Prizm Content Connect default.aspx document Parameter Remote File Inclusion

The remote web server hosts Prizm Content Connect, a fully customizable document viewer. The 'default.aspx' script included with the install fails to sanitize user input to the 'document' parameter before reading a file. A remote attacker can leverage this issue to view arbitrary files or execute...

Cisco Unity Express Multiple XSS and CSRF Vulnerabilities

The host is installed with Cisco Unity Express and is prone to multiple cross-site scripting and request forgery vulnerabilities. OpenVAS Vulnerability Test $Id: gbciscounityexpressmultxssncsrfvuln.nasl 7585 2017-10-26 15:03:01Z cfischer $ Cisco Unity Express Multiple XSS and CSRF Vulnerabilities...

Incapsula Component for Joomla! 'token' Parameter Multiple XSS

The version of the Incapsula component for Joomla! running on the remote host is affected by multiple cross-site scripting XSS vulnerabilities in the Security.php and Performance.php scripts due to improper sanitization of user-supplied input to the 'token' parameter before using it to generate...

PHP-Fusion 'cat-id' XSS Vulnerability

PHP-Fusion is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

ViArt Shop sips_response.php DATA Parameter Request Parsing Remote Shell Command Execution

The version of the ViArt Shop installed on the remote host contains a flaw that could allow a remote attacker to execute arbitrary commands. Input passed to the 'DATA' parameter in 'sipsresponse.php' is not properly sanitized before being used to process payment data. An attacker could leverage...

Joomla! JEvents Component SQLi Vulnerability

Joomla! with JEvents component is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Joomla! Ignite Gallery Component SQLi Vulnerabilities

Joomla! with Ignite Gallery component is prone to multiple SQL injection SQLi vulnerabilities. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

GRAND Flash Album Gallery Plugin for WordPress 'f' Parameter Traversal Arbitrary Directory Enumeration

The Grand Flash Album Gallery Plugin for WordPress installed on the remote host is affected by a directory traversal vulnerability due to a failure to properly sanitize user-supplied input to the 'f' parameter of its 'facebook.php' script. This vulnerability allows an unauthenticated, remote...

Forums Plugin for WordPress 'url' Parameter Arbitrary File Disclosure

The Forums Plugin for WordPress installed on the remote host is affected by an information disclosure vulnerability due to a failure to properly sanitize user-supplied input to the 'url' parameter of the zingforumoutput function in the zingiri-forum/forum.php script. An unauthenticated, remote...

RHEL 4 / 5 : jbossweb (RHSA-2008:0877)

An updated jbossweb package that fixes various security issues is now available for JBoss Enterprise Application Platform JBoss EAP 4.2 and 4.3. This update has been rated as having important security impact by the Red Hat Security Response Team. JBoss Web Server jbossweb is an enterprise ready w...

RHEL 4 : JBoss EAP (RHSA-2008:0151)

Updated JBoss Enterprise Application Platform JBEAP packages that fix several security issues are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. JBoss Enterprise Application Platform JBEAP is a middleware platform for Java 2...

RHEL 6 : Ruby on Rails in Subscription Asset Manager (RHSA-2013:0154)

Updated rubygem-actionpack, rubygem-activesupport, and rubygem-activerecord packages that fix multiple security issues are now available for Red Hat Subscription Asset Manager. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scorin...

RHEL 6 : resource-agents (RHSA-2011:1580)

An updated resource-agents package that fixes one security issue, several bugs, and adds multiple enhancements is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System CVSS base...

RHEL 5 : JBoss EAP (RHSA-2008:0213)

New JBoss Enterprise Application Platform JBEAP packages, comprising the 4.2.0.CP02 release, are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. JBEAP is a middleware platform for Java 2 Platform,...

WordPress Shopping Cart Plugin Multiple Vulnerabilities

WordPress Shopping Cart Plugin is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Scientific Linux Security Update : net-snmp on SL5.x i386/x86_64 (20130108)

An out-of-bounds buffer read flaw was found in the net-snmp agent. A remote attacker with read privileges to a Management Information Base MIB subtree handled by the 'extend' directive in '/etc/snmp/snmpd.conf' could use this flaw to crash snmpd via a crafted SNMP GET request. CVE-2012-2141 Bug...

CentOS 5 : net-snmp (CESA-2013:0124)

Updated net-snmp packages that fix one security issue and multiple bugs are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

Hero Framework Cross-Site Scripting and Request Forgery Vulnerabilities

Hero Framework is prone to multiple cross site scripting and CSRF vulnerabilities. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Nagios Core history.cgi Multiple Parameter Buffer Overflow

The remote web server hosts a version of Nagios Core that is affected by a buffer overflow vulnerability. By sending a specially crafted request using the 'hostname' or 'svcdescription' parameter to 'history.cgi', a remote attacker may be able to execute arbitrary code or trigger a denial of...

ERP (Enterprise Resource Planning) System SQLi Vulnerability - Active Check

Enterprise Resource Planning is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...