Samba smbmnt Local Privilege Escalation

According to its banner, the version of Samba running on the remote host is in the 2.x or 3.x branch. Such versions are shipped with a utility called 'smbmnt'. When smbmnt has the setuid 'root' bit set, a local user with access to the victim can mount a Samba share and then execute a setuid or...

FreeBSD Ports: samba34

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2011 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Buffer overflow

Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service memory corruption and daemon restart or possibly have unspecified other impac...

CVE-2011-2737

RSA enVision 3.x and 4.x prior to 4 SP4 P3 contain an arbitrary file retrieval vulnerability (CVE-2011-2737) that may allow unauthenticated remote attackers to read files via unspecified vectors. The issue is acknowledged in RSA ESA-2011-030, which recommends upgrading to RSA enVision 4 SP4 P3 as...

Mandriva Update for dhcp MDVSA-2011:128 (dhcp)

Check for the Version of dhcp OpenVAS Vulnerability Test Mandriva Update for dhcp MDVSA-2011:128 dhcp Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the ter...

Cross site scripting

Cross-site scripting XSS vulnerability in the Contacts application in HP Palm webOS 3.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-2409

The CVE-2011-2409 issue affects HP webOS Calendar on HP Palm webOS 3.x prior to 3.0.2. The vulnerability is a Cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Reported impact indicates potential for arbitrary HTML/JavaScr...

CVE-2011-2408

CVE-2011-2408 affects HP webOS 3.x, specifically the Contacts application, where an XSS vulnerability exists in the Contacts UI before version 3.0.2. The flaw allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. HP security bulletin HPSBGN02694 rev.1 notes affec...

CVE-2011-2694

Cross-site scripting XSS vulnerability in the chgpasswd function in web/swat.c in the Samba Web Administration Tool SWAT in Samba 3.x before 3.5.10 allows remote authenticated administrators to inject arbitrary web script or HTML via the username parameter to the passwd program aka the user field...

CVE-2011-2522

Multiple cross-site request forgery CSRF vulnerabilities in the Samba Web Administration Tool SWAT in Samba 3.x before 3.5.10 allow remote attackers to hijack the authentication of administrators for requests that 1 shut down daemons, 2 start daemons, 3 add shares, 4 remove shares, 5 add printers...

CVE-2011-2694

Cross-site scripting XSS vulnerability in the chgpasswd function in web/swat.c in the Samba Web Administration Tool SWAT in Samba 3.x before 3.5.10 allows remote authenticated administrators to inject arbitrary web script or HTML via the username parameter to the passwd program aka the user field...

phpMyAdmin 3.x Conditional Session Manipulation

No description provided by source. Application: phpMyAdmin 3.x Patched ver: 3.3.10.3 and 3.4.3.2 Severity: Low Exploitable: Remote PMASA ID: PMASA-2011-12 Description If the Swekey extention is activated a remote attacker can manipulate the variables in the the global namespace. Fix Upgrade to...

CVE-2011-2505

libraries/auth/swekey/swekey.auth.lib.php in the Swekey authentication feature in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 assigns values to arbitrary parameters referenced in the query string, which allows remote attackers to modify the SESSION superglobal array via a crafted...

Fedora Update for httpcomponents-client FEDORA-2011-7747

Check for the Version of httpcomponents-client OpenVAS Vulnerability Test Fedora Update for httpcomponents-client FEDORA-2011-7747 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it...

Technote 7.2 Blind SQL Injection

Exploit Title: technote blind sql injection Google Dork: inurl:/technote7/board.php?board= Date: 2011.06.11 Author: BlueH4G http://blueh4g.org Software Link: http://www.technote.co.kr/php/technote1/board.php?board=consult&command=skininsert&exe=insertdownshop Version: technote7.2 && Mysql 3.x sor...

Technote 7.2 - Blind SQL Injection

Exploit Title: technote blind sql injection Google Dork: inurl:/technote7/board.php?board= Date: 2011.06.11 Author: BlueH4G http://blueh4g.org Software Link: http://www.technote.co.kr/php/technote1/board.php?board=consult&command=skininsert&exe=insertdownshop Version: technote7.2 && Mysql 3.x sor...

Python Multiple Vulnerabilities (Windows)

This host is installed with Python and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: gbpythonmultvulnwin.nasl 8160 2017-12-18 15:33:57Z cfischer $ Python Multiple Vulnerabilities Windows Authors: Madhuri D Copyright: Copyright c 2011 Greenbone Networks GmbH,...

vBulletin 3.x vBExperience Cross Site Scripting

Author : Mr.ThieF alert1; Example : http://www.worldwide-invest.org/xperience.php?sortfield=xr&sortorder="alert1; GreeTz : RENO 3 - x-CoD3r 3 - T3rr0risT07 3 -Snip3rwww - ALL My FrindS 3...

CVE-2011-1521

The urllib and urllib2 modules in Python 2.x before 2.7.2 and 3.x before 3.2.1 process Location headers that specify redirection to file: URLs, which makes it easier for remote attackers to obtain sensitive information or cause a denial of service resource consumption via a crafted URL, as...

DEBIAN-CVE-2011-1518

Multiple cross-site scripting XSS vulnerabilities in Open Ticket Request System OTRS 2.4.x before 2.4.10 and 3.x before 3.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...