114 matches found
iDefense Security Advisory 11.11.10: Apple Mobile OfficeImport Framework Excel Parsing Memory Corruption Vulnerability
iDefense Security Advisory 11.11.10 http://labs.idefense.com/intelligence/vulnerabilities/ Nov 11, 2010 I. BACKGROUND The OfficeImport framework is an API used by Apple's mobile devices, including the iPod Touch, iPhone, and iPad. The framework is used to parse and display Microsoft Office file...
CVE-2010-3786
QuickLook in Apple Mac OS X 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted Excel file...
CVE-2010-3786
CVE-2010-3786 affects Apple Mac OS X QuickLook in 10.6.x prior to 10.6.5, where a crafted Excel file can cause memory corruption leading to remote code execution or a denial of service. Public sources also tie related Excel-handling memory corruption to iWork Numbers, and Apple released mitigatio...
CVE-2009-3786
Cross-site scripting XSS vulnerability in Organic Groups OG Vocabulary 5.x before 5.x-1.1 and 6.x before 6.x-1.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via the group title...
CVE-2009-3786
CVE-2009-3786 affects Drupal’s Organic Groups (OG) Vocabulary module. Vulnerable: OG Vocabulary 5.x before 5.x-1.1 and 6.x before 6.x-1.1. Issue: cross-site scripting via the group title, enabling remote injection of arbitrary web script/HTML. Impact as stated: script execution in user context; n...
CVE-2009-3786
Cross-site scripting XSS vulnerability in Organic Groups OG Vocabulary 5.x before 5.x-1.1 and 6.x before 6.x-1.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via the group title...
CVE-2008-3786
Cross-site scripting XSS vulnerability in index.php in PICTURESPRO Photo Cart 3.9 allows remote attackers to inject arbitrary web script or HTML via the qtitle parameter aka "Gallery or event name" field in a search action...
CVE-2008-3786
The CVE-2008-3786 entry concerns a Cross-site Scripting (XSS) vulnerability in index.php of PICTURESPRO Photo Cart 3.9. The issue arises from the qtitle parameter (Gallery or event name) in a search action, where user-supplied input is not properly sanitized, enabling an attacker to inject arbitr...
CVE-2008-3786
creationtimestamp| type| source ---|---|--- 2008-08-22 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/32291...
CVE-2007-3786
Cross-site request forgery CSRF vulnerability on the eSoft InstaGate EX2 UTM device before firmware 3.1.20070615 allows remote attackers to perform privileged actions as administrators. NOTE: the vendor disputes the distribution of the vulnerable software, stating that it was a custom build for a...
CVE-2007-3786
The vulnerable product is the eSoft InstaGate EX2 UTM device. A CSRF flaw affects firmware versions prior to 3.1.20070615, allowing remote attackers to perform privileged actions as administrators. The issue’s root cause is a CSRF vulnerability (as described in the CVE entry and related docs). Re...
CVE-2007-3786
Cross-site request forgery CSRF vulnerability on the eSoft InstaGate EX2 UTM device before firmware 3.1.20070615 allows remote attackers to perform privileged actions as administrators. NOTE: the vendor disputes the distribution of the vulnerable software, stating that it was a custom build for a...
CVE-2006-3786
Symantec pcAnywhere 12.5 is affected by CVE-2006-3786 due to weak integrity protection for .cif (CallerID) files, enabling local users to craft a custom .cif file and modify the superuser flag. The concrete impact is local privilege manipulation. Exploitation status is not provided in the connect...