[SECURITY] [DSA 3165-1] xdg-utils security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3165-1 [email protected] http://www.debian.org/security/ Michael Gilbert February 21, 2015 http://www.debian.org/security/faq -...

QNX--6.5.0-QCONN-1.4.207944

Title : QNX QCONN Remote Command Execution Vurnerability Version : QNX 6.5.0 QCONN 1.4.207944 Download: http://www.qnx.com/download/feature.html?programid=23665 QNX Neutrino 6.5.0 SP1 Vendor : http://www.qnx.com import telnetlib import sys if lensys.argv " print " + Ex QCONNRC.py 192.168.0.1 8000...

IPCop Firewall cgi-bin/iptablesgui.cgi Arbitrary Code Execution Vulnerability

IPCop Firewall is a firewall suite for the Linux environment , mainly for home and SOHO Small Office/Home Office users . An arbitrary code execution vulnerability exists in cgi-bin/iptablesgui.cgi in IPCop Firewall, which allows remote authenticated users to execute arbitrary code via the TABLE...

Cross site scripting

Cross-site scripting XSS vulnerability in cgi-bin/ipinfo.cgi in IPCop aka IPCop Firewall before 2.1.3 allows remote attackers to inject arbitrary web script or HTML via the QUERYSTRING. NOTE: this can be used to bypass the cross-site request forgery CSRF protection mechanism by setting the Refere...

CVE-2013-7417

Cross-site scripting XSS vulnerability in cgi-bin/ipinfo.cgi in IPCop aka IPCop Firewall before 2.1.3 allows remote attackers to inject arbitrary web script or HTML via the QUERYSTRING. NOTE: this can be used to bypass the cross-site request forgery CSRF protection mechanism by setting the Refere...

PT-2015-3578

Name of the Vulnerable Software and Affected Versions IPCop aka IPCop Firewall versions prior to 2.1.3 Description The issue allows remote attackers to inject arbitrary web script or HTML via the QUERY STRING in the cgi-bin/ipinfo.cgi endpoint. This can be used to bypass the cross-site request...

PT-2015-3579

Name of the Vulnerable Software and Affected Versions IPCop aka IPCop Firewall versions prior to 2.1.5 Description The issue allows remote authenticated users to execute arbitrary code via shell metacharacters in the TABLE parameter of the "cgi-bin/iptablesgui.cgi" endpoint. This can be exploited...

CVE-2013-7418: Improper Neutralization of Special Elements used in a Command

cgi-bin/iptablesgui.cgi in IPCop aka IPCop Firewall before 2.1.5 allows remote authenticated users to execute arbitrary code via shell metacharacters in the TABLE parameter. NOTE: this can be exploited remotely by leveraging a separate cross-site scripting XSS vulnerability...

CVE-2013-7417: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in cgi-bin/ipinfo.cgi in IPCop aka IPCop Firewall before 2.1.3 allows remote attackers to inject arbitrary web script or HTML via the QUERYSTRING. NOTE: this can be used to bypass the cross-site request forgery CSRF protection mechanism by setting the Refere...

PT-2015-3502

Name of the Vulnerable Software and Affected Versions CosmoShop ePRO version 10.05.00 Description A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators for requests that modify settings via a setup action. Recommendations For version 10.05.00, a...

PT-2015-3501

Name of the Vulnerable Software and Affected Versions CosmoShop ePRO version 10.05.00 Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting XSS attacks. This can be achieved via the rcopy parameter to...

CVE-2011-5306: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in cgi-bin/admin/setupedit.cgi in CosmoShop ePRO 10.05.00 allows remote attackers to hijack the authentication of administrators for requests that modify settings via a setup action...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Smoothwall Express 3.1 and 3.0 SP3 allow remote attackers to inject arbitrary web script or HTML via the 1 PROFILENAME parameter in a Save action to httpd/cgi-bin/pppsetup.cgi or 2 COMMENT parameter in an Add action to httpd/cgi-bin/ddns.cgi...

CVE-2011-5284

CVE-2011-5284 describes a Cross-site Request Forgery vulnerability in Smoothwall Express 3.1 and 3.0 SP3 and earlier, specifically in the web management interface’s httpd/cgi-bin/shutdown.cgi. The vulnerability allows an attacker to hijack an administrator’s authenticated session to perform reboo...

PT-2014-2198

Name of the Vulnerable Software and Affected Versions Smoothwall Express versions 3.0 SP3 and earlier, Smoothwall Express version 3.1 Description A cross-site request forgery CSRF issue exists in the web management interface, specifically in the httpd/cgi-bin/shutdown.cgi endpoint. This allows...

PT-2014-9007

Name of the Vulnerable Software and Affected Versions Smoothwall Express version 3.0 SP3 Description A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML via the COMMENT parameter in an Add action in the httpd/cgi-bin/vpn.cgi/vpnconfig.dat endpoint...

PT-2014-2197

Name of the Vulnerable Software and Affected Versions Smoothwall Express versions 3.0 SP3 and earlier, Smoothwall Express version 3.1 Description A cross-site scripting XSS issue exists in the web management interface, specifically in the httpd/cgi-bin/ipinfo.cgi file. This allows remote attacker...

CVE-2011-5283: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the web management interface in httpd/cgi-bin/ipinfo.cgi in Smoothwall Express 3.1 and 3.0 SP3 and earlier allows remote attackers to inject arbitrary web script or HTML via the IP parameter in a Run action...

CVE-2014-9431: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Smoothwall Express 3.1 and 3.0 SP3 allow remote attackers to hijack the authentication of administrators for requests that change the 1 admin or 2 dial password via a request to httpd/cgi-bin/changepw.cgi...

CVE-2014-9430: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in httpd/cgi-bin/vpn.cgi/vpnconfig.dat in Smoothwall Express 3.0 SP3 allows remote attackers to inject arbitrary web script or HTML via the COMMENT parameter in an Add action...