CVE-2014-2712

Cross-site scripting XSS vulnerability in J-Web in Juniper Junos before 10.0S25, 10.4 before 10.4R10, 11.4 before 11.4R11, 12.1 before 12.1R9, 12.1X44 before 12.1X44-D30, 12.1X45 before 12.1X45-D20, 12.1X46 before 12.1X46-D10, and 12.2 before 12.2R1 allows remote attackers to inject arbitrary web...

CVE-2014-2712

Cross-site scripting XSS vulnerability in J-Web in Juniper Junos before 10.0S25, 10.4 before 10.4R10, 11.4 before 11.4R11, 12.1 before 12.1R9, 12.1X44 before 12.1X44-D30, 12.1X45 before 12.1X45-D20, 12.1X46 before 12.1X46-D10, and 12.2 before 12.2R1 allows remote attackers to inject arbitrary web...

CVE-2014-2712

The CVE-2014-2712 entry describes a cross-site scripting (XSS) in Juniper Junos J-Web that affects multiple Junos releases (e.g., before 10.0S25, 10.4 before 10.4R10, 11.4 before 11.4R11, 12.1 before 12.1R9, 12.2 before 12.2R1 and related 12.1X4x/12.1X46 lines) where J-Web’s index.php accepts uns...

Juniper JunOS J-Web多个跨站脚本漏洞

CVE ID:CVE-2014-2712 Junos是用在Juniper Networks硬件系统内的应用开发平台或网络操作系统。 Juniper JunOS没有正确过滤index.php内使用的某些输入，这可导致插入任意HTML和脚本代码，然后在受影响站点用户浏览器中执行。成功利用此漏洞需要启用J-Web。 0 Juniper Networks JUNOS 13.x Juniper Networks JUNOS 12.x Juniper Networks JUNOS 11.x 目前厂商已经发布了升级补丁以修复漏洞，请下载使用：...

Oracle Linux 5 : vim (ELSA-2008-0580)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2008-0580 advisory. - fixes CVE-2008-3074 tar plugin - fixes CVE-2008-3075 zip plugin - fixes CVE-2008-3076 netrw plugin - fixes CVE-2008-4101 keyword and tag lookup - fix...

Debian DSA-2712-1 : otrs2 - privilege escalation

It was discovered that users with a valid agent login could use crafted URLs to bypass access control restrictions and read tickets to which they should not have access. The oldstable distribution squeeze is not affected by this problem. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Multiple Vulnerabilities in KrisonAV CMS

Advisory ID: HTB23150 Product: KrisonAV CMS Vendor: http://www.krisonav.com Vulnerable Versions: 3.0.1 and probably prior Tested Version: 3.0.1 Vendor Notification: March 27, 2013 Vendor Patch: March 31, 2013 Public Disclosure: April 17, 2013 Vulnerability Type: Cross-Site Scripting CWE-79,...

KrisonAV CMS 3.0.1 - Multiple Vulnerabilities

KrisonAV CMS 3.0.1 - Multiple Vulnerabilities Advisory ID: HTB23150 Product: KrisonAV CMS Vendor: http://www.krisonav.com Vulnerable Versions: 3.0.1 and probably prior Tested Version: 3.0.1 Vendor Notification: March 27, 2013 Vendor Patch: March 31, 2013 Public Disclosure: April 17, 2013...

KrisonAV CMS 3.0.1 - Multiple Vulnerabilities

Advisory ID: HTB23150 Product: KrisonAV CMS Vendor: http://www.krisonav.com Vulnerable Versions: 3.0.1 and probably prior Tested Version: 3.0.1 Vendor Notification: March 27, 2013 Vendor Patch: March 31, 2013 Public Disclosure: April 17, 2013 Vulnerability Type: Cross-Site Scripting CWE-79,...

KrisonAV CMS 3.0.1 CSRF / Cross Site Scripting

Advisory ID: HTB23150 Product: KrisonAV CMS Vendor: http://www.krisonav.com Vulnerable Versions: 3.0.1 and probably prior Tested Version: 3.0.1 Vendor Notification: March 27, 2013 Vendor Patch: March 31, 2013 Public Disclosure: April 17, 2013 Vulnerability Type: Cross-Site Scripting CWE-79,...

Multiple Vulnerabilities in KrisonAV CMS

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in KrisonAV CMS, which can be exploited to perform cross-site scripting and cross-site request forgery attacks. 1 Cross-Site Scripting XSS vulnerability in KrisonAV CMS: CVE-2013-2712 The vulnerability exists due to...

CVE-2012-2712

Multiple cross-site scripting XSS vulnerabilities in the Search API module 7.x-1.x before 7.x-1.1 for Drupal, when supporting manual entry of field identifiers, allow remote attackers to inject arbitrary web script or HTML via vectors related to thrown exceptions and logging errors...

CVE-2012-2712

CVE-2012-2712 affects Drupal’s Search API module (7.x-1.x) up to version 7.x-1.1. The issue is a failure to sufficiently sanitize user input when throwing exceptions or logging errors, enabling remote attackers to inject arbitrary scripts via crafted URLs. Impact is cross-site scripting (XSS) in ...

SA-CONTRIB-2012-084 - Search API - Cross Site Scripting (XSS)

CVE: CVE-2012-2712 This module enables you to build searches using a wide range of features, data sources and backends. The module doesn't sufficiently sanitize user input in some cases when throwing exceptions or logging errors. This enables attackers to insert arbitrary data into a page by...

CVE-2011-2712

CVE-2011-2712 is a cross-site scripting (XSS) vulnerability affecting Apache Wicket 1.4.x prior to 1.4.18 when setAutomaticMultiWindowSupport is enabled. The root cause is the application’s multi-window support configuration enabling injection of arbitrary JavaScript/HTML via unspecified paramete...

[security bulletin] HPSBUX02552 SSRT100062 rev.1 - HP-UX running Software Distributor (sd), Local Privilege Increase, Unauthorized Access

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c02285980 Version: 1 HPSBUX02552 SSRT100062 rev.1 - HP-UX running Software Distributor sd, Local Privilege Increase, Unauthorized Access NOTICE: The information in this Security Bulletin should be...

HP-UX PHCO_41200 : HP-UX running Software Distributor (sd), Local Privilege Increase, Unauthorized Access (HPSBUX02552 SSRT100062 rev.1)

s700800 11.11 Software Distributor Cumulative Patch : A potential security vulnerability has been identified with HP-UX running Software Distributor sd. The vulnerability could be exploited locally to grant an increase in privilege, or to permit unauthorized access. %NASLMINLEVEL 70300 C Tenable...

CVE-2010-2712

CVE-2010-2712 affects HP-UX running Software Distributor (sd) on HP-UX B.11.11, B.11.23, and B.11.31. The vulnerability is described as a local privilege increase with unauthorized access possible via unknown vectors; no exploitation details are provided in the documents beyond HP’s Security Bull...

SLES10: Security update for vim

The remote host is missing updates to packages that affect the security of your system. One or more of the following packages are affected: gvim vim More details may also be found by searching for the SuSE Enterprise Server 10 patch database linked in the references. SPDX-FileCopyrightText: 2009...

CVE-2009-2712

Sun Java System Access Manager 6.3 2005Q1, 7.0 2005Q4, and 7.1; and OpenSSO Enterprise 8.0; when AMConfig.properties enables the debug flag, allows local users to discover cleartext passwords by reading debug files...