CVE-2013-1920

Xen 4.2.x, 4.1.x, and earlier, when the hypervisor is running "under memory pressure" and the Xen Security Module XSM is enabled, uses the wrong ordering of operations when extending the per-domain event channel tracking table, which causes a use-after-free and allows local guest kernels to injec...

CVE-2012-1920

The CVE-2012-1920 issue affects the @Mail WebMail Client in AtMail Open-Source 1.04 and earlier. A remote attacker can obtain configuration information by issuing a direct request to install/info.php, which calls phpinfo. This is an information-disclosure vulnerability in the WebMail component. T...

CVE-2011-1920

CVE-2011-1920 affects NetBSD make include files (bsd.lib.mk, bsd.prog.mk) as used by pmake 1.111 and related products; local users can overwrite arbitrary files via a symlink attack on a /tmp/_depend##### file. Affected: NetBSD make includes; pmake usage; vulnerability arises from insecure tempor...

CVE-2010-1920

OpenMairie openAnnuaire 2.00 is affected by a directory traversal vulnerability in scr/soustab.php when register_globals is enabled. The flaw allows remote attackers to include and execute arbitrary local files via traversal sequences in the dsn[phptype] parameter (a related issue to CVE-2007-206...

CVE-2010-1920

Directory traversal vulnerability in scr/soustab.php in OpenMairie openAnnuaire 2.00, when registerglobals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the dsnphptype parameter, a related issue to CVE-2007-2069...

Debian DSA-1920-1 : nginx - denial of service

A denial of service vulnerability has been found in nginx, a small and efficient web server. Jasson Bell discovered that a remote attacker could cause a denial of service segmentation fault by sending a crafted request. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

nginx ngx_http_process_request_headers()函数空指针引用拒绝服务漏洞

BUGTRAQ ID: 36839 CVECAN ID: CVE-2009-3896 nginx是多平台的HTTP服务器和邮件代理服务器。 nginx服务器的src/http/ngxhttpparse.c文件的ngxhttpprocessrequestheaders函数中存在空指针引用错误，远程攻击者可以通过超长的URI来触发这个漏洞，导致worker进程崩溃。 Igor Sysoev nginx 0.8.x Igor Sysoev nginx 0.7.x Igor Sysoev nginx 0.6.x Igor Sysoev nginx 0.5.x Igor Sysoev nginx...

Microsoft JScript脚本引擎Arguments关键字内存破坏漏洞（MS09-045）

BUGTRAQ ID: 36224 CVECAN ID: CVE-2009-1920 JScript是一种解释性的基于对象的脚本语言。 JScript脚本引擎（JScript.dll）处理网页中脚本的方式存在远程代码执行漏洞。在解析jscript arguments关键字时，由于arguments对象在某一时间之前不可用，调用该对象可能导致内存破坏。 如果用户打开了特制文件或访问了运行脚本的特制网站，这个漏洞可能允许远程执行指令。 Microsoft JScript 5.8 Microsoft JScript 5.7 Microsoft JScript 5.6 Microsoft...

ZDI-09-062: Microsoft Internet Explorer JScript arguments Invocation Memory Corruption Vulnerability

ZDI-09-062: Microsoft Internet Explorer JScript arguments Invocation Memory Corruption Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-062 September 8, 2009 -- CVE ID: CVE-2009-1920 -- Affected Vendors: Microsoft -- Affected Products: Microsoft Internet Explorer -- TippingPointTM...

CVE-2009-1920

The CVE-2009-1920 vulnerability is a remote code execution flaw in the JScript scripting engine (JScript.dll) used by Internet Explorer. It arises from the engine’s handling of decoded scripts loaded into memory, where memory corruption can occur and allow arbitrary code execution when a user vis...

JScript Scripting Engine Web Pages Decoding Code Execution (MS09-045; CVE-2009-1920)

JScript is an interpreted, object-based scripting language that is often used to make Web sites more flexible or interactive. A remote code execution vulnerability has been reported in the way that the JScript scripting engine decodes script in Web pages. The vulnerability is due to a memory...

MS09-045: Vulnerability in JScript Scripting Engine Could Allow Remote Code Execution (971961)

The remote host is running a version of Windows that contains a flaw in its JScript scripting engine. An attacker may be able to execute arbitrary code on the remote host by constructing a malicious JScript and enticing a victim to visit a web site or view a specially crafted email message. C...

CVE-2008-1920

CVE-2008-1920 describes a heap-based buffer overflow in the boxelyRenderer module of the Personal Status Manager feature in ICQ 6.0 build 6043. The vulnerability allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted personal status message. The core ...

Debian Security Advisory DSA 804-1 (kdelibs)

The remote host is missing an update to kdelibs announced via advisory DSA 804-1. KDE developers have reported a vulnerability in the backup file handling of Kate and Kwrite. The backup files are created with default permissions, even if the original file had more strict permissions set. This cou...

SuSE 10 Security Update : gimp (ZYPP Patch Number 1920)

A buffer overflow was fixed in the xcf loader in GIMP that allows user-complicit attackers to cause a denial of service crash and possibly execute arbitrary code via an XCF file with a large numaxes value in the VECTORS property. CVE-2006-3404 %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

CVE-2007-1920

CVE-2007-1920 is a SQL injection vulnerability described across multiple sources, affecting SmodBIP 1.06 and earlier in the aktualnosci module. The issue occurs in index.php where the zoom parameter can be exploited by remote attackers to execute arbitrary SQL commands, potentially related to hom...

GLSA-200611-21 : Kile: Incorrect backup file permission

The remote host is affected by the vulnerability described in GLSA-200611-21 Kile: Incorrect backup file permission Kile fails to set the same permissions on backup files as on the original file. This is similar to CVE-2005-1920. Impact : A kile user may inadvertently grant access to sensitive...

CentOS 4 : kdelibs (CESA-2005:612)

Updated kdelibs packages are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. kdelibs contains libraries for the K Desktop Environment. A flaw was discovered affecting Kate, the KDE advanced text...

CVE-2006-1920

The CVE-2006-1920 issue affects PMTool 1.2.2 and is a SQL injection vulnerability in index.php, exploitable via the order parameter within the included files (user.inc.php, customer.inc.php, and project.inc.php). The root cause is a failure to properly sanitize the order parameter leading to arbi...

[SECURITY] [DSA 804-2] New kdelibs packages fix backup file information leak

-------------------------------------------------------------------------- Debian Security Advisory DSA 804-2 [email protected] http://www.debian.org/security/ Martin Schulze November 10th, 2005 http://www.debian.org/security/faq -...