198 matches found
CVE-2009-0240
CVE-2009-0240 affects WebSVN 2.0 (and possibly 1.7 beta). listing.php can expose restricted project changelogs/diffs when using an SVN authz file, via a manipulated repname parameter. Root cause is improper access control in listing.php. Impact: remote authenticated users can read restricted cont...
FreeBSD Ports: zope
The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...
CVE-2008-0240
/idm/help/index.jsp in Sun Java System Identity Manager 6.0 SP1 through SP3, 7.0, and 7.1 allows remote attackers to inject frames from arbitrary web sites and conduct phishing attacks via the helpUrl parameter, aka "frame injection."...
CVE-2008-0240
Sun Java System Identity Manager (versions 6.0 SP1–SP3, 7.0, 7.1) is affected by a vulnerability in /idm/help/index.jsp where the helpUrl parameter can be abused to inject frames from arbitrary sites, enabling phishing-like framing attacks. This aligns with the public CVE-2008-0240 description of...
openSUSE 10 Security Update : zope (zope-3346)
This update fixes a cross site scripting bug XSS in zope CVE-2007-0240. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update zope-3346. The text description of this plugin is C SUSE LLC...
[SECURITY] [DSA 1275-1] New zope2.7 packages fix cross-site scripting flaw
------------------------------------------------------------------------ Debian Security Advisory DSA-1275-1 [email protected] http://www.debian.org/security/ Noah Meyerhans April 02, 2007 - ------------------------------------------------------------------------ Package : zope2.7 Vulnerability...
[SECURITY] [DSA 1275-1] New zope2.7 packages fix cross-site scripting flaw
------------------------------------------------------------------------ Debian Security Advisory DSA-1275-1 [email protected] http://www.debian.org/security/ Noah Meyerhans April 02, 2007 - ------------------------------------------------------------------------ Package : zope2.7 Vulnerability...
CVE-2007-0240
The CVE-2007-0240 entry describes a cross-site scripting (XSS) vulnerability in Zope 2.10.2 and earlier, exploitable via unspecified vectors in HTTP GET requests, allowing an attacker to inject arbitrary web script/HTML that runs in the victim’s browser. The OpenVAS/Debian/SUSE/Nessus advisories ...
CVE-2006-0240
Multiple SQL injection vulnerabilities in Simple Blog 2.1 allow remote attackers to execute arbitrary SQL commands via the month parameter in an archives view operation and possibly certain other parameters in unspecified scripts...
CVE-2006-0240
CVE-2006-0240 involves multiple SQL injection vulnerabilities in Simple Blog 2.1 . The flaws allow remote attackers to execute arbitrary SQL commands via the month parameter in an archives view operation and possibly other parameters in unspecified scripts. The primary sources consistently descri...
CVE-2005-0240
Format string vulnerability in chdev on IBM AIX 5.2 allows local users to execute arbitrary code via format string specifiers in a command line argument, which is not properly handled when printing an error message...
CVE-2003-0240
CVE-2003-0240 describes an Axis Network Camera vulnerability where authentication to the admin interface can be bypassed by requesting http://camera-ip//admin/admin.shtml (double slash). This allows remote attackers to bypass restrictions and modify configuration, potentially enabling root access...
CVE-2002-0240
CVE-2002-0240 affects PHP when deployed with Apache and configured to serve index.php by default. The vulnerability allows remote attackers to learn the server’s full pathname via the HTTP OPTIONS method, leaking a partial confidentiality breach (PARTIAL) without impact to integrity/availability,...
CVE-2002-0240
PHP, when installed with Apache and configured to search for index.php as a default web page, allows remote attackers to obtain the full pathname of the server via the HTTP OPTIONS method, which reveals the pathname in the resulting error message...
CVE-2001-0240
Microsoft Word before Word 2002 allows attackers to automatically execute macros without warning the user via a Rich Text Format RTF document that links to a template with the embedded macro...
CVE-2000-0240
vqSoft vqServer program allows remote attackers to read arbitrary files via a /........../ in the URL, a variation of a .. dot dot attack...
CVE-1999-0240
CVE-1999-0240 is described across connected sources as a policy-abiding issue where some filters or firewalls permit fragmented SYN packets with IP reserved bits, violating implemented policy. The documents do not provide specific affected products, vendors, components, versions, or a concrete fi...