virtio-block or virtio-serial read.

RHUI: PKI entitlement certificates are world readable

RHUI (Red Hat Update Infrastructure) 2.1.3 has world readable PKI entitlement certificates

Zanata: Remote code execution due to EL interpolation in logging

Zanata 3.0.0 through 3.1.2 has RCE due to EL interpolation in logging

CloudForms: user password stored in recoverable format

CloudForms stores user passwords in recoverable format

An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests.

Server: Malicious change set import due to insecure temporary file usage

An insecurity temporary file vulnerability exists in RHQ Mongo DB Drift Server through 2013-09-25 when unpacking zipped files.

OpenShift: openshift-origin-broker-util incorrect temporary file usage

(1) oo-analytics-export and (2) oo-analytics-import in the openshift-origin-broker-util package in Red Hat OpenShift Enterprise 1 and 2 allow local users to have unspecified impact via a symlink attack on an unspecified file in /tmp.

vdsm: /tmp file vulnerability issues

Insecure temporary file vulnerability in RedHat vsdm 4.9.6.

scipy: weave /tmp and current directory issues

The scipy.weave component in SciPy before 0.12.1 creates insecure temporary directories.

Katello: proxied Candlepin calls authorization bypass

The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the "access resource node" and "create page content" permissions (or equivalents) to conduct cross-site scripting (XSS) or execute arbitrary PHP code via a crafted text field.