Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in TWiki before 4.3.1 allows remote authenticated users to hijack the authentication of arbitrary users for requests that update pages, as demonstrated by a URL for a save script in the SRC attribute of an IMG element, a related issue to CVE-2009-1434...

CVE-2009-1434

Cross-site request forgery CSRF vulnerability in Foswiki before 1.0.5 allows remote attackers to hijack the authentication of arbitrary users for requests that modify pages, change permissions, or change group memberships, as demonstrated by a URL for a 1 save or 2 view script in the SRC attribut...

CVE-2009-1434

Foswiki CSRF (CVE-2009-1434): Affected: Foswiki 1.0.x prior to 1.0.5. Vulnerable vector involves CSRF via URLs in IMG SRC attributes that trigger save/view scripts, enabling an attacker to hijack user sessions to modify pages, change permissions, or alter group memberships. Root cause: insufficie...

CVE-2008-1434

CVE-2008-1434 describes a remote code execution vulnerability in Microsoft Word caused by a memory handling error when processing a Word file containing a malformed CSS value. The issue affects Word across multiple products/versions (Office 2000 SP3, Word 2000; Word XP SP3; Word 2003 SP2/SP3; Wor...

Debian: Security Advisory (DSA-1434-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-1434-1 : mydns - buffer overflow

It was discovered that in MyDNS, a domain name server with database backend, the daemon could be crashed through malicious remote update requests, which may lead to denial of service. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

CVE-2003-1434

The CVE concerns login_ldap 3.1 and 3.2, where remote attackers can initiate unauthenticated binds if (a) bind_anon_dn is on (bind with no password), (b) bind_anon_cred is on (bind with no DN), or (c) bind_anon is on (bind with no DN or password). Root cause is misconfiguration allowing unauthent...

CVE-2007-1434

Grayscale Blog 0.8.0 (and possibly earlier) is affected by an SQL injection vulnerability. The vulnerable components are the PHP scripts userdetail.php (parameter id ), jump.php (parameter url ), and detail.php (parameter id ). Root cause: unsafely constructed SQL queries via these inputs, enabli...

CVE-2006-1434

The CVE-2006-1434 issue affects Annuaire (Directory) 1.0, where the XSS vulnerability exists in inscription.php via the Comment Field (COMMENTAIRE parameter). The underlying flaw is a cross-site scripting vulnerability that could allow remote attackers to inject arbitrary web script or HTML. Mult...

CVE-2005-1434

OpenView Network Node Manager (OV NNM) versions 6.2, 6.4, 7.01, and 7.50 are associated with CVE-2005-1434. The available descriptions indicate multiple unknown vulnerabilities that can cause denial of service or allow arbitrary code execution. The connected documents do not provide concrete tech...

CVE-2001-1434

The vulnerability CVE-2001-1434 affects Cisco IOS 12.0(5)XU through 12.1(2). An SNMP command snmp-server host can cause creation of a readable SNMP community string, enabling remote attackers to read system administration and topology information. Exploitation is remote and depends on SNMP access...

CVE-2004-1434

CVE-2004-1434 affects Cisco ONS platforms: 15327, 15454, and 15454 SDH, across multiple software lines (4.1(0)–4.1(2), 4.5(x), 4.0(0)–4.0(2) and earlier). The issue allows remote attackers to cause a denial of service via malformed SNMP packets, triggering a control card reset. No exploitation de...

CVE-2004-1434

Multiple versions of Cisco ONS 15327, ONS 15454, and ONS 15454 SDH, including 4.10 to 4.12, 4.5x, 4.00 to 4.02, and earlier versions, allows remote attackers to cause a denial of service control card reset via malformed SNMP packets...

CVE-2004-1434

Multiple versions of Cisco ONS 15327, ONS 15454, and ONS 15454 SDH, including 4.10 to 4.12, 4.5x, 4.00 to 4.02, and earlier versions, allows remote attackers to cause a denial of service control card reset via malformed SNMP packets...

CVE-2003-1434

loginldap 3.1 and 3.2 allows remote attackers to initiate unauthenticated bind requests if 1 bindanondn is on, which allows a bind with no password provided, 2 bindanoncred is on, which allows a bind with no DN, or 3 bindanon is on, which allows a bind with no DN or password...

CVE-2003-0353

Buffer overflow in a component of SQL-DMO for Microsoft Data Access Components MDAC 2.5 through 2.7 allows remote attackers to execute arbitrary code via a long response to a broadcast request to UDP port 1434...

CVE-2003-0353

CVE-2003-0353 details a Unicode buffer overflow in the SQL-DMO component of Microsoft MDAC (versions 2.5–2.7) that can be exploited by a long UDP broadcast response on port 1434, enabling remote code execution. Affected packages include MDAC 2.5/2.6/2.7 with various SPs; fixes are described in MS...

VulnCheck KEV: CVE-2002-0649

Multiple buffer overflows in the Resolution Service for Microsoft SQL Server 2000 and Microsoft Desktop Engine 2000 MSDE allow remote attackers to cause a denial of service or execute arbitrary code via UDP packets to port 1434 in which 1 a 0x04 byte that causes the SQL Monitor thread to...

CVE-2002-1434

CVE-2002-1434 corresponds to multiple cross-site scripting (XSS) vulnerabilities in the Web Mail module of Kerio MailServer 5.0. The collected documents specify that remote attackers could cause HTML/script execution as other users by exploiting certain URLs in the WebMail interface. The OpenVAS/...

CVE-2002-0650

The keep-alive mechanism for Microsoft SQL Server 2000 allows remote attackers to cause a denial of service bandwidth consumption via a "ping" style packet to the Resolution Service UDP port 1434 with a spoofed IP address of another SQL Server system, which causes the two servers to exchange...