CVE-2008-7299

IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.2 uses an incomplete SAML 1.x browser-artifact, which allows remote OpenID providers to spoof assertions via vectors related to the Issuer field...

CVE-2011-2222

Session fixation vulnerability in WebAdmin in the Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 allows remote attackers to hijack web sessions via unspecified vectors...

Null pointer dereference

The pngerr function in pngerror.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 makes a function call using a NULL pointer argument instead of an empty-string argument, which allows remote attackers to cause a denial of service application crash vi...

CVE-2011-1922

daemon/worker.c in Unbound 1.x before 1.4.10, when debugging functionality and the interface-automatic option are enabled, allows remote attackers to cause a denial of service assertion failure and daemon exit via a crafted DNS request that triggers improper error handling...

CVE-2011-1922

daemon/worker.c in Unbound 1.x before 1.4.10, when debugging functionality and the interface-automatic option are enabled, allows remote attackers to cause a denial of service assertion failure and daemon exit via a crafted DNS request that triggers improper error handling...

Z-blog 1.8 cmd.asp xss跨站漏洞

No description provided by source. !/usr/bin/env python coding: utf-8 from urlparse import urljoin from pocsuite.net import req from pocsuite.poc import POCBase, Output from pocsuite.utils import register class TestPOCPOCBase: vulID = '20520' ssvid version = '1.0' author = 'Disorder' vulDate = ''...

CVE-2011-1522

Multiple SQL injection vulnerabilities in the Doctrine\DBAL\Platforms\AbstractPlatform::modifyLimitQuery function in Doctrine 1.x before 1.2.4 and 2.x before 2.0.3 allow remote attackers to execute arbitrary SQL commands via the 1 limit or 2 offset field...

CVE-2011-1684

Heap-based buffer overflow in the MP4ReadBoxskcr function in libmp4.c in the MP4 demultiplexer in VideoLAN VLC media player 1.x before 1.1.9 allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a crafted MP4 file...

CVE-2011-1522

Multiple SQL injection vulnerabilities in the Doctrine\DBAL\Platforms\AbstractPlatform::modifyLimitQuery function in Doctrine 1.x before 1.2.4 and 2.x before 2.0.3 allow remote attackers to execute arbitrary SQL commands via the 1 limit or 2 offset field...

VLC Media Player USF and Text Subtitles Decoders BOF Vulnerabilities (Windows)

The host is installed with VLC Media Player and is prone to buffer overflow vulnerabilities. OpenVAS Vulnerability Test $Id: secpodvlcmediaplayerbofvulnfeb11win.nasl 8174 2017-12-19 12:23:25Z cfischer $ VLC Media Player USF and Text Subtitles Decoders BOF Vulnerabilities Windows Authors: Madhuri ...

VLC Media Player USF and Text Subtitles Decoders BOF Vulnerabilities (Linux)

The host is installed with VLC Media Player and is prone to buffer overflow vulnerabilities. OpenVAS Vulnerability Test $Id: secpodvlcmediaplayerbofvulnfeb11lin.nasl 7029 2017-08-31 11:51:40Z teissa $ VLC Media Player USF and Text Subtitles Decoders BOF Vulnerabilities Linux Authors: Madhuri D...

CuteSITE CMS 1.x - managemain.php?fld_path Cross-Site Scripting

CuteSITE CMS 1.x - managemain.php?fldpath Cross-Site Scripting source: https://www.securityfocus.com/bid/40612/info CuteSITE CMS is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting these...

CVE-2010-1633

RSA verification recovery in the EVPPKEYverifyrecover function in OpenSSL 1.x before 1.0.0a, as used by pkeyutl and possibly other applications, returns uninitialized memory upon failure, which might allow context-dependent attackers to bypass intended key requirements or obtain sensitive...

CVE-2010-1633

RSA verification recovery in the EVPPKEYverifyrecover function in OpenSSL 1.x before 1.0.0a, as used by pkeyutl and possibly other applications, returns uninitialized memory upon failure, which might allow context-dependent attackers to bypass intended key requirements or obtain sensitive...

Vulnerabilities in CaptchaSecurityImages

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Insufficient Anti-automation и Denial of Service уязвимостях в системе WeBAM. Уязвимости имеют место в скрипте капчи CaptchaSecurityImages.php, который используется в данной системе. Об уязвимостях в CaptchaSecurityImages я уже сообщал. Insufficie...

CVE-2009-4681

CVE-2009-4681 affects phpDirectorySource 1.x; the XSS flaw exists in search.php where a malicious value in the st parameter enables remote injection of arbitrary script/HTML. This CVE entry is supported by multiple references (e.g., exploits and advisories) and is listed in NVD. No explicit remed...

CVE-2009-4681

Cross-site scripting XSS vulnerability in search.php in phpDirectorySource 1.x allows remote attackers to inject arbitrary web script or HTML via the st parameter...

Debian DSA-1896-1 : opensaml, shibboleth-sp - several vulnerabilities

Several vulnerabilities have been discovered in the opensaml and shibboleth-sp packages, as used by Shibboleth 1.x : - Chris Ries discovered that decoding a crafted URL leads to a crash and potentially, arbitrary code execution. - Ian Young discovered that embedded NUL characters in certificate...

OCSinventory-ng 1.x SQL Injection / Cross Site Scripting

OCSinventory-ng Multiple remote vulnerabalities as ben descovered in OCS Inventory NG Management server, sql inyeccion and xss This vulneravility afect version 1.x Name OCS Inventory vendor http://www.ocsinventory-ng.org/ Download http://www.ocsinventory-ng.org/index.php?page=1-02-1 Category web...

Blog System 1.x SQL Injection

Script : Blog System Version : 1.x Link : http://netartmedia.net/blogsystem/ Author : BorN To K!LL - h4ck3r Dork : "powered by Blog System" Table : websiteadminadminusers Columns : id,username,password,type Exploit :...