CVE-2016-2289

ICONICS WebHMI (versions 9 and earlier) suffers a directory traversal flaw (CWE-22) that enables remote attackers to read configuration files and obtain password hashes. Multiple sources (NVD CVE-2016-2289; CNVD-2016-01984; PRION/CVE-2016-2289; ICSA-16-091-01) describe the vulnerability as exploi...

CVE-2015-2289

The CVE-2015-2289 vulnerability affects Serendipity prior to 2.0.1, where the XSS flaw is in templates/2k11/admin/entries.tpl. Remote authenticated editors can inject arbitrary script/HTML via the serendipity[cat][name] parameter to serendipity_admin.php when creating a new category. Root cause i...

Ubuntu: Security Advisory (USN-2289-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2014-2289

res/respjsipextenstate.c in the PJSIP channel driver in Asterisk Open Source 12.x before 12.1.0 allows remote authenticated users to cause a denial of service crash via a SUBSCRIBE request without any Accept headers, which triggers an invalid pointer dereference...

CVE-2014-2289

CVE-2014-2289 affects Asterisk Open Source 12.x prior to 12.1.0 in res/res_pjsip_exten_state.c (PJSIP channel driver). A remote authenticated user can trigger a denial of service (crash) by sending a SUBSCRIBE request without Accept headers, causing an invalid pointer dereference. The issue is fi...

AST-2014-004: Remote Crash Vulnerability in PJSIP Channel Driver Subscription Handling

Asterisk Project Security Advisory - AST-2014-004 Product Asterisk Summary Remote Crash Vulnerability in PJSIP Channel Driver Subscription Handling Nature of Advisory Denial of Service Susceptibility Remote Authenticated Sessions Severity Moderate Exploits Known No Reported On January 14th, 2014...

CVE-2013-2289

CVE-2013-2289 describes a Cross-site Scripting (XSS) vulnerability in Batavi 1.2.2, specifically in admin/templates/default.php, exploitable by sending crafted data via the QUERY_STRING to admin/index.php. Affected component/file: Batavi 1.2.2’s admin templates; root cause is unsanitized QUERY_ST...

CVE-2013-2289

creationtimestamp| type| source ---|---|--- 2013-03-01 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/38332...

ZDI-12-179 : EMC ApplicationXtender Desktop Viewer AEXView ActiveX AnnoSave Remote Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-179 : EMC ApplicationXtender Desktop Viewer AEXView ActiveX AnnoSave Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-179 August 29, 2012 - -- CVE ID: CVE-2012-2289 - -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:...

ESA-2012-039: EMC ApplicationXtender Arbitrary File Upload Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2012-039: EMC ApplicationXtender Arbitrary File Upload Vulnerability EMC Identifier: ESA-2012-039 CVE Identifier: CVE-2012-2289 Severity Rating: CVSS v2 Base Score: 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P Affected products: EMC ApplicationXtender Desktop 6...

DSquare Exploit Pack: D2SEC_EMCAXWA

Name| d2secemcaxwa ---|--- CVE| CVE-2012-2289 Exploit Pack| D2ExploitPack Description| EMC ApplicationXtender Web Access .NET Viewer ActiveX Remote Code Execution Vulnerability Notes|...

CVE-2012-2289

EMC ApplicationXtender products are affected by CVE-2012-2289. The vulnerability exists in EMC ApplicationXtender Desktop before 6.5 SP2 and ApplicationXtender Web Access .NET before 6.5 SP2, enabling remote file uploads to arbitrary locations and potentially arbitrary code execution via unspecif...

Debian: Security Advisory (DSA-2289-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2011-2289

CVE-2011-2289 concerns an unspecified local vulnerability in Oracle Solaris 10 related to LiveUpgrade. Connected sources confirm affected platforms and concrete remediation: Solaris 10 x86: patch 121429-15 (Live Upgrade Zones Support Patch) — install to mitigate. Solaris 10 SPARC: patch 121428-15...

CVE-2010-2289

CVE-2010-2289 describes an open redirect in Juniper Networks IVE. The vulnerability exists in the web-facing CGI path dana/home/homepage.cgi and is exploitable via the Location parameter, allowing remote attackers to redirect users to arbitrary sites and facilitate phishing. Affected products are...

CVE-2009-2289

CVE-2009-2289 is an XSS vulnerability in Arcade Trade Script 1.0 beta, impacting index.php where the q parameter in a gamelist action can be exploited to inject arbitrary script/HTML. The issue is documented in multiple sources (e.g., NVD entry) and arises from insufficient input sanitization in ...

CVE-2009-2289

creationtimestamp| type| source ---|---|--- 2009-05-25 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/34941...

CVE-2008-2289

The CVE-2008-2289 entry concerns Symantec Altiris Deployment Solution 6.8.x and 6.9.x prior to 6.9.176. A vulnerability in a tooltip element enables local users to gain privileges via unspecified attack vectors. Connected documents corroborate the issue as part of multiple local vulnerabilities a...

Altiris Deployment Solution Agent < 6.9.176 Multiple Local Vulnerabilities

The version of the Altiris Deployment Solution Agent installed on the remote host reportedly is affected by several issues : - A local user could access a privileged command prompt via the Agent's user interface CVE-2008-2290. - A local user could leverage a GUI tooltip to access a privileged...

CVE-2002-2289

The CVE concerns BadBlue 1.7.1 where soinfo.php calls the PHP phpinfo function, exposing sensitive information and potentially ODBC passwords. The root cause is the phpinfo output being exposed remotely, enabling information disclosure. Publicly documented details are limited to this information;...