CVE-2014-0114

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrar...

Code injection

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrar...

CVE-2014-0114

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrar...

CVE-2013-7064

Cross-site scripting XSS vulnerability in the EU Cookie Compliance module 7.x-1.x before 7.x-1.12 for Drupal allows remote authenticated administrators with the "Administer EU Cookie Compliance popup" permission to inject arbitrary web script or HTML via unspecified configuration values...

CVE-2013-7064

Cross-site scripting XSS vulnerability in the EU Cookie Compliance module 7.x-1.x before 7.x-1.12 for Drupal allows remote authenticated administrators with the "Administer EU Cookie Compliance popup" permission to inject arbitrary web script or HTML via unspecified configuration values...

CVE-2014-0922

IBM MessageSight 1.x before 1.1.0.0-IBM-IMA-IT01015 allows remote attackers to cause a denial of service resource consumption via WebSockets MQ Telemetry Transport MQTT data...

[IDSwakeup] Collection of Tools to test network intrusion detection systems

IDSwakeup is a collection of tools that allows to test network intrusion detection systems. The main goal of IDSwakeup is to generate false attack that mimic well known ones, in order to see if NIDS detects them and generates false positives. This release of IDSwakeup includes: IDSwakeup The main...

Oracle Outside In Microsoft Access 1.x Parser Buffer Overflow (CVE-2013-5791)

A stack buffer overflow vulnerability exists in Oracle Outside-In, a set of libraries used to decode many file formats. The vulnerability is due to an error while processing Microsoft Access 1.x database files .mdb. This vulnerability can be exploited by causing an application that uses the...

CVE-2013-4927

Integer signedness error in the gettypelength function in epan/dissectors/packet-btsdp.c in the Bluetooth SDP dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 allows remote attackers to cause a denial of service loop and CPU consumption via a crafted packet...

[SECURITY] Fedora 19 Update: bzr-2.5.1-11.fc19

Bazaar is a distributed revision control system that is powerful, friendly, and scalable. It is the successor of Baz-1.x which, in turn, was a user-friendly reimplementation of GNU Arch...

CVE-2013-0205

Cross-site request forgery CSRF vulnerability in the RESTful Web Services restws module 7.x-1.x before 7.x-1.2 and 7.x-2.x before 7.x-2.0-alpha4 for Drupal allows remote attackers to hijack the authentication of arbitrary users via unknown vectors...

BF and FPD vulnerabilities in MODx

Hello 3APA3A! I want to warn you about security vulnerabilities in MODx. This is the first part of the vulnerabilities in this CMS the first 19 vulnerabilities. These are Brute Force and Full path disclosure vulnerabilities in MODx. It's about 0.x and 1.x Evolution versions of MODx CMS. In 2.x...

CVE-2012-5539

The Organic Groups OG module 7.x-1.x before 7.x-1.5 for Drupal does not properly maintain pending group memberships, which allows remote authenticated users to post to arbitrary groups by modifying their own account while a pending membership is waiting to be approved...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Excluded Users module 6.x-1.x before 6.x-1.1 for Drupal allow remote attackers to inject arbitrary web script or HTML via a 1 user name or 2 email address...

CVE-2012-5326

Cross-site request forgery CSRF vulnerability in admin/function.php in IDevSpot iSupport 1.x allows remote attackers to hijack the authentication of administrators for requests that add administrator accounts via an administrators action...

CVE-2012-5326

CVE-2012-5326 affects IDevSpot iSupport 1.x. The vulnerability is a CSRF in admin/function.php that allows remote attackers to hijack administrator authentication to perform actions that add administrator accounts. The connected documents provide the same description and do not specify exploitati...

Drupal Password Policy模块跨站请求伪造和跨站脚本执行漏洞

BUGTRAQ ID: 51385 CVE ID: CVE-2012-1633 Drupal是一款开源CMS，可以作为各种网站的内容管理平台。 Drupal Password Policy模块6.x-1.x 存在跨站脚本漏洞。可允许远程攻击者劫持管理员用户接通用户请求的验证。 0 Drupal Password Policy 6.X-1.X 厂商补丁： Drupal ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://drupal.org/...

CVE-2011-5188

Cross-site scripting XSS vulnerability in the Support Timer module 6.x-1.x before 6.x-1.4 for Drupal allows remote authenticated users with the "track time spent" permission to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-5189

CVE-2011-5189 affects Drupal's Webform Validation module (versions 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.1). The vulnerability is a cross-site scripting (XSS) flaw that can be triggered by remote authenticated users who have permission to update Webform nodes, allowing them to inject ar...

CVE-2012-5007

The CVE-2012-5007 entry concerns the Drupal Fill PDF module (7.x-1.x before 7.x-1.2; also 6.x-1.x paths in related CVEs). Affected component/function: fillpdf_merge_pdf, with unspecified vectors and incorrect arguments that allow remote attackers to write to arbitrary PDF files. The root cause an...