CVE-2011-2919

Cross-site scripting XSS vulnerability in Spacewalk 1.6, as used in Red Hat Network RHN Satellite, allows remote attackers to inject arbitrary web script or HTML via the QueryString to the SystemGroupList.do page...

CVE-2011-1594 Spacewalk: spacewalk: open redirect vulnerability enables phishing attacks via url parameter

A flaw was found in Spacewalk, as used in Red Hat Network Satellite. This open redirect vulnerability allows remote attackers to redirect users to arbitrary web sites by manipulating a URL in the urlbounce parameter. This can enable attackers to conduct phishing attacks, potentially leading to...

CVE-2011-3344 Spacewalk: spacewalk: cross-site scripting via uri in lookup login/password form

A flaw was found in Spacewalk. A remote attacker can exploit a cross-site scripting XSS vulnerability in the Lookup Login/Password form by injecting arbitrary web script or HTML via the URI. This can lead to information disclosure or unauthorized actions within the user's browser session...

CVE-2011-3344

CVE-2011-3344 is a cross-site scripting (XSS) flaw in the Spacewalk/RHN Satellite web interface, exposed via the Lookup Login/Password form in Spacewalk 1.6. The root cause is a reflected XSS vulnerability in the URI handling of the RHN Satellite web UI, allowing remote attackers to inject arbitr...

CVE-2011-2920 Spacewalk: spacewalk: cross-site scripting vulnerability allows arbitrary web script execution.

A flaw was found in Spacewalk and Red Hat Network Satellite. This cross-site scripting XSS vulnerability allows a remote attacker to inject arbitrary web script or HTML into web pages through various input fields, such as the "Filter by Synopsis" field. This could lead to the execution of malicio...

CVE-2011-2920

CVE-2011-2920 corresponds to multiple XSS flaws in Spacewalk 1.6 used by Red Hat Network Satellite. The Spacewalk web interface has vulnerabilities that allow remote attackers to inject arbitrary script/HTML, notably via the Filter by Synopsis field. Public references from SUSE and Red Hat descri...

CVE-2011-1594

CVE-2011-1594 is an Open Redirect in Spacewalk 1.6 used by Red Hat Network Satellite. The flaw allows remote attackers to redirect users to arbitrary sites via the url_bounce parameter, enabling phishing-like redirects. Multiple references (RHSA-2011:1299, SUSE CVE page) indicate an open‑redirect...

PT-2014-2144 · Red Hat · Spacewalk

Name of the Vulnerable Software and Affected Versions: Spacewalk version 1.6 Description: A cross-site scripting XSS issue exists in the Lookup Login/Password form, allowing remote attackers to inject arbitrary web script or HTML via the URI. This could potentially lead to unauthorized access or...

PT-2014-2131 · Red Hat · Spacewalk

Name of the Vulnerable Software and Affected Versions: Spacewalk version 1.6 Description: The issue allows remote attackers to inject arbitrary web script or HTML via the "Filter by Synopsis" field and other unspecified filter forms, potentially leading to cross-site scripting XSS attacks...

CVE-2013-4331

Light Display Manager aka LightDM 1.4.x before 1.4.3, 1.6.x before 1.6.2, and 1.7.x before 1.7.14 uses 0664 permissions for the temporary .Xauthority file, which allows local users to obtain sensitive information by reading the file...

Oracle JRE/JDK: Multiple vulnerabilities

Background The Oracle Java Development Kit JDK formerly known as Sun JDK and the Oracle Java Runtime Environment JRE formerly known as Sun JRE provide the Oracle Java platform formerly known as Sun Java Platform. Description Multiple vulnerabilities have been reported in the Oracle Java...

Fedora 19 : qt-4.8.5-15.fc19 (2013-22932)

Qt Project Security Advisory: XML Entity Expansion Denial of Service CVE-2013-4549 See also http://lists.qt-project.org/pipermail/announce/2013-December/000036.ht ml In addition, this update : - adds support for the aarch64 architecture, - fixes QTBUG-35459, a too low character limit for XML...

Fedora 20 : qt-4.8.5-15.fc20 (2013-22860)

Qt Project Security Advisory: XML Entity Expansion Denial of Service CVE-2013-4549 See also http://lists.qt-project.org/pipermail/announce/2013-December/000036.ht ml In addition, this update : - adds support for the aarch64 architecture, - fixes QTBUG-35459, a too low character limit for XML...

CUPS 1.6.x >= 1.6.4 / 1.7.x < 1.7.1 lppasswd Information Disclosure

According to its banner, the version of CUPS installed on the remote host is 1.6.x greater or equal to 1.6.4 or 1.7.x earlier than 1.7.1. It is, therefore, potentially affected by an information disclosure vulnerability related to the 'lppasswd' binary, setuid settings, and the use of...

FlashCanvas 1.5 proxy.php XSS Vulnerability

Advisory Information Title: FlashCanvas proxy.php XSS Vulnerability Date published: 11 December 2013 Reference: CVE-2013-6880 Advisory Summary Script does not adequately verify the Referer header before requesting via curl the remote URL specified in the ‘url’ GET parameter and rendering it. Vend...

Solaris 10 (sparc) : 143733-01 (deprecated)

CDE 1.6: ToolTalk RPC patch. Date this patch was last updated by Sun : Jul/06/10 This plugin has been deprecated and either replaced with individual 143733 patch-revision plugins, or deemed non-security related. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. @DEPRECATED@ Disabled on...

SuSE 11.2 Security Update : OpenJDK 1.6 (SAT Patch Number 8598)

OpenJDK 1.6 was updated to the new Icedtea release 1.12.7, which includes many fixes for bugs and security issues : - S8006900, CVE-2013-3829: Add new date/time capability - S8008589: Better MBean permission validation - S8011071, CVE-2013-5780: Better crypto provider handling - S8011081,...

DEBIAN-CVE-2013-4249

Cross-site scripting XSS vulnerability in the AdminURLFieldWidget widget in contrib/admin/widgets.py in Django 1.5.x before 1.5.2 and 1.6.x before 1.6 beta 2 allows remote attackers to inject arbitrary web script or HTML via a URLField...

Cross site scripting

Cross-site scripting XSS vulnerability in the AdminURLFieldWidget widget in contrib/admin/widgets.py in Django 1.5.x before 1.5.2 and 1.6.x before 1.6 beta 2 allows remote attackers to inject arbitrary web script or HTML via a URLField...

PYSEC-2013-21

The issafeurl function in utils/http.py in Django 1.4.x before 1.4.6, 1.5.x before 1.5.2, and 1.6 before beta 2 treats a URL's scheme as safe even if it is not HTTP or HTTPS, which might introduce cross-site scripting XSS or other vulnerabilities into Django applications that use this function, a...