CVE-2015-2294

pfSense before 2.2.1 is affected by multiple WebGUI XSS vulnerabilities (CVE-2015-2294) and a CSRF issue (CVE-2015-2295). The root cause is insufficient validation/sanitization of user-supplied input across many parameters (zone, if/dragtable, queue, id, and various filterlogentries_*; plus syste...

KLA10528 Code injection vulnerability in pfsense

Cross-site scripting vulnerabilities were found in pfSense. By exploiting these vulnerabilities malicious users can enject arbitrary sctip or HTML. These vulnerabilities can be exploited remotely via a specially designed parameters for web interface. Original advisories pfSense advisory...

pfSense 2.2 - Multiple Vulnerabilities

Exploit for php platform in category web applications Product: pfSense Vendor: Electric Sheep Fencing LLC Vulnerable Versions: 2.2 and probably prior Tested Version: 2.2 Advisory Publication: March 4, 2015 without technical details Vendor Notification: March 4, 2015 Vendor Patch: March 5, 2015...

pfSense 2.2 - Multiple Vulnerabilities

Advisory ID: HTB23251 Product: pfSense Vendor: Electric Sheep Fencing LLC Vulnerable Versions: 2.2 and probably prior Tested Version: 2.2 Advisory Publication: March 4, 2015 without technical details Vendor Notification: March 4, 2015 Vendor Patch: March 5, 2015 Public Disclosure: March 25, 2015...

pfSense 2.2 - Multiple Vulnerabilities

pfSense 2.2 - Multiple Vulnerabilities Advisory ID: HTB23251 Product: pfSense Vendor: Electric Sheep Fencing LLC Vulnerable Versions: 2.2 and probably prior Tested Version: 2.2 Advisory Publication: March 4, 2015 without technical details Vendor Notification: March 4, 2015 Vendor Patch: March 5,...

Open Web Analytics 1.5.6 PHP Object Injection Vulnerability

Exploit for php platform in category web applications Open Web Analytics setSetting'base', 'isremoteeventqueue', true; $owa-e-debug$POST; $rawevent = owacoreAPI::getRequestParam'event'; if $rawevent $dispatch = owacoreAPI::getEventDispatch; $event = unserialize base64decode $rawevent ;...

Open Web Analytics 'owa_event'参数PHP对象注入漏洞

Bugtraq ID:66076 CVE ID:CVE-2014-2294 Open Web Analytics是一款基于PHP+MySQL开发的、开源的网络分析软件,可以用来追踪和分析人们是怎样访问你的网站和应用程序的。 Open Web Analytics queue.php不正确过滤通过"owaevent" POST参数提交给"unserialize"的输入，允许远程攻击者利用漏洞通过特制的序列化对象操作部分受限配置选项或创建或覆盖任意文件。 0 Open Web Analytics 1.5.6 厂商补丁： Open Web Analytics ----- Open Web...

ViewGit 0.0.6 - Multiple Cross-Site Scripting Vulnerabilities

ViewGit 0.0.6 - Multiple Cross-Site Scripting Vulnerabilities Vulnerability Report Author: Matthew R. Bucci Date: 18 March, 2013 CVE-2013-2294 Description of Vulnerability: ----------------------------- ViewGit "is a git web repository viewer that aims to be easy to set up and upgrade, light on...

ESA-2013-002: RSA Archer® GRC Multiple Vulnerabilities

ESA-2013-002.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-002: RSA Archer® GRC Multiple Vulnerabilities EMC Identifier: ESA-2013-002 CVE Identifier: CVE-2012-2293, CVE-2012-2292, CVE-2012-1064, CVE-2012-2294 Severity Rating: See below for scores for individual issues Affected...

CVE-2012-2294

CVE-2012-2294 affects EMC RSA Archer SmartSuite Framework 4.x and RSA Archer GRC 5.x earlier than 5.2SP1. The issue is a clickjacking vulnerability exposed via crafted web pages, allowing remote attackers to entice user actions in a legitimate session. The NVD entry lists a CVSSv2 base score of 6...

Debian DSA-2294-1 : freetype - missing input sanitising

It was discovered that insufficient input sanitising in Freetype's code to parse Type1 could lead to the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-2294...

CVE-2011-2294

CVE-2011-2294 applies to Oracle Solaris 10/11 Express and is addressed by Solaris SSH patches. Connected sources indicate SSH-related vulnerability affects SSH/Secure Shell availability. Solaris patch IDs: 143559-10 (sparc) and 145802-06 (x86) fix the issue; installation is the advised remediatio...

CVE-2010-2294

CVE-2010-2294 affects Plume CMS 1.2.4 (and possibly earlier). The vulnerability is a Cross-Site Request Forgery that allows an attacker to hijack the administrator’s session and perform password-change requests, enabling unauthorized admin credential changes via unspecified vectors. The connected...

CVE-2010-2294

Cross-site request forgery CSRF vulnerability in Plume CMS 1.2.4 and possibly earlier allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via unspecified vectors...

Gentoo Security Advisory GLSA 200908-10 (dillo)

The remote host is missing updates announced in advisory GLSA 200908-10. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

[oCERT-2009-008] Dillo integer overflow

2009-008 Dillo integer overflow Description: Dillo, an open source graphical web browser, suffers from an integer overflow which may lead to a potentially exploitable heap overflow and result in arbitrary code execution. The vulnerability is triggered by HTML pages with embedded PNG images, the...

CVE-2009-2294

Integer overflow in the Pngdatainfocallback function in Dillo 2.1 and earlier allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a PNG image with crafted 1 width or 2 height values...

CVE-2009-2294

Dillo up to version 2.1 and earlier is affected by an integer overflow in the Png_datainfo_callback() function when processing crafted PNGs with large width/height. This can lead to a denial of service (crash) and possibly arbitrary code execution. Gentoo GLSA 200908-10 and the related OSS/NVL/Ne...

CVE-2008-2294

The CVE-2008-2294 entry applies to Pet Grooming Management System 2.0. Affected component: useradded.php. Root cause: remote attackers can manipulate a request to set a modified username for the account “admin,” enabling privilege escalation. Documented impact: gain privileges (higher access) rem...

CVE-2008-2294

creationtimestamp| type| source ---|---|--- 2008-05-15 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/5627...