PYSEC-2011-5

The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers to trigger unauthenticated forged requests via vectors involving a DNS CNAME record and a web page...

CVE-2011-4138

The verifyexists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 originally tests a URL's validity through a HEAD request, but then uses a GET request for the new target URL in the case of a redirect, which might allow remote attackers to trigger arbitra...

CVE-2011-4139

Django before 1.2.7 and 1.3.x before 1.3.1 uses a request's HTTP Host header to construct a full URL in certain circumstances, which allows remote attackers to conduct cache poisoning attacks via a crafted request...

Django开发框架多个安全漏洞

Bugtraq ID: 49573 Django是一款开放源代码的Web应用框架，由Python写成。 Django存在多个安全漏洞，允许攻击者获得敏感信息，操作数据，进行缓存毒药攻击或进行拒绝服务攻击。 1当使用缓存后端时django.contrib.sessions中处理会话存在错误，可被利用操作会话信息。要成功个利用漏洞需要已知会话KEY和应用程序允许攻击者使用合法会话KEY储存字典类对象到缓冲中。 2Django模型系统包括一个字段类型-- URLField...

openSUSE Security Update : libwebkit (openSUSE-SU-2011:0482-1)

This version upgrade of webkit to 1.2.7 fixes the following bugs : - CVE-2010-2441: CVSS v2 Base Score: 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N: Permissions, Privileges, and Access Control CWE-264 - CVE-2010-2901: CVSS v2 Base Score: 3.7 AV:L/AC:H/Au:N/C:P/I:P/A:P: Buffer Errors CWE-119 - CVE-2010-4042:...

Mahara Cross Site Scripting and Cross Site Request Forgery Vulnerabilities

This host is running Mahara and is prone to cross site scripting and cross site request forgery vulnerabilities. OpenVAS Vulnerability Test $Id: secpodmaharaxssncsrfvuln.nasl 7029 2017-08-31 11:51:40Z teissa $ Mahara Cross Site Scripting and Cross Site Request Forgery Vulnerabilities Authors:...

CVE-2010-3695

Cross-site scripting XSS vulnerability in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allows remote attackers to inject arbitrary web script or HTML via the fmid parameter in a fetchmailprefssave action, related to the Fetchmail configuration...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Mahara 1.2.x before 1.2.7 and 1.3.x before 1.3.4 allows remote attackers to hijack the authentication of arbitrary users for requests that delete blogs...

Fedora 13 : webkitgtk-1.2.7-1.fc13 (2011-1224)

Fixes the following CVEs: CVE-2010-4492 CVE-2010-4493 CVE-2011-0482 CVE-2010-4199 CVE-2010-4578 CVE-2010-4040 CVE-2011-0778 CVE-2010-2901 CVE-2010-4042 - Fixes a regression caused by earlier fix for CVE-2010-1791. This caused webkitgtk to crash on certain sites with JavaScript. Note that Tenable...

Wireshark DOCSIS Dissector Denial of Service Vulnerability (Windows)

This host is installed with Wireshark and is prone to denial of service vulnerability. OpenVAS Vulnerability Test $Id: gbwiresharkdocsisdosvulnwin.nasl 6519 2017-07-04 14:08:14Z cfischer $ Wireshark DOCSIS Dissector Denial of Service Vulnerability Windows Authors: Sooraj KS Copyright: Copyright c...

Wireshark DOCSIS Dissector Denial of Service Vulnerability - Windows

Wireshark is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wireshark:wireshark"...

Wireshark DOCSIS Dissector Denial of Service Vulnerability

No description provided by source. A vulnerability has been reported in Wireshark, which can be exploited by malicious people to cause a DoS Denial of Service. The vulnerability is caused due to an error within the DOCSIS Data Over Cable Service Interface Specifications dissector and can be...

Outreach Project Tool 'CRM_path' Parameter Remote File Inclusion Vulnerability

The host is running Outreach Project ToolOPT and is prone to Remote File Inclusion vulnerability. OpenVAS Vulnerability Test $Id: gboutreachprojecttoolrfivuln.nasl 4869 2016-12-29 11:01:45Z teissa $ Outreach Project Tool 'CRMpath' Parameter Remote File Inclusion Vulnerability Authors: Antu Sanadi...

NullLogic Groupware Multiple Vulnerabilities

The host is installed with NullLogic Groupware and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: gbnulllogicgroupwaremultvulnwin.nasl 7573 2017-10-26 09:18:50Z cfischer $ NullLogic Groupware Multiple Vulnerabilities Authors: Nikita MR Copyright: Copyright c 2009 Greenbone...

CVE-2009-2354

The CVE-2009-2354 entry concerns NullLogic Groupware 1.2.7 with an SQL injection in the auth_checkpass function of the login page, allowing remote attackers to execute arbitrary SQL via the username parameter. OpenVAS entries confirm multiple vulnerabilities affecting NullLogic Groupware

cpcommerce-bypass.txt

Author: girex Homepage: girex.altervista.org CMS: cpCommerce 1.2.6 Site: http://cpcommerce.cpradio.org/ Bug: URL Rewrite - Input variables overwrite PoC: Auth bypass - Shell upload Note: Works regardless php.ini settings Vendor informed: 23/11/08 cpCommerce 1.2.7 released: 30/11/08 Public advisor...

Debian Security Advisory DSA 1656-1 (cupsys)

The remote host is missing an update to cupsys announced via advisory DSA 1656-1. OpenVAS Vulnerability Test $Id: deb16561.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1656-1 cupsys Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

CVE-2008-2178

Technical details for CVE-2008-2178 are not publicly available in the provided documents; monitor for updates.

lifetype-xss.txt

---------------------------------------------------------------- Script : Lifetype 1.2.7 Type : XSS Vulnerabilities ---------------------------------------------------------------- Discovered by : Dr.Crash Or Khashayar Fereidani Our Team : IRCRASH...

Lifetype 1.2.7 XSS Vulnerability

---------------------------------------------------------------- Script : Lifetype 1.2.7 Type : XSS Vulnerabilities ---------------------------------------------------------------- Discovered by : Dr.Crash Or Khashayar Fereidani Our Team : IRCRASH...