28044 matches found
CVE-2012-5558
CVE-2012-5558 affects Drupal contributed modules Smiley (6.x-1.x before 6.x-1.1) and Smileys (6.x-1.x before 6.x-1.1). Root cause: these modules do not sufficiently sanitize user-defined smiley acronyms, enabling XSS when an attacker with the administer smiley permission injects arbitrary script/...
CVE-2012-4434
fwknop before 2.0.3 is affected by a vulnerability that lets remote authenticated users cause a denial-of-service (server crash) and possibly execute arbitrary code. Root cause details are not provided in the documents. Upgrade to fwknop 2.0.3 or apply vendor-recommended remediation per the linke...
CVE-2012-4434
fwknop before 2.0.3 allow remote authenticated users to cause a denial of service server crash or possibly execute arbitrary code...
CVE-2012-3490
CVE-2012-3490 affects the Condor project (7.6.x before 7.6.10 and 7.8.x before 7.8.4). The vulnerability arises from not properly checking the return value of setuid in (1) my_popenv_impl, (2) my_spawnv (src/condor_utils/my_popen.cpp), and (3) systemCommand (condor_vm-gahp/vmgahp_common.cpp). Thi...
CVE-2012-2226
CVE-2012-2226 concerns Invision Power Board (IPB) versions 3.3.0 and 3.2.3, where unsanitized user input in the like.php flow enables Local File Inclusion (LFI) via a crafted key parameter. The vulnerability chain involves base64 decoding a user-supplied value, splitting it into app/area/relId/li...
CVE-2012-1915
CVE-2012-1915 affects EllisLab CodeIgniter up to version 2.1.1; CodeIgniter 2.1.2 fixes bypasses of the xss_clean() filter in system/core/Security.php, enabling XSS that could bypass input filtering. Documented bypass vectors include various HTML tag/attribute configurations that bypass the filte...
CVE-2012-1261
Cross-site scripting XSS vulnerability in cgi-bin/scrutfaexclusions.cgi in Plixer International Scrutinizer NetFlow and sFlow Analyzer 8.6.2.16204 and other versions before 9.0.1.19899 allows remote attackers to inject arbitrary web script or HTML via the standalone parameter...
CVE-2012-1260
Cross-site scripting XSS vulnerability in cgi-bin/userprefs.cgi in Plixer International Scrutinizer NetFlow & sFlow Analyzer 8.6.2.16204, and possibly other versions before 9.0.1.19899, allows remote attackers to inject arbitrary web script or HTML via the newUser parameter. NOTE: this might not ...
CVE-2012-2714
The CVE-2012-2714 entry concerns the Drupal BrowserID (Mozilla Persona) module for Drupal 7.x-1.x, vulnerable before 7.x-1.3. The underlying issue is insufficient validation of authentication requests, allowing remote attackers to hijack arbitrary user authentication via the audience identifier. ...
CVE-2012-2724
The vulnerability CVE-2012-2724 affects the Drupal Simplenews module (versions 6.x-1.x prior to 6.x-1.4, 6.x-2.x prior to 6.x-2.0-alpha4, and 7.x-1.x prior to 7.x-1.0-rc1). The root cause is information disclosure: when confirmation is required for new subscribers, the confirmation page reveals t...
CVE-2012-1261
CVE-2012-1261 describes a cross-site scripting (XSS) vulnerability in Scrutinizer NetFlow and sFlow Analyzer. The issue affects the CGI endpoint /cgi-bin/scrut_fa_exclusions.cgi, where the standalone parameter can be used to inject arbitrary web script/HTML on affected versions (8.6.2.16204 and o...
CVE-2012-1260
Cross-site scripting XSS vulnerability in cgi-bin/userprefs.cgi in Plixer International Scrutinizer NetFlow & sFlow Analyzer 8.6.2.16204, and possibly other versions before 9.0.1.19899, allows remote attackers to inject arbitrary web script or HTML via the newUser parameter. NOTE: this might not ...
CVE-2012-1260
The CVE-2012-1260 entry describes multiple vulnerabilities in Plixer Scrutinizer NetFlow & sFlow Analyzer (Scrutinizer) up to version 8.6.2.16204, possibly affecting earlier builds, with remediation implemented in 9.0.1 (9.0.1.19899). Concrete issues include: Cross-site scripting (XSS) in cgi-bin...
CVE-2012-1258
The CVE-2012-1258 issue affects Plixer Scrutinizer NetFlow & sFlow Analyzer prior to version 9.0.1.19899, where the web application in cgi-bin/userprefs.cgi does not properly enforce permissions, enabling remote attackers to add administrator accounts via parameters newuser, pwd, and selectedUser...
CVE-2012-5693
creationtimestamp| type| source ---|---|--- 2020-01-03 22:49:09+00:00| seen| https://t.me/cibsecurity/8995...
CVE-2012-4451
creationtimestamp| type| source ---|---|--- 2020-01-03 20:49:18+00:00| seen| https://t.me/cibsecurity/8991...
CVE-2012-5878
CVE-2012-5878 concerns the Smartphone Pentest Framework (SPF) versions 0.1.2–0.1.4. The connected records confirm a remote OS command injection vulnerability in SPF’s web GUI, triggered by unsanitized input in the hostingPath parameter for SEAttack.pl and CSAttack.pl (frameworkgui/), and the appU...
CVE-2012-5693
Bulb Security’s Smartphone Pentest Framework (SPF) is affected by OS command injection in SPF web GUI. CVE-2012-5693 (and related CVE-2012-5878) describe that remote attackers can execute arbitrary commands by supplying shell metacharacters in various input fields (ipAddressTB, hostingPath, appUR...
CVE-2012-4451
Zend Framework 2.0.x (before 2.0.1) contains multiple XSS vulnerabilities related to Escaper, exploitable via input to components such as Debug, Feed\PubSubHubbub, Log\Formatter\Xml, Tag\Cloud\Decorator, Uri, View\Helper\HeadStyle, View\Helper\Navigation\Sitemap, and View\Helper\Placeholder\Conta...