Oracle Solaris Critical Patch Update : july2013_SRU5_5

This Solaris system is missing necessary patches to address critical security updates : - Vulnerability in the Solaris component of Oracle and Sun Systems Products Suite subcomponent: SMF/File Locking Services. Supported versions that are affected are 8, 9, 10 and 11. Easily exploitable...

CVE-2014-3786

Pixie CMS 1.04’s contact module (admin/modules/contact.php) is affected by multiple POST XSS vulnerabilities via the uemail and subject fields in the contact form. A remote attacker could inject arbitrary web script/HTML, enabling script execution in the victim’s browser on the affected site. The...

Pixie CMS 1.04 Cross Site Scripting

Pixie CMS v1.04 Contact form POST XSS Vulnerabilities Vendor: Pixie CMS Product web page: http://www.getpixie.co.uk Affected version: 1.04 Severity: Medium CVE: CVE-2014-3786 Demo page: http://demo.getpixie.co.uk Discovered by: Filippos Mastrogiannis @filipposmastro & Simone Memoli @Simon90Italy...

CVE-2013-3786

CVE-2013-3786 is an unspecified local kernel vulnerability in Oracle Solaris 9, 10, and 11 that can affect confidentiality, integrity, and availability via unknown vectors. It is classified with CVSSv2 base score 6.0 (local, high complexity, single auth) and is associated with Kernel component is...

APPLE-SA-2011-10-12-6 Numbers for iOS v1.5

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2011-10-12-6 Numbers for iOS v1.5 Numbers for iOS v1.5 is now available and addresses the following: Numbers Available for: iOS Impact: Opening a maliciously crafted Excel file may lead to an unexpected application termination or arbitrary co...

CVE-2011-3786

PHProjekt 6.0.5 is affected by a remote information-disclosure vulnerability where an attacker can trigger a direct request to a PHP file (Setup/Controllers/IndexController.php) and cause an error message to reveal the installation path. The issue is documented across CVE-2011-3786 entries (NVD, ...

Apple iWork Numbers/Pages多个漏洞(CVE-2010-3786)

CVE ID: CVE-2010-3786 iWork 是以Mac 方式创建文档、电子表格和演示文稿的最轻松途径。 Apple iWork在实现上存在多个安全漏洞，远程攻击者可利用这些漏洞控制用户系统。 在处理Excel文件时，iWork Numbers中存在错误，可通过特制的文件造成内存破坏。 Apple iWork 9.x 厂商补丁： Apple ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://support.apple.com/...

Slackware 13.1 / current : mozilla-thunderbird (SSA:2010-202-02)

New mozilla-thunderbird packages are available for Slackware 13.1 and -current to fix security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2010-202-02. The text itself is...

iDefense Security Advisory 11.11.10: Apple Mobile OfficeImport Framework Excel Parsing Memory Corruption Vulnerability

iDefense Security Advisory 11.11.10 http://labs.idefense.com/intelligence/vulnerabilities/ Nov 11, 2010 I. BACKGROUND The OfficeImport framework is an API used by Apple's mobile devices, including the iPod Touch, iPhone, and iPad. The framework is used to parse and display Microsoft Office file...

CVE-2010-3786

QuickLook in Apple Mac OS X 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted Excel file...

CVE-2010-3786

CVE-2010-3786 affects Apple Mac OS X QuickLook in 10.6.x prior to 10.6.5, where a crafted Excel file can cause memory corruption leading to remote code execution or a denial of service. Public sources also tie related Excel-handling memory corruption to iWork Numbers, and Apple released mitigatio...

CVE-2009-3786

Cross-site scripting XSS vulnerability in Organic Groups OG Vocabulary 5.x before 5.x-1.1 and 6.x before 6.x-1.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via the group title...

CVE-2009-3786

CVE-2009-3786 affects Drupal’s Organic Groups (OG) Vocabulary module. Vulnerable: OG Vocabulary 5.x before 5.x-1.1 and 6.x before 6.x-1.1. Issue: cross-site scripting via the group title, enabling remote injection of arbitrary web script/HTML. Impact as stated: script execution in user context; n...

CVE-2009-3786

Cross-site scripting XSS vulnerability in Organic Groups OG Vocabulary 5.x before 5.x-1.1 and 6.x before 6.x-1.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via the group title...

CVE-2008-3786

Cross-site scripting XSS vulnerability in index.php in PICTURESPRO Photo Cart 3.9 allows remote attackers to inject arbitrary web script or HTML via the qtitle parameter aka "Gallery or event name" field in a search action...

CVE-2008-3786

The CVE-2008-3786 entry concerns a Cross-site Scripting (XSS) vulnerability in index.php of PICTURESPRO Photo Cart 3.9. The issue arises from the qtitle parameter (Gallery or event name) in a search action, where user-supplied input is not properly sanitized, enabling an attacker to inject arbitr...

CVE-2008-3786

creationtimestamp| type| source ---|---|--- 2008-08-22 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/32291...

CVE-2007-3786

Cross-site request forgery CSRF vulnerability on the eSoft InstaGate EX2 UTM device before firmware 3.1.20070615 allows remote attackers to perform privileged actions as administrators. NOTE: the vendor disputes the distribution of the vulnerable software, stating that it was a custom build for a...

CVE-2007-3786

The vulnerable product is the eSoft InstaGate EX2 UTM device. A CSRF flaw affects firmware versions prior to 3.1.20070615, allowing remote attackers to perform privileged actions as administrators. The issue’s root cause is a CSRF vulnerability (as described in the CVE entry and related docs). Re...

CVE-2007-3786

Cross-site request forgery CSRF vulnerability on the eSoft InstaGate EX2 UTM device before firmware 3.1.20070615 allows remote attackers to perform privileged actions as administrators. NOTE: the vendor disputes the distribution of the vulnerable software, stating that it was a custom build for a...