CVE-2011-3288

CVE-2011-3288 affects Cisco Unified Presence before 8.5(4). The vulnerability arises from improper detection of recursion during XML entity expansion, allowing a remote attacker to craft an XML document with deeply nested entity references to cause memory and CPU exhaustion and potentially crash ...

CVE-2011-3288

Cisco Unified Presence before 8.54 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service memory and CPU consumption, and process crash via a crafted XML document containing a large number of nested entity references, aka Bug IDs...

[security bulletin] HPSBMA02591 SSRT100299 rev.1 - HP Systems Insight Manager (SIM) for HP-UX, Linux, and Windows, Remote Cross Site Request Forgery (CSRF), Cross Site Scripting (XSS), Privilege Escalation

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c02549477 Version: 1 HPSBMA02591 SSRT100299 rev.1 - HP Systems Insight Manager SIM for HP-UX, Linux, and Windows, Remote Cross Site Request Forgery CSRF, Cross Site Scripting XSS, Privilege...

CVE-2010-3288

HP Systems Insight Manager (SIM) before version 6.2 is affected by CVE-2010-3288: a remote CSRF vulnerability that could allow an attacker to hijack the authentication of unspecified victims. The HP security bulletin (HPSBMA02591) notes that HP SIM versions prior to 6.2 for HP-UX, Linux, and Wind...

CVE-2010-3288

Cross-site request forgery CSRF vulnerability in HP Systems Insight Manager SIM before 6.2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 : linux, linux-source-2.6.15 vulnerabilities (USN-852-1)

Solar Designer discovered that the z90crypt driver did not correctly check capabilities. A local attacker could exploit this to shut down the device, leading to a denial of service. Only affected Ubuntu 6.06. CVE-2009-1883 Michael Buesch discovered that the SGI GRU driver did not correctly check...

CVE-2009-3288

The sgbuildindirect function in drivers/scsi/sg.c in Linux kernel 2.6.28-rc1 through 2.6.31-rc8 uses an incorrect variable when accessing an array, which allows local users to cause a denial of service kernel OOPS and NULL pointer dereference, as demonstrated by using xcdroast to duplicate a CD...

CVE-2009-3288

The CVE-2009-3288 entry affects the Linux kernel 2.6.28-rc1 through 2.6.31-rc8. It concerns the sg_build_indirect function in drivers/scsi/sg.c, which uses an incorrect variable when accessing an array, allowing a local user to cause a Denial of Service via a kernel OOPS and NULL pointer derefere...

CVE-2008-3288

The CVE-2008-3288 entry documents that the Server Authentication Module in EMC Dantz Retrospect Backup Server 7.5.508 uses a weak hash algorithm for password hashing, enabling context-dependent attackers to recover passwords. This is a network-vector issue with partial confidentiality impact and ...

CVE-2007-3288

Cross-site scripting XSS vulnerability in the skeltoac stats Automattic Stats 1.0 plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer field...

CVE-2007-3288

The CVE-2007-3288 vulnerability affects the WordPress plugin Automattic Stats (skeltoac stats) version 1.0, where an XSS flaw allows remote attackers to inject arbitrary script or HTML via the HTTP Referer field. This is caused by insufficient input/output handling in the plugin, enabling cross-s...

CVE-2005-3288

Mailsite Express is affected by CVE-2005-3288. Remote attackers can upload and execute files with executable extensions (e.g., ASP) by attaching the file via the compose page and then accessing it from the cache directory before saving or sending the message. The vulnerability is documented acros...