[CVE-2014-1607.] Cross Site Scripting(XSS) in Drupal Event calendar module

Advisory ID: hag2014101 Product: EventCalendar Vendor: Drupal Vulnerable Versions: Drupal 7.14 and probably newer version Tested Version: Drupal 7.14 Advisory Publication: January 23, 2014 Vendor Notification: November 20, 2013 Public Disclosure: January 23, 2014 Vulnerability Type: Cross-Site...

Mediatrix 4402 digital gateway web interface contains a cross-site scripting (XSS) vulnerability

Overview Mediatrix's web management interface for the 4402 digital gateway device with firmware version Dgw 1.1.13.186, and possibly earlier versions, contains a cross-site scripting XSS vulnerability. CWE-79 Description CWE-79: Improper Neutralization of Input During Web Page Generation...

Drupal 7.14 EventCalendar Cross Site Scripting

Advisory ID: hag2014101 Product: EventCalendar Vendor: Drupal Vulnerable Versions: Drupal 7.14 and probably newer version Tested Version: Drupal 7.14 Advisory Publication: January 23, 2014 Vendor Notification: November 20, 2013 Public Disclosure: January 23, 2014 Vulnerability Type: Cross-Site...

Stem Innovation IZON Hardcoded Password Vulnerability

Stem Innovation's IZON IP camera has hard-coded passwords that can be leveraged via both telnetd and httpd. Stem Innovation ‘IZON’ Hard-coded Credentials CVE-2013-6236 Mark Stanislav - email protected I. DESCRIPTION --------------------------------------- Stem Innovation's IP camera called ‘IZON’...

[CVE-2014-1238] Cross Site Scripting(XSS) in q-pulse application

Cross-Site Scripting XSS in Q-Pulse application Advisory ID: hag201475 Product: q-pulse risk management software Vendor: q-pulse Vulnerable Versions: 0.6 and probably prior Tested Version: 0.6 Advisory Publication: Januray 14, 2013 Vendor Notification: July 31, 2013 Public Disclosure: December 31...

Q-Pulse 0.6 Cross Site Scripting

Cross-Site Scripting XSS in Q-Pulse application Advisory ID: hag201475 Product: q-pulse risk management software Vendor: q-pulse Vulnerable Versions: 0.6 and probably prior Tested Version: 0.6 Advisory Publication: Januray 14, 2013 Vendor Notification: July 31, 2013 Public Disclosure: December 31...

IBM WebSphere Application Server 8.5 < Fix Pack 8.5.5.1 Multiple Vulnerabilities

IBM WebSphere Application Server 8.5 before Fix Pack 8.5.5.1 appears to be running on the remote host and is, therefore, potentially affected by the following vulnerabilities : - A flaw exists related to Apache Ant and file compression that could lead to denial of service conditions. CVE-2012-209...

Cross site scripting

Cross-site scripting XSS vulnerability in workingSet.jsp in IBM Eclipse Help System IEHS, as used in the installable InfoCenter component in IBM FileNet Content Manager 4.5.1, 5.0.0, 5.1.0, and 5.2.0, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-5449

CVE-2013-5449 is an XSS vulnerability in the IBM Eclipse Help System (IEHS) used by IBM FileNet Content Manager InfoCenter. The issue affects IEHS in the installable InfoCenter components of multiple IBM FileNet/Content Manager versions and is triggered via crafted URLs to execute script in a use...

CVE-2013-5449

Cross-site scripting XSS vulnerability in workingSet.jsp in IBM Eclipse Help System IEHS, as used in the installable InfoCenter component in IBM FileNet Content Manager 4.5.1, 5.0.0, 5.1.0, and 5.2.0, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-5449: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in workingSet.jsp in IBM Eclipse Help System IEHS, as used in the installable InfoCenter component in IBM FileNet Content Manager 4.5.1, 5.0.0, 5.1.0, and 5.2.0, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

New Banking malware 'i2Ninja' being sold via underground Russian Cybercrime Market

Researchers at Trusteer spotted a new banking malware program on the underground Russian cybercrime market, that communicates with attackers over the I2P anonymity network is for sale on underground Russian cybercrime forums. Dubbed 'i2Ninja', malware has most of the features found in other...

[iptables-bash_completion] Programmable completion code (bash) for ip[6]tables

This is the programmable completion specification compspec for the iptables program netfilter.org. Features Interactive completion for ip6tables. This completion specification follows the logic of iptables and will only show commands and options, when they are available for the current context...

PT-2013-3869

Name of the Vulnerable Software and Affected Versions WebCollab versions 3.30 and earlier Description The issue allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks. This is achieved via the item parameter in the help/help language.php file...

CVE-2013-2652: Improper Neutralization of Input During Web Page Generation

CRLF injection vulnerability in help/helplanguage.php in WebCollab 3.30 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the item parameter...

Stem Innovation - 'IZON' Hard-Coded Credentials

Stem Innovation ‘IZON’ Hard-coded Credentials CVE-2013-6236 Mark Stanislav - [email protected] I. DESCRIPTION --------------------------------------- Stem Innovation's IP camera called ‘IZON’ utilizes numerous hard-coded credentials within its Linux distribution and also the hidden web...

Kayako Script Config Download Vulnerability

Kayako Script version 4.57.1.3626 Configuration Can be Downloaded Exploit Title: Remote File Upload Kayako Script Google Dork: Powered by Kayako Fusion Help Desk Software Date: 08.10.2013 Exploit Author: Mauritania Attacker & Virusa Worm Vendor Homepage: http://www.kayako.com/ Software Link:...

Design/Logic Flaw

Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript strings, as demonstrated by use of an ms-help: URL that triggers loading of hxds.dll...

CVE-2013-3893

Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript strings, as demonstrated by use of an ms-help: URL that triggers loading of hxds.dll...

CVE-2013-3893

CVE-2013-3893 is a use-after-free in mshtml.dll (Internet Explorer) specifically in SetMouseCapture, exploited via crafted JavaScript (notably through ms-help URLs) to achieve remote code execution across IE 6–11. Connected KEV/CISA entries confirm active exploitation in the wild and classify it ...