CVE-2011-4923

Cross-site scripting XSS vulnerability in View.pm in BackupPC 3.0.0, 3.1.0, 3.2.0, 3.2.1, and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the num parameter in a view action to index.cgi, related to the log file viewer, a different vulnerability than...

CVE-2011-3361

Cross-site scripting XSS vulnerability in CGI/Browse.pm in BackupPC 3.2.0 and possibly other versions before 3.2.1 allows remote attackers to inject arbitrary web script or HTML via the num parameter in a browse action to index.cgi...

CVE-2011-4923

CVE-2011-4923 is an XSS vulnerability in BackupPC’s View.pm affecting versions 3.0.0, 3.1.0, 3.2.0, 3.2.1, and possibly earlier. The flaw allows remote attackers to inject arbitrary web script or HTML via the num parameter in a view action to index.cgi, related to the log file viewer. The vulnera...

CVE-2011-3361

CVE-2011-3361 is an XSS vulnerability in BackupPC 3.2.0 (and possibly earlier) exploitable via the num parameter in the browse action to index.cgi, implemented in CGI/Browse.pm. The issue allows remote attackers to inject arbitrary web script or HTML, with impact described as partial integrity an...

CVE-2011-4614

TYPO3 core (workspaces extension) is affected by CVE-2011-4614: a remote PHP code execution via the BACK_PATH parameter due to a remote file inclusion vulnerability in AbstractController.php. Affected: TYPO3 4.5.x before 4.5.9 and 4.6.x before 4.6.2, plus development 4.7-. Exploitation involves s...

CVE-2011-4320

The modpubsub module modpubsub.erl in ejabberd 2.1.8 and 3.0.0-alpha-3 allows remote authenticated users to cause a denial of service infinite loop via a stanza with a publish tag that lacks a node attribute...

CVE-2011-5081

BackupPC (affected: 3.1.0, 3.2.1 and possibly earlier) contains an XSS vulnerability in RestoreFile.pm that can be triggered via the share parameter in a RestoreFile action to index.cgi, allowing remote attackers to inject arbitrary web script/HTML. The issue is documented as CVE-2011-5081. Sever...

CVE-2011-4614

PHP remote file inclusion vulnerability in Classes/Controller/AbstractController.php in the workspaces system extension in TYPO3 4.5.x before 4.5.9, 4.6.x before 4.6.2, and development versions of 4.7 allows remote attackers to execute arbitrary PHP code via a URL in the BACKPATH parameter...

CVE-2011-4320

The CVE-2011-4320 issue affects the mod_pubsub module (mod_pubsub.erl) in ejabberd 2.1.8 and 3.0.0-alpha-3. An unauthenticated? or remote authenticated user can trigger a denial of service by sending a publish stanza without a node attribute, causing an infinite loop. The root cause is input vali...

CVE-2011-4113

SQL injection vulnerability in the Views module before 6.x-2.13 for Drupal allows remote attackers to execute arbitrary SQL commands via vectors related to "filters/arguments on certain types of views with specific configurations of arguments."...

CVE-2011-4113

CVE-2011-4113 describes a SQL injection vulnerability in the Drupal Views module , present in versions before 6.x-2.13 . The issue allows remote attackers to execute arbitrary SQL commands via vectors related to the filters/arguments on certain types of views with specific configurations of argum...

CVE-2011-4105

CVE-2011-4105 affects LightDM prior to 1.0.6. A local user can change the ownership of arbitrary files via a symlink attack on ~/.Xauthority. This is a local-privilege/teardown-style issue, with low CVSS in the base data but clear impact on file ownership. Remediation: upgrade LightDM to 1.0.6 or...

RHEL 4 : firefox (RHSA-2012:0142)

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2012:0142 advisory. - libpng: Heap buffer overflow in pngdecompresschunk MFSA 2012-11 CVE-2011-3026 Note that Nessus has not tested for this issue but has instead relied...

RHEL 5 / 6 : java-1.6.0-sun (RHSA-2012:0139)

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0139 advisory. - OpenJDK: JavaSound incorrect bounds check Sound, 7088367 CVE-2011-3563 - OpenJDK: AtomicReferenceArray insufficient array type check...

Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 / 11.10 : update-manager regression (USN-1284-2)

USN-1284-1 fixed vulnerabilities in Update Manager. One of the fixes introduced a regression for Kubuntu users attempting to upgrade to a newer Ubuntu release. This update fixes the problem. We apologize for the inconvenience. David Black discovered that Update Manager incorrectly extracted the...

Firefox 10.x < 10.0.2 'png_decompress_chunk' Integer Overflow

The installed version of Firefox 10.x is earlier than 10.0.2 and is, therefore, potentially affected by an integer overflow vulnerability. An integer overflow error exists in 'libpng', a library used by this application. When decompressing certain PNG image files, this error can allow a heap-base...

RHEL 5 / 6 : xulrunner (RHSA-2012:0143)

Updated xulrunner packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having critical security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating...

RHEL 6 : thunderbird (RHSA-2012:0140)

An updated thunderbird package that fixes one security issue is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having critical security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating,...

Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 / 11.10 : libpng vulnerabilities (USN-1367-1)

It was discovered that libpng did not properly verify the embedded profile length of iCCP chunks. An attacker could exploit this to cause a denial of service via application crash. This issue only affected Ubuntu 8.04 LTS. CVE-2009-5063 Jueri Aedla discovered that libpng did not properly verify t...

SeaMonkey < 2.7.2 'png_decompress_chunk' Integer Overflow

The installed version of SeaMonkey is earlier than 2.7.2. Such versions are potentially affected by an integer overflow vulnerability. An integer overflow error exists in 'libpng', a library used by this application. When decompressing certain PNG image files, this error can allow a heap-based...