CVE-2011-4709

CVE-2011-4709 is an XSS issue in Hotaru CMS (admin_index.php SITE_NAME and related admin/index parameters). Connected Red Hat/Veracode records tie a stored-XSS variant to Hotaru CMS v1.7.2 via SITE_NAME, indicating a broader XSS lineage. The sources here do not specify exact affected versions or ...

CVE-2011-4713

Directory traversal vulnerability in catalog/content.php in osCSS2 2.1.0 and earlier allows remote attackers to read arbitrary files via a .. dot dot in the ID parameter to 1 catalog/shoppingcart.php or 2 catalog/content.php...

CVE-2011-4710

Multiple SQL injection vulnerabilities in Pixie CMS 1.01 through 1.04 allow remote attackers to execute arbitrary SQL commands via the 1 pixieuser parameter and 2 Referer HTTP header in a request to the default URI...

CVE-2011-4716

CVE-2011-4716 describes a directory traversal vulnerability in DreamBox DM800 (versions up to 1.6rc3, 1.5rc1 and earlier) that allows remote attackers to read arbitrary files via the file parameter. The affected component is the file handling logic within the DreamBox DM800 firmware. The underlyi...

Moderate: Red Hat Security Advisory: perl security update

Updated perl packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings,...

USN-1294-1: Linux kernel (Oneiric backport) vulnerabilities

Peter Huewe discovered an information leak in the handling of reading security-related TPM data. A local, unprivileged user could read the results of a previous TPM command. CVE-2011-1162 Vasiliy Kulikov discovered that taskstats did not enforce access restrictions. A local attacker could exploit...

CVE-2011-4539

dhcpd in ISC DHCP 4.x before 4.2.3-P1 and 4.1-ESV before 4.1-ESV-R4 does not properly handle regular expressions in dhcpd.conf, which allows remote attackers to cause a denial of service daemon crash via a crafted request packet...

CVE-2011-4265

Cross-site scripting XSS vulnerability in phpWebSite before 1.0.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-3636

Cross-site request forgery CSRF vulnerability in the management interface in FreeIPA before 2.1.4 allows remote attackers to hijack the authentication of administrators for requests that make configuration changes...

CVE-2011-2653

Directory traversal vulnerability in the rtrlet component in Novell ZENworks Asset Management ZAM 7.5 allows remote attackers to execute arbitrary code by uploading an executable file...

DSquare Exploit Pack: D2SEC_ZAM

Name| d2seczam ---|--- CVE| CVE-2011-2653 Exploit Pack| D2ExploitPack Description| Novell ZENWorks Asset Management Arbitrary File Upload Remote Code Execution Vulnerability Notes|...

CVE-2011-3179

CVE-2011-3179 affects Novell Messenger Server (formerly GroupWise Messenger): versions 2.1 and 2.2.x prior to 2.2.1, and GroupWise Messenger 2.04 and earlier, are vulnerable to an information-disclosure flaw that allows a remote attacker to read arbitrary memory locations via a crafted command. T...

CVE-2011-4054

CVE-2011-4054 affects CA SiteMinder (login.fcc) where insufficient validation of the postpreservationdata parameter enables cross-site scripting (XSS). Reported for CA SiteMinder R6 SP6 before CR7 and R12 SP3 before CR8; vendor remediation patches were issued to address the vulnerability: R6 SP6 ...

CVE-2011-4265

Cross-site scripting XSS vulnerability in phpWebSite before 1.0.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-4264

CVE-2011-4264 affects Etomite CMS versions prior to 1.1 with a cross-site scripting (XSS) vulnerability. An attacker can inject arbitrary web script or HTML via unspecified vectors, potentially leading to script execution in the affected user’s browser. Remediation per connected documents is to u...

CVE-2011-3636

Cross-site request forgery CSRF vulnerability in the management interface in FreeIPA before 2.1.4 allows remote attackers to hijack the authentication of administrators for requests that make configuration changes...

CVE-2011-4539

CVE-2011-4539 affects ISC DHCP: dhcpd in 4.x before 4.2.3-P1 and 4.1-ESV before 4.1-ESV-R4 fails to properly handle regular expressions in dhcpd.conf, enabling remote attackers to cause a denial of service (daemon crash) via a crafted request packet. Public advisories and Nessus/OpenSSL patch ref...

CVE-2011-4265

CVE-2011-4265 is an XSS vulnerability in phpWebSite before 1.0.0. Affected product: phpWebSite (versions prior to 1.0.0). Vulnerable component/vector: unspecified in the documents, but the result is arbitrary script execution in a user’s browser. Impact: remote attackers can inject arbitrary web ...

CVE-2011-3636

CVE-2011-3636 describes a CSRF vulnerability in the FreeIPA management interface prior to 2.1.4. The flaw allows an attacker to hijack an administrator’s session and perform configuration-changing requests without authorization. Affected component: FreeIPA management UI. Root cause: CSRF in the w...

CVE-2011-2653

CVE-2011-2653 is a directory traversal vulnerability in Novell ZENworks Asset Management 7.5 (rtrlet/CatchFileServlet) that allows remote attackers to upload an arbitrary executable file and potentially achieve code execution. Multiple connected sources document a path traversal flaw enabling upl...