2796 matches found
PunBB 1.3 'viewtopic.php' Cross-Site Scripting Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/37930/info PunBB is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an...
Google Hack Honeypot File Upload Manager 1.3 'delall' Unauthorized File Access Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/27877/info Google Hack Honeypot File Upload Manager is prone to an unauthorized file-access vulnerability. This issue occurs because the application fails to validate users before processing a certain HTTP request...
CuteNews 0.88/1.3 show_archives.php id Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/10620/info It is reported that CuteNews is affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input. The problems present...
flinx <= 1.3 (category.php id) Remote SQL Injection Vulnerability
No description provided by source. -------------------------------------------------------------- H-T Team HouSSaMix + ToXiC350 + RxH -------------------------------------------------------------- Author : Houssamix From H-T Team Script : flinx 1.3 & below Download :...
Ultimate Uploader 1.3 - Remote File Upload Vulnerability
No description provided by source. ========================================================================== Script Name : Ultimate Uploader 1.3 Language : php Vendor : http://www.element-it.com Author : Master Mind Home : www.shdowskill.com , www.vbspiders.com...
CVE-2013-6737
CVE-2013-6737 affects IBM System Storage Storwize V7000 Unified 1.3.x and 1.4.x prior to 1.4.3.0, where a rare hardware fault (1691) can cause fragments of customer data to be dumped into a file. An authorized user may copy this file and read the data fragments, potentially compromising confident...
WordPress Plugin Booking System (Booking Calendar) - booking_form_id SQL Injection
WordPress Plugin Booking System Booking Calendar - bookingformid SQL Injection source: https://www.securityfocus.com/bid/67535/info Search Everything plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting this issu...
Rack: Multiple vulnerabilities
Background Rack is a modular Ruby web server interface. Description Multiple vulnerabilities have been discovered in Rack. Please review the CVE identifiers referenced below for details. Impact A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a...
Threatpost News Wrap, May 9, 2014
Dennis Fisher and Mike Mimoso discuss the major news stories of the last couple of weeks, including the proposal in TLS 1.3 to drop RSA key transport, the Snapchat FTC settlement and the end of Windows XP support. And no Heartbleed talk! Download: digitalunderground153.mp3 Music by Chris Gonsalve...
TLS 1.3 Has Consensus to Deprectate RSA Key Transport
The IETF working group responsible for the TLS 1.3 standard is closing in on a decision to remove RSA key transport cipher suites from the protocol. Decades-old RSA-based handshakes don’t cut it anymore, according to experts, who are anxious to put a modern protocol in place, one that can fend of...
Drupal Webform Template模块安全绕过漏洞
Drupal是一套开放源码的内容管理平台。 该漏洞是由于当显示可能的节点来复制网页表单的配置文件时，应用程序没有正确验证权限, 攻击者可以利用漏洞泄漏其他受限制接点的某些信息。 0 Drupal Webform Template Module 7.x Drupal Webform Template Module 7.x-1.3版本以修复此漏洞，建议用户下载使用： https://drupal.org/node/2216607...
CVE-2014-2013
Stack-based buffer overflow in the xpsparsecolor function in xps/xps-common.c in MuPDF 1.3 and earlier allows remote attackers to execute arbitrary code via a large number of entries in the ContextColor value of the Fill attribute in a Path element...
Stack overflow
Stack-based buffer overflow in the xpsparsecolor function in xps/xps-common.c in MuPDF 1.3 and earlier allows remote attackers to execute arbitrary code via a large number of entries in the ContextColor value of the Fill attribute in a Path element...
[SECURITY] Fedora 19 Update: apache-commons-fileupload-1.3-5.fc19
The javax.servlet package lacks support for rfc 1867, html file upload. This package provides a simple to use api for working with such data. The scope of this package is to create a package of Java utility classes to read multipart/form-data within a javax.servlet.http.HttpServletRequest...
WordPress Custom Website Data插件跨站请求伪造漏洞
WordPress是一款内容管理系统。 由于程序允许用户通过味精验证的HTTP请求执行某些操作，攻击者可以利用漏洞在已登录的用户访问特制网页时删除任意记录。 0 WordPress Custom Website Data Plugin 1.x 厂商补丁： WordPress ----- WordPress Custom Website Data插件1.3版本以修复此漏洞，建议用户下载使用： http://wordpress.org/plugins/simple-custom-website-data/changelog...
CVE-2013-3709
WebYaST 1.3 uses weak permissions for config/initializers/secrettoken.rb, which allows local users to gain privileges by reading the Rails secret token from this file...
Design/Logic Flaw
WebYaST 1.3 uses weak permissions for config/initializers/secrettoken.rb, which allows local users to gain privileges by reading the Rails secret token from this file...
CVE-2013-3709
WebYaST 1.3 uses weak permissions for config/initializers/secrettoken.rb, which allows local users to gain privileges by reading the Rails secret token from this file...
