CVE-2011-5024

CVE-2011-5024 describes an XSS in the mmsearch/design component of the Mailman/htdig integration, allowing remote injection of script/HTML via the config parameter. Connected sources confirm the vulnerability in GNU Mailman mmsearch/design and note affected software as Mailman, with root cause a ...

CVE-2011-5026

Cross-site scripting XSS vulnerability in the addPost function in data/functions.php in Winn GuestBook before 2.4.8d allows remote attackers to inject arbitrary web script or HTML via the name parameter to index.php. NOTE: some of these details are obtained from third party information...

CVE-2011-5026

Cross-site scripting (XSS) in Winn GuestBook prior to version 2.4.8d is caused by insufficient sanitization in the addPost function (data/functions.php) that processes the name parameter in index.php. This allows remote attackers to inject arbitrary script/HTML. Affected: Winn GuestBook 2.4.8c (a...

CVE-2011-5021

CVE-2011-5021 affects PHPIDS before 0.7. The vulnerability arises from improper implementation of Regular Expression Denial of Service (ReDoS) filters, allowing remote attackers to bypass rulesets and insert PHP sequences into a file via unspecified vectors. Impact is partial confidentiality, int...

Mandriva Linux Security Advisory : ipmitool (MDVSA-2011:196)

A vulnerability has been discovered and corrected in ipmitool : ipmievd as used in the ipmitool package uses 0666 permissions for its ipmievd.pid PID file, which allows local users to kill arbitrary processes by writing to this file CVE-2011-4339. In Mandriva the ipmievd daemon from the ipmitool...

CVE-2011-5022

creationtimestamp| type| source ---|---|--- 2011-12-29 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/36495...

Winn Guestbook 2.4.8c - Persistent Cross-Site Scripting

Exploit Title: Winn Guestbook v2.4.8c Stored XSS Date: 12/29/11 Author: G13 Software Link: http://code.google.com/p/winn-guestbook/, http://www.winn.ws Version: 2.4.8c Category: webapps php CVE: 2011-5026 Vulnerability There is no sanitation on the input of the name variable. This allows maliciou...

CVE-2011-4461

Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service CPU consumption by sending many crafted parameters...

CVE-2011-5140

creationtimestamp| type| source ---|---|--- 2011-12-29 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/18288...

MS11-100: Vulnerabilities in .NET Framework Could Allow Elevation of Privilege (2638420)

The remote Windows host is running a version of the Microsoft ASP.NET Framework that has multiple vulnerabilities. These include: - A flaw exists in the way ASP.NET generates hash tables for user-supplied values. By sending a small number of specially crafted posts to an ASP.NET server, an attack...

CVE-2011-5023

creationtimestamp| type| source ---|---|--- 2011-12-29 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/36496...

CVE-2011-5026

creationtimestamp| type| source ---|---|--- 2011-12-29 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/18290...

Winn Guestbook 2.4.8c - Persistent Cross-Site Scripting

Winn Guestbook 2.4.8c - Persistent Cross-Site Scripting Exploit Title: Winn Guestbook v2.4.8c Stored XSS Date: 12/29/11 Author: G13 Software Link: http://code.google.com/p/winn-guestbook/, http://www.winn.ws Version: 2.4.8c Category: webapps php CVE: 2011-5026 Vulnerability There is no sanitation...

Mandriva Linux Security Advisory : icu (MDVSA-2011:194)

A vulnerability has been discovered and corrected in icu : A stack-based buffer overflow flaw was found in the way ICU performed variant canonicalization for some locale identifiers. If a specially crafted locale representation was opened in an application linked against ICU, it could cause the...

CVE-2011-4815 ruby: hash table collisions CPU usage DoS (oCERT-2011-003)

Ruby aka CRuby before 1.8.7-p357 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service CPU consumption via crafted input to an application that maintains a hash table...

Hastymail rs parameter command injection

Added: 12/28/2011 CVE: CVE-2011-4542 BID: 50791 OSVDB: 77331 Background Hastymail is a fast, secure, rfc-compliant, cross-platform IMAP/SMTP client application written in PHP providing a clean web interface for sending and reading E-mail. Problem Hastymail2 fails to properly sanitize user-supplie...

Hastymail rs parameter command injection

Added: 12/28/2011 CVE: CVE-2011-4542 BID: 50791 OSVDB: 77331 Background Hastymail is a fast, secure, rfc-compliant, cross-platform IMAP/SMTP client application written in PHP providing a clean web interface for sending and reading E-mail. Problem Hastymail2 fails to properly sanitize user-supplie...

RHEL 6 : krb5-appl (RHSA-2011:1852)

Updated krb5-appl packages that fix one security issue are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Critical security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

FreeBSD 'telnetd' Daemon Remote Buffer Overflow Vulnerability (FreeBSD-SA-11:08.telnetd) - Active Check

FreeBSD is prone to a remote buffer-overflow vulnerability. Copyright C 2011 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...

Hastymail rs parameter command injection

Added: 12/28/2011 CVE: CVE-2011-4542 BID: 50791 OSVDB: 77331 Background Hastymail is a fast, secure, rfc-compliant, cross-platform IMAP/SMTP client application written in PHP providing a clean web interface for sending and reading E-mail. Problem Hastymail2 fails to properly sanitize user-supplie...