Oracle: Security Advisory (ELSA-2007-0890)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Gentoo Security Advisory GLSA 201312-06

Gentoo Linux Local Security Checks GLSA 201312-06 SPDX-FileCopyrightText: 2015 Eero Volotinen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

CVE-2014-3996

CVE-2014-3996 is a SQL injection in the LinkViewFetchServlet.dat endpoint of multiple ManageEngine products, exploitable via the sv parameter. Affected are Desktop Central (DC) and DC MSP editions before 9 build 90043, Password Manager Pro (PMP) and PMP MSP before 7 build 7003, and IT360/IT360 MS...

ManageEngine Password Manager - MetadataServlet.dat SQL Injection (Metasploit)

ManageEngine Password Manager - MetadataServlet.dat SQL Injection Metasploit This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'msf/core/exploit/filedropper' class Metasploit3 "ManageEngine...

CVE-2014-3996

creationtimestamp| type| source ---|---|--- 2014-08-25 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/34409 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/manageenginedcpmpsqli.rb 2025-02-06 03:13:41+00:00|...

ManageEngine Desktop Central / Password Manager Pro / IT360 SQL Injection

ManageEngine Desktop Central, Password Manager Pro, and IT360 suffer from remote blind SQL injection vulnerabilities. Metasploit module included. TL;DR CVE-2014-3996 / CVE-2014-3997 Blind SQL injection in ManageEngine Desktop Central, Password Manager Pro and IT360 including MSP versions Scroll t...

ManageEngine Password Manager Pro / ManageEngine IT360 - SQL Injection

source: https://www.securityfocus.com/bid/69303/info ManageEngine Password Manager Pro and ManageEngine IT360 are prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to...

ManageEngine Desktop Central / Password Manager Pro / IT360 SQL Injection

TL;DR CVE-2014-3996 / CVE-2014-3997 Blind SQL injection in ManageEngine Desktop Central, Password Manager Pro and IT360 including MSP versions Scroll to the bottom for the Metasploit module link; the module will be submitted to Metasploit proper in a pull request in the next few days...

openSUSE Security Update : festival (openSUSE-SU-2010:0756-1)

festivalserver uses an unsafe LDLIBRARYPATH. Local users could exploit that to execute code as another user if that user runs festivalserver. CVE-2010-3996 has been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

CVE-2013-3996

CVE-2013-3996 affects IBM InfoSphere BigInsights v1.1–v2.1. The issue is a flaw in how FRAME elements are handled, enabling phishing via a crafted web site when the user is authenticated. The IBM bulletin confirms vulnerability to phishing through frames and cross-site scripting-type risks, with ...

Oracle Linux 5 : Moderate: / php (ELSA-2007-0890)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2007-0890 advisory. 5.1.6-15.el5 - improve fix for CVE-2007-3997 278411 5.1.6-14.el5 - fix backport for CVE-2007-3996 278411 5.1.6-13.el5 - add security fixes for...

CVE-2012-3996

The vulnerability CVE-2012-3996 affects TikiWiki CMS/Groupware 8.3 and earlier. It allows remote attackers to disclose the installation path by directly requesting one of three files: admin/include_calendar.php, tiki-rss_error.php, or tiki-watershed_service.php. The impact is information disclosu...

CVE-2012-3996

creationtimestamp| type| source ---|---|--- 2012-07-04 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/19573 2012-07-09 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/19630...

Fedora Update for firefox FEDORA-2012-3996

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Fedora Update for nss FEDORA-2012-3996

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

CVE-2011-3996

The vulnerability CVE-2011-3996 affects CSWorks LiveData Service. Reports confirm that LiveData Service, a server component of CSWorks, is vulnerable to DoS caused by processing crafted TCP packets, leading to a service crash. Affected products/versions include CSWorks 2.0.4115.0 and earlier, wit...

CentOS Update for mikmod CESA-2010:0720 centos5 i386

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

SuSE 11 Security Update : libmikmod (SAT Patch Number 2354)

Specially crafted 'Impulse Tracker' and 'Ultratracker' files could cause a heap based buffer overflow in libmikmod. Attackers could exploit that to crash or potentially execute code in applications linking against libmikmod. CVE-2009-3995 / CVE-2009-3996 %NASLMINLEVEL 70300 C Tenable Network...

CVE-2010-3996

festivalserver in Centre for Speech Technology Research CSTR Festival, probably 2.0.95-beta and earlier, places a zero-length directory name in the LDLIBRARYPATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory...

CVE-2010-3996

The CVE-2010-3996 issue affects Festival Server (CSTR Festival), probably in versions up to 2.0.95-beta and earlier. The root cause is an unsafe LD_LIBRARY_PATH implementation that places a zero-length directory name, enabling a local attacker to load a Trojan horse shared library from the curren...