CVE-2011-4449

CVE-2011-4449 affects WikkaWiki 1.3.1 and 1.3.2. When INTRANET_MODE is enabled, the actions/files/files.php upload handling permits uploading files with extensions typically not listed in Apache’s TypesConfig, enabling remote attackers to place multi-extension files (e.g., .mm or .vpp) and execut...

CVE-2011-4450

CVE-2011-4450 affects WikkaWiki 1.3.1 and 1.3.2. The vulnerability is a directory traversal in handlers/files.xml/files.xml.php that lets remote attackers read or delete arbitrary files by supplying a path with a non-initial .. in the file parameter (example: /../../wikka.config.php during a down...

CVE-2011-4452

CVE-2011-4452 describes a CSRF vulnerability in WikkaWiki 1.3.1–1.3.2, specifically in the AdminUsers component. An attacker can lure an admin to visit a malicious page containing an image action that triggers delete requests, potentially hijacking the administrator’s session and removing arbitra...

CVE-2011-4448

SQL injection vulnerability in actions/usersettings/usersettings.php in WikkaWiki 1.3.1 and 1.3.2 allows remote attackers to execute arbitrary SQL commands via the defaultcommentdisplay parameter in an update action...

CVE-2011-4451

WikkaWiki 1.3.1 and 1.3.2 are affected by a remote PHP code injection vulnerability in the spam-logging path when spam_logging is enabled. The issue allows an attacker to supply PHP code via the User-Agent header in addcomment requests to write to the spamlog_path file. Vendor disputes this issue...

CVE-2011-4448

CVE-2011-4448 affects WikkaWiki 1.3.1 and 1.3.2. The vulnerability is an SQL injection in actions/usersettings/usersettings.php via the default_comment_display parameter in an update action, caused by insufficient sanitization. This allows remote attackers to inject arbitrary SQL commands and pot...

CVE-2011-4450

Directory traversal vulnerability in handlers/files.xml/files.xml.php in WikkaWiki 1.3.1 and 1.3.2 allows remote attackers to read or delete arbitrary files via a non-initial .. dot dot in the file parameter, as demonstrated by the /../../wikka.config.php pathname in a download action...

Fedora 17 : keepalived-1.2.5-2.fc17 (2012-12377)

Update to keepalived v1.2.5 stable release. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

FreeBSD : moinmoin -- XSS via RST parser (4a8a98ab-f745-11e1-8bd8-0022156e8794)

MITRE CVE team reports : Cross-site scripting XSS vulnerability in the reStructuredText rst parser in parser/textrst.py in MoinMoin before 1.9.4, when docutils is installed or when 'format rst' is set, allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in the...

Novell Sentinel Log Manager <= 1.2.0.1 Directory Traversal

Exploit for php platform in category web applications Exploit Title: Novell Sentinel Log Manager directory traversal Date: 2011-12-18 Exploit Author: Andrea Fabrizi Vendor Homepage: http://www.novell.com/ Version: = 1.2.0.1 Tested on: Sentinel Log Manager Appliance 1.2.0.1 CVE: 2011-5028 The late...

Fedora 16 : keepalived-1.2.3-2.fc16 (2012-12367)

Update to keepalived v1.2.3 stable release. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Mandriva Update for fetchmail MDVSA-2012:149 (fetchmail)

Check for the Version of fetchmail OpenVAS Vulnerability Test Mandriva Update for fetchmail MDVSA-2012:149 fetchmail Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify i...

Fedora Update for java-1.7.0-openjdk FEDORA-2012-13138

Check for the Version of java-1.7.0-openjdk OpenVAS Vulnerability Test Fedora Update for java-1.7.0-openjdk FEDORA-2012-13138 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or...

Fedora Update for kernel FEDORA-2012-12684

Check for the Version of kernel OpenVAS Vulnerability Test Fedora Update for kernel FEDORA-2012-12684 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the ter...

Fedora Update for java-1.7.0-openjdk FEDORA-2012-13138

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Fedora Update for zabbix FEDORA-2012-12488

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Secunia Research: Citrix Access Gateway Plug-in for Windows nsepacom ActiveX Control Integer Overflow

====================================================================== Secunia Research 01/08/2012 - Citrix Access Gateway Plug-in for Windows - - "nsepacom" ActiveX Integer Overflow Vulnerability - ====================================================================== Table of Contents Affected...

Secunia Research: Citrix Access Gateway Plug-in for Windows nsepacom ActiveX Control Buffer Overflow

====================================================================== Secunia Research 01/08/2012 - Citrix Access Gateway Plug-in for Windows - - "nsepacom" ActiveX Buffer Overflow Vulnerability - ====================================================================== Table of Contents Affected...

CVE-2011-4947

Cross-site request forgery CSRF vulnerability in e107admin/usersextended.php in e107 before 0.7.26 allows remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting XSS sequences via the userinclude parameter...

CVE-2011-4951

Open redirect vulnerability in phpgwapi/ntlm/index.php in EGroupware Enterprise Line EPL before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the forward parameter...