Weekly Digest: a new vulnerability is published on the National Vulnerability Database (19 items)

New vulnerabilities from the NVD: CVE-2015-5350 In Garden versions 0.22.0-0.329.0, a vulnerability has been discovered in the garden-linux nstar executable that allows access to files on the host system. By staging an application on Cloud Foundry using Diego and Garden installations with a malicious custom buildpack an end user could read files on the host system that the BOSH-created vcap user has permissions to read and then package them into their app droplet. Published at: March 19, 2018 at 03:29PM View on website March 19, 2018 at 04:31PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2014-3626 The Grails Resource Plugin often has to exchange URIs for resources with other internal components. Those other components will decode any URI passed to them. To protect against directory traversal the Grails Resource Plugin did the following: normalized the URI, checked the normalized URI did not step outside the appropriate root directory (e.g. the web application root), decoded the URI and checked that this did not introduce additional /../ (and similar) sequences. A bug was introduced where the Grails Resource Plugin before 1.2.13 returned the decoded version of the URI rather than the normalized version of the URI after the directory traversal check. This exposed a double decoding vulnerability. To address this issue, the Grails Resource Plugin now repeatedly decodes the URI up to three times or until decoding no longer changes the URI. If the decode limit of 3 is exceeded the URI is rejected. A side-effect of this is that the Grails Resource Plugin is unable t o serve a resource that includes a '%' character in the full path to the resource. Not all environments are vulnerable because of the differences in URL resolving in different servlet containers. Applications deployed to Tomcat 8 and Jetty 9 were found not not be vulnerable, however applications deployed to JBoss EAP 6.3 / JBoss AS 7.4 and JBoss AS 7.1 were found to be vulnerable (other JBoss versions weren't tested). In certain cases JBoss returns JBoss specific vfs protocol urls from URL resolution methods (ClassLoader.getResources). The JBoss vfs URL protocol supports resolving any file on the filesystem. This made the directory traversal possible. There may be other containers, in addition to JBoss, on which this vulnerability is exposed. Published at: March 19, 2018 at 03:29PM View on website March 19, 2018 at 04:31PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2014-5450 Zarafa Collaboration Platform 4.1 uses world-readable permissions for /etc/zarafa/license, which allows local users to obtain sensitive information by reading license files. Published at: March 19, 2018 at 11:29PM View on website March 20, 2018 at 12:22AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2014-5443 Seafile Server before 3.1.2 and Server Professional Edition before 3.1.0 allow local users to gain privileges via vectors related to ccnet handling user accounts. Published at: March 19, 2018 at 11:29PM View on website March 20, 2018 at 12:22AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2014-4024 SSL virtual servers in F5 BIG-IP systems 10.x before 10.2.4 HF9, 11.x before 11.2.1 HF12, 11.3.0 before HF10, 11.4.0 before HF8, 11.4.1 before HF5, 11.5.0 before HF5, and 11.5.1 before HF5, when used with third-party Secure Sockets Layer (SSL) accelerator cards, might allow remote attackers to have unspecified impact via a timing side-channel attack. Published at: March 19, 2018 at 11:29PM View on website March 20, 2018 at 12:22AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2014-2885 Multiple integer overflows in TrueCrypt 7.1a allow local users to (1) obtain sensitive information via vectors involving a crafted item->OriginalLength value in the MainThreadProc function in EncryptedIoQueue.c or (2) cause a denial of service (memory consumption) via vectors involving large StartingOffset and Length values in the ProcessVolumeDeviceControlIrp function in Ntdriver.c. Published at: March 19, 2018 at 11:29PM View on website March 20, 2018 at 12:22AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2014-2884 The ProcessVolumeDeviceControlIrp function in Ntdriver.c in TrueCrypt 7.1a allows local users to bypass access restrictions and obtain sensitive information about arbitrary files via a (1) TC_IOCTL_OPEN_TEST or (2) TC_IOCTL_GET_SYSTEM_DRIVE_CONFIG IOCTL call. Published at: March 19, 2018 at 11:29PM View on website March 20, 2018 at 12:22AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2014-2675 Cross-site request forgery (CSRF) vulnerability in inc/AdminPage.php in the WP HTML Sitemap plugin 1.2 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete the sitemap via a request to the wp-html-sitemap page in wp-admin/options-general.php. Published at: March 19, 2018 at 11:29PM View on website March 20, 2018 at 12:22AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2014-2674 Directory traversal vulnerability in the Ajax Pagination (twitter Style) plugin 1.1 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the loop parameter in an ajax_navigation action to wp-admin/admin-ajax.php. Published at: March 19, 2018 at 11:29PM View on website March 20, 2018 at 12:22AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2014-2652 SQL injection vulnerability in OpenScape Deployment Service (DLS) before 6.x and 7.x before R1.11.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Published at: March 19, 2018 at 11:29PM View on website March 20, 2018 at 12:22AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2014-2550 Cross-site request forgery (CSRF) vulnerability in the Disable Comments plugin before 1.0.4 for WordPress allows remote attackers to hijack the authentication of administrators for requests that enable comments via a request to the disable_comments_settings page to wp-admin/options-general.php. Published at: March 19, 2018 at 11:29PM View on website March 20, 2018 at 12:22AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2014-2297 Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin 4.29.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) n parameter to ls/htmlchat.php or (2) bgcolor parameter to ls/index.php. NOTE: vector 1 may overlap CVE-2014-1906.4. Published at: March 19, 2018 at 11:29PM View on website March 20, 2018 at 12:22AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2014-2274 Cross-site request forgery (CSRF) vulnerability in the Subscribe To Comments Reloaded plugin before 140219 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via a request to the subscribe-to-comments-reloaded/options/index.php page to wp-admin/admin.php. Published at: March 19, 2018 at 11:29PM View on website March 20, 2018 at 12:22AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2011-3178 In the web ui of the openbuildservice before 2.3.0 a code injection of the project rebuildtimes statistics could be used by authorized attackers to execute shellcode. Published at: March 20, 2018 at 08:29PM View on website March 20, 2018 at 10:16PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2014-2032 Deadwood before 2.3.09, 3.x before 3.2.05, and as used in MaraDNS before 1.4.14 and 2.x before 2.0.09, allow remote attackers to cause a denial of service (out-of-bounds read and crash) by leveraging permission to perform recursive queries against Deadwood, related to missing input validation. Published at: March 20, 2018 at 11:29PM View on website March 21, 2018 at 12:18AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2014-2031 Deadwood before 2.3.09, 3.x before 3.2.05, and as used in MaraDNS before 1.4.14 and 2.x before 2.0.09, allow remote attackers to cause a denial of service (out-of-bounds read and crash) by leveraging permission to perform recursive queries against Deadwood, related to a logic error. Published at: March 20, 2018 at 11:29PM View on website March 21, 2018 at 12:18AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2014-1665 Cross-site scripting (XSS) vulnerability in ownCloud before 6.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the filename of an uploaded file. Published at: March 20, 2018 at 11:29PM View on website March 21, 2018 at 12:18AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2014-1457 Open Web Analytics (OWA) before 1.5.6 improperly generates random nonce values, which makes it easier for remote attackers to bypass a CSRF protection mechanism by leveraging knowledge of an OWA user name. Published at: March 20, 2018 at 11:29PM View on website March 21, 2018 at 12:18AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2014-1215 Multiple buffer overflows in Core FTP Server before 1.2 build 508 allow local users to gain privileges via vectors related to reading data from config.dat and Windows Registry. Published at: March 20, 2018 at 11:29PM View on website March 21, 2018 at 12:18AM via National Vulnerability Database