CVE-2013-3281

The CVE-2013-3281 entry describes a cross-site scripting (XSS) vulnerability in EMC Documentum products (Webtop, WDK, Taskspace, Records Manager, Web Publisher, Digital Asset Manager, Administrator, Capital Projects) prior to the stated SP versions. The flaw allows remote attackers to inject arbi...

CVE-2013-3281: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in EMC Documentum Webtop before 6.7 SP2 P07, Documentum WDK before 6.7 SP2 P07, Documentum Taskspace before 6.7 SP2 P07, Documentum Records Manager before 6.7 SP2 P07, Documentum Web Publisher before 6.5 SP7, Documentum Digital Asset Manager before 6.5 SP6,...

Practico 13.9 - Multiple Vulnerabilities

Practico 13.9 Multiple Vulnerabilities Vendor: Practico Product web page: http://www.codigoabierto.org Affected version: 13.9 Summary: Practico is a free CMS software project released under license GNU GPL v2.0 for creating web applications in a completely visual and fast fashion. Without...

Google to Pay Rewards For Patches to Open Source Projects

Google, one of the first companies to offer a significant bug bounty program, is extending its rewards to researchers and developers who contribute patches to a variety of open source projects and have an effect on the security of the project. The new rewards will range from $500 to $3,133.70, an...

CM3 AcoraCMS XSS / CSRF / Redirection / Disclosure

=============================== - Advisory - =============================== Tittle: CM3 AcoraCMS - Several Vulnerabilities Risk: Medium Date: 12.Sept.2012 Author: Pedro Andujar Twitter: @pandujar .: INTRO :. Acora CMS is a sleek and powerful off-the-shelf content management application coupled...

[The Burp SessionAuth] Extension for Detection of Possible Privilege escalation vulnerabilities

Normally a web application should identify a logged in user by data which is stored on the server side in some kind of session storage. However, in web application audits someone can often observe that internal user identifiers are transmitted in HTTP requests as parameters or cookies. Applicatio...

BOINC Manager 7.0.64 Buffer Overflow

Exploit Title: BOINC Manager 7.0.64 Field stack based buffer overflow Date: 26.05.2013 Exploit Author: xisone@STM Solutions Vendor Homepage: http://boinc.berkeley.edu/ Software Link: http://boinc.berkeley.edu/dl/boinc7.0.64windowsintelx86.exe Version: 7.0.64 for Windows Tested on: Windows XP SP3...

BOINC Manager (Seti@home) 7.0.64 - Field Buffer Overflow (SEH)

Exploit Title: BOINC Manager 7.0.64 Field stack based buffer overflow Date: 26.05.2013 Exploit Author: xisone@STM Solutions Vendor Homepage: http://boinc.berkeley.edu/ Software Link: http://boinc.berkeley.edu/dl/boinc7.0.64windowsintelx86.exe Version: 7.0.64 for Windows Tested on: Windows XP SP3...

[SECURITY] Fedora 18 Update: rubygem-rdoc-3.12-6.fc18

RDoc produces HTML and command-line documentation for Ruby projects. RDoc includes the +rdoc+ and +ri+ tools for generating and displaying online documentation. See RDoc for a description of RDoc's markup and basic use...

[SECURITY] Fedora 17 Update: rubygem-rdoc-3.12-5.fc17

RDoc produces HTML and command-line documentation for Ruby projects. RDoc includes the +rdoc+ and +ri+ tools for generating and displaying online documentation. See RDoc for a description of RDoc's markup and basic use...

[SECURITY] Fedora 17 Update: xulrunner-19.0.2-1.fc17

XULRunner is a Mozilla runtime package that can be used to bootstrap XUL+XP COM applications that are as rich as Firefox and Thunderbird. It provides mecha nisms for installing, upgrading, and uninstalling these applications. XULRunner a lso provides libxul, a solution which allows the embedding ...

Mudge on the CFT

Peiter Zatko, also known as Mudge, has run the DARPA Cyber Fast Track program for the last three years, but he said that the researcher program is ending on April 1. The CFT program funded a wide range of security research projects in its time, including Charlie Miller’s NFC work and Moxie...

[SECURITY] Fedora 17 Update: xulrunner-19.0-1.fc17

XULRunner is a Mozilla runtime package that can be used to bootstrap XUL+XP COM applications that are as rich as Firefox and Thunderbird. It provides mecha nisms for installing, upgrading, and uninstalling these applications. XULRunner a lso provides libxul, a solution which allows the embedding ...

DARPA Seeks Revolution, Not Evolution, in Cyberspace Capabilities

Defense Advanced Research Projects Agency DARPA, the avant-garde research and development arm of the Department of Defense – perhaps best known for its central role in the development of the Internet – is soliciting research proposals that would help the military improve its cyber battlespace...

'The Hacker News' Celebrating 2nd Birthday

One of the most awaited occasions in a year is your birthday, same way we are today celebrating 'The Hacker News' 2nd Birthday week from on 28th October-3rd November 2012. Originally founded on 1st November 2010 by Mohit Kumar, 'The Hacker News' was the very First dedicated Hacking and Security...

CVE-2011-5187

Cross-site scripting XSS vulnerability in the Support Ticketing System module 6.x-1.x before 6.x-1.7 for Drupal allows remote authenticated users with the "administer support projects" permission to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-5187: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Support Ticketing System module 6.x-1.x before 6.x-1.7 for Drupal allows remote authenticated users with the "administer support projects" permission to inject arbitrary web script or HTML via unspecified vectors...

PT-2012-2164

Name of the Vulnerable Software and Affected Versions Drupal Support Ticketing System module versions 6.x-1.x before 6.x-1.7 Description A cross-site scripting XSS issue exists in the Support Ticketing System module for Drupal, allowing remote authenticated users with the "administer support...

WaveMaker Studio Requires No Authentication

The version of WaveMaker Studio detected on the remote host does not require authentication. A remote, unauthenticated attacker could exploit this to create, modify, and deploy projects. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

Debian DSA-2500-1 : mantis - several vulnerabilities

Several vulnerabilities were discovered in Mantis, an issue tracking system. - CVE-2012-1118 Mantis installation in which the privatebugviewthreshold configuration option has been set to an array value do not properly enforce bug viewing restrictions. - CVE-2012-1119 Copy/clone bug report actions...