It was discovered that the XML::Atom Perl module before version 0.39 did not disable external entities when parsing XML from potentially untrusted sources. This may allow attackers to gain read access to otherwise protected resources, depending on how the library is used.

mod_cluster registers and exposes the root context of a JBoss AS 7 server by default, despite ROOT being in the excluded-contexts list

JBoss AS 7 prior to 7.1.1 and mod_cluster do not handle default hostname in the same way, which can cause the excluded-contexts list to be mismatched and the root context to be exposed.

The init script in the Debian x11-common package before 1:7.6+12 is vulnerable to a symlink attack that can lead to a privilege escalation during package installation.

404like Plugin 404Like.php checkPage sql injection

A vulnerability was found in 404like Plugin up to 1.0.2 on WordPress. It has been classified as critical. Affected is the function checkPage of the file 404Like.php. The manipulation of the argument searchWord leads to sql injection. It is possible to launch the attack remotely. Upgrading to version 1.0.2 is able to address this issue. The name of the patch is 2c4b589d27554910ab1fd104ddbec9331b540f7f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-223404.

A Memory Corruption Vulnerability exists in NVIDIA Graphics Drivers 29549 due to an unknown function in the file proc/driver/nvidia/registry.

PyXML: hash table collisions CPU usage DoS (oCERT-2011-003)

PyXML: Hash table collisions CPU usage Denial of Service

Hash collision attack vulnerability in Jenkins before 1.447, Jenkins LTS before 1.424.2, and Jenkins Enterprise by CloudBees 1.424.x before 1.424.2.1 and 1.400.x before 1.400.0.11 could allow remote attackers to cause a considerable CPU load, aka "the Hash DoS attack."

spamdyke prior to 4.2.1: STARTTLS reveals plaintext

Insecure plugin update mechanism in tucan through 0.3.10 could allow remote attackers to perform man-in-the-middle attacks and execute arbitrary code ith the permissions of the user running tucan.

OverlayFS in the Linux kernel before 3.0.0-16.28, as used in Ubuntu 10.0.4 LTS and 11.10, is missing inode security checks which could allow attackers to bypass security restrictions and perform unauthorized actions.

Tahoe-LAFS 1.9.0 fails to ensure integrity which allows remote attackers to corrupt mutable files or directories upon retrieval.

mediawiki allows deleted text to be exposed

Snare for Linux before 1.7.0 has password disclosure because the rendered page contains the field RemotePassword.

hook_file_download in the CKEditor module 7.x-1.4 for Drupal does not properly restrict access to private files, which allows remote attackers to read private files via a direct request.

tog-pegasus: xml hash table collision CPU usage DoS

tog-Pegasus has a package hash collision DoS vulnerability

cobbler: Local privilege escalation due use of insecure (world writable) location for PYTHON_EGG_CACHE cache

cobbler has local privilege escalation via the use of insecure location for PYTHON_EGG_CACHE

(cobbler-web): Absent CSRF protection when using Django framework

cobbler: Web interface lacks CSRF protection when using Django framework

Joomla! 1.7.1 has core information disclosure due to inadequate error checking.

gpw generates shorter passwords than required

mpack 1.6 has information disclosure via eavesdropping on mails sent by other users