Session Fixation - ownCloud

Due to authenticating a user without invalidating any existing session identifier an attacker has the opportunity to steal authenticated sessions. A successful exploit requires that PHP is configured to accept session parameters via GET. Affected Software ownCloud Server 6.0.2 CVE-2014-2047 Actio...

mutt: heap-based buffer overflow when parsing certain headers

Buffer overflow in copy.c in Mutt before 1.5.23 allows remote attackers to cause a denial of service crash via a crafted RFC2047 header line, related to address expansion...

CVE-2014-2047

Session fixation vulnerability in ownCloud before 6.0.2, when PHP is configured to accept session parameters through a GET request, allows remote attackers to hijack web sessions via unspecified vectors...

CVE-2013-2047

The CVE-2013-2047 entry concerns ownCloud Server versions earlier than 5.0.6, where the login page (index.php) does not disable the password field’s autocomplete. This configuration allows physically proximate attackers to obtain passwords via browsers that support autocomplete. Public references...

CVE-2014-2047

CVE-2014-2047 affects ownCloud Server prior to 6.0.2, where PHP may accept session parameters via GET. The root cause is that authentication could proceed without invalidating an existing session, enabling an attacker to hijack a user’s session (session fixation). The linked advisories describe t...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2012-2047)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-2047 advisory. - mm/hotplug: correctly add new zone to all other nodes zone lists Jiang Liu Orabug: 16020976 Bug-db: 14798 CVE-2012-5517 - Divide by zero in TCP...

CVE-2012-2047

Adobe Shockwave Player before 11.6.6.636 allows attackers to execute arbitrary code or cause a denial of service memory corruption via unspecified vectors, a different vulnerability than CVE-2012-2043, CVE-2012-2044, CVE-2012-2045, and CVE-2012-2046...

Memory corruption

Adobe Shockwave Player before 11.6.6.636 allows attackers to execute arbitrary code or cause a denial of service memory corruption via unspecified vectors, a different vulnerability than CVE-2012-2043, CVE-2012-2044, CVE-2012-2045, and CVE-2012-2047...

Memory corruption

Adobe Shockwave Player before 11.6.6.636 allows attackers to execute arbitrary code or cause a denial of service memory corruption via unspecified vectors, a different vulnerability than CVE-2012-2043, CVE-2012-2044, CVE-2012-2046, and CVE-2012-2047...

CVE-2012-2047

Affected software: Adobe Shockwave Player (before 11.6.6.636). Vulnerability: memory corruption that can allow arbitrary code execution or cause a denial of service via unspecified vectors (distinct from CVE-2012-2043, -2044, -2045, -2046). Root cause/impact: memory corruption leading to potentia...

CVE-2010-2047

SQL injection vulnerability in index.php in JE CMS 1.0.0 and 1.1 allows remote attackers to execute arbitrary SQL commands via the categoryid parameter in a viewcategory action. NOTE: some of these details are obtained from third party information...

CVE-2010-2047

CVE-2010-2047 (JE CMS) : A SQL injection vulnerability exists in JE CMS versions 1.0.0 and 1.1 in index.php, exploitable via the categoryid parameter in a viewcategory action. This allows remote attackers to craft SQL payloads and potentially execute arbitrary SQL commands. The documents do not p...

CVE-2010-2047

creationtimestamp| type| source ---|---|--- 2010-05-17 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/12641...

CVE-2009-2047

Cisco CVE-2009-2047 pertains to a directory traversal vulnerability in the Administration interface of Cisco Customer Response Solutions (CRS) and Cisco Unified CCX, affecting CRS before 7.0(1) SR2. The flaw allows remote authenticated users to read, modify, or delete arbitrary files on the serve...

CVE-2008-2047

creationtimestamp| type| source ---|---|--- 2008-04-26 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/5503...

CVE-2007-2047

Openads 2.3 (aka Max Media Manager, MMM) is affected by a CRLF injection in www/delivery/ck.php, tractable before 0.3.31-alpha-pr3. The vulnerability allows remote attackers to inject arbitrary HTTP headers and perform HTTP response splitting via CRLF sequences in the destination parameter. Impac...

CVE-2006-2047

The CVE-2006-2047 entry affects Application Dynamics Cartweaver ColdFusion versions 2.16.11 and earlier. The vulnerability arises via invalid input parameters in Results.cfm (secondary, PageNum_Results, category, keywords) and Details.cfm (ProdID), which can cause error messages that disclose int...

CVE-2002-2047

The CVE-2002-2047 entry describes a vulnerability in the file preview feature of Sketch (version 0.6.12 and earlier). The issue is that remote attackers can execute arbitrary commands by supplying shell metacharacters in the filename of an encapsulated Postscript (EPS) file, exploiting the previe...

CVE-2002-2047

The file preview functionality in Sketch 0.6.12 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an encapsulated Postscript EPS file...

CVE-2005-2047

Affected product: DUware DUpaypal Pro (3.0; 3.1 noted in related CVEs) is affected by multiple SQL injection vulnerabilities. Vulnerability: Improper sanitization of user-supplied input enables remote attackers to craft SQL queries via specific parameters and pages: iCat to cat.asp (and catEdit.a...