SA-CONTRIB-2012-073 - Glossary - Cross-Site Scripting (XSS)

CVE: CVE-2012-2339 The glossary module scans posts for glossary terms, adding an indicator. By hovering over the indicator, users may learn the definition of that term. The module does not sufficiently sanitize the taxonomy information. This leaves sites vulnerable to Cross-Site Scripting attacks...

Debian: Security Advisory (DSA-2339-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 2339-1 (nss)

The remote host is missing an update to nss announced via advisory DSA 2339-1. OpenVAS Vulnerability Test $Id: deb23391.nasl 6612 2017-07-07 12:08:03Z cfischer $ Description: Auto-generated from advisory DSA 2339-1 nss Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc...

Debian DSA-2339-1 : nss - several vulnerabilities

This update to the NSS cryptographic libraries revokes the trust in the'DigiCert Sdn. Bhd' certificate authority. More information can be found in the Mozilla Security Blog. This update also fixes an insecure load path for pkcs11.txt configuration file CVE-2011-3640 . %NASLMINLEVEL 70300 C Tenabl...

APPLE-SA-2011-10-12-4 Safari 5.1.1

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2011-10-12-4 Safari 5.1.1 Safari 5.1.1 is now available and addresses the following: Safari Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7.2, OS X Lion Server v10.7.2, Windows 7, Vista, XP SP2 or later Impact:...

CVE-2011-2339

The CVE-2011-2339 entry concerns WebKit as used in Apple iTunes prior to v10.5. The vulnerability enables man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and crash) via iTunes Store browsing-related vectors. This is tied to WebKit/Apple iTunes...

CVE-2010-2339

CVE-2010-2339 is an SQL injection in Subdreamer CMS 3.x.x, exploitable via the categoryids[] parameter in admin/pages.php's update_pages action. Documented impact: remote attackers can execute arbitrary SQL commands. Connected sources confirm the vulnerability details, but do not provide exploita...

CVE-2009-2339

CVE-2009-2339 describes an SQL injection in index.php of Rentventory, exploitable remotely via the product parameter. Root cause: improper input handling allows arbitrary SQL execution. Impact (per CVSS v2): partial confidentiality, integrity, and availability with a base score of 7.5 (NETWORK at...

CVE-2009-2339

creationtimestamp| type| source ---|---|--- 2009-07-02 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/9081...

CVE-2008-2339

The CVE-2008-2339 entry describes an SQL injection vulnerability in Turnkey Web Tools SunShop Shopping Cart 3.5.1. The flaw occurs in the index.php file, where an attacker can inject SQL via the id parameter in an item action, potentially allowing remote execution of arbitrary SQL commands. This ...

SuSE 10 Security Update : gv (ZYPP Patch Number 2339)

The previous 'gv' update to fix a stack overflow did not completely fix the problem spotted. An attacker could still cause the handling to use up all system memory, or open windows much wider than the X display and crash. Code execution however was not possible. %NASLMINLEVEL 70300 C Tenable...

CVE-2002-2339

CVE-2002-2339 is an XSS vulnerability in Script-Shed GuestBook 1.0, triggered in configure.asp via javascript: URLs in (1) image, (2) img, (3) image=right, (4) img=right, (5) image=left, (6) img=left tags. Affected component: Script-Shed GuestBook 1.0; root cause: improper handling of user-suppli...

CVE-2007-2339

CVE-2007-2339 concerns Phorum prior to 5.1.22. The vulnerability enables remote attackers to execute arbitrary SQL commands through multiple input vectors: (1) a modified recipients parameter name in pm.php; (2) the curr parameter to the badwords (censorlist) or banlist module in admin.php; or (3...

CVE-2006-2339

CVE-2006-2339 affects evoTopsites 2.x and evoTopsites Pro 2.x. The vulnerability is an SQL injection in index.php exploitable via the cat_id and id parameters, enabling remote attackers to execute arbitrary SQL commands. The connected documents confirm the affected components and the underlying c...

CVE-2005-2339

The CVE-2005-2339 issue affects the Unicode version of msearch (unicode-msearch) 1.51(U1)-beta1, 1.51(U1), and 1.52(U1). The vulnerability is a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The JVN entry confirms the i...

CVE-2004-2339

Microsoft Windows 2000, XP, and possibly 2003 allows local users with the SeDebugPrivilege privilege to execute arbitrary code as kernel and read or write kernel memory via the NtSystemDebugControl function, which does not verify its pointer arguments. Note: this issue has been disputed, since...

CVE-2004-2339

CVE-2004-2339 affects Microsoft Windows 2000, XP, and possibly 2003. The vulnerability allows local users with SeDebugPrivilege to execute arbitrary code at kernel level and read/write kernel memory via NtSystemDebugControl, with argument pointer verification not performed. The issue is local and...

CVE-2004-2339

Microsoft Windows 2000, XP, and possibly 2003 allows local users with the SeDebugPrivilege privilege to execute arbitrary code as kernel and read or write kernel memory via the NtSystemDebugControl function, which does not verify its pointer arguments. Note: this issue has been disputed, since...

CVE-2002-2339

Cross-site scripting XSS vulnerability in configure.asp in Script-Shed GuestBook 1.0 allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in 1 image, 2 img, 3 image=right, 4 img=right, 5 image=left, and 6 img=left tags...