CakePHP 2.5.9, 2.6.11 & 2.7.2 Released

CakePHP 2.5.9, 2.6.11 & 2.7.2 Released The CakePHP core team is ready to announce the immediate availability of CakePHP 2.5.9, 2.6.11, and 2.7.2. These releases contain important security updates for applications using prefix routing. Security Issues There are two issues that can impact the...

CVE-2004-2777

GE Healthcare Centricity Image Vault 3.x has a password of 1 gemnet for the administrator account, 2 webadmin for the webadmin administrator account of the ASACA DVD library, 3 an empty value for the gemsservice account of the Ultrasound Database, and possibly 4 gemnet2002 for the gemnet2002...

greenpeace.org XSS vulnerability

Open Bug Bounty ID: OBB-77547 Description| Value ---|--- Affected Website:| greenpeace.org Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat She...

musicnotes.com XSS vulnerability

Vulnerable URL: https://www.musicnotes.com/search/go?p=Q====x";confirm'XSSposed'//=score=or=list=inst1:strings Details: Description| Value ---|--- Patched:| Yes, at 11.08.2015 Latest check for patch:| 11.08.2015 19:14 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa...

c-creation.fr XSS vulnerability

Vulnerable URL: http://c-creation.fr/index2.php?categ=%27/%3E%3Cimg%20src=x%20onerror=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 22.11.2017 Latest check for patch:| 22.11.2017 14:01 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa...

CVE-2015-4293

The packet-reassembly implementation in Cisco IOS XE 3.13S and earlier allows remote attackers to cause a denial of service CPU consumption or packet loss via fragmented 1 IPv4 or 2 IPv6 packets that trigger ATTN-3-SYNCTIMEOUT errors after reassembly failures, aka Bug ID CSCuo37957...

tv8.ch XSS vulnerability

Vulnerable URL: http://www.tv8.ch/tv8/channel/168/3-SAT/now%22%3E%3Csvg%20onload=alert%28%27XSSPOSED%27%29%3E/33/journey/1/progview=1?search=asd Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed...

tv8.ch XSS vulnerability

Vulnerable URL: http://www.tv8.ch/tv8/channel/168/3-SAT/now/33%22%3E%3Csvg%20onload=alert%28%27XSSPOSED%27%29%3E/journey/1/progview=1?search=asd Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed...

tv8.ch XSS vulnerability

Vulnerable URL: http://www.tv8.ch/tv8/channel/168/3-SAT/now/33/journey/1%22%3E%3Csvg%20onload=alert%28%27XSSPOSED%27%29%3E/progview=1?search=asd Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed...

Debian: Security Advisory (DSA-3320-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2015-3226

CVE-2015-3226 is an XSS vulnerability in Active Support's JSON encoding (ActiveSupport::JSON.encode) where a Hash with user-controlled data is mishandled during JSON encoding, potentially injecting script/HTML when inserted into HTML. Affected are Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2...

CVE-2015-1840

CVE-2015-1840 describes a CSRF/XSS-style risk in Rails tooling: jquery_ujs.js and rails.js could cause a CSRF token to be transmitted to a different-domain server when a URL attribute contains a leading space. This bypasses the Same Origin Policy under supported Rails setups (Rails 3.x/4.x with j...

hivex, ocaml, perl, python security update

CentOS Errata and Security Advisory CESA-2015:1378 Updated hivex packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base...

raahauges.com XSS vulnerability

Vulnerable URL: http://www.raahauges.com/view-news.php?id=%27/%3E%3Cimg%20src=x%20onerror=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 25.07.2017 Latest check for patch:| 25.07.2017 13:09 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Ale...

malawiyp.com XSS vulnerability

Vulnerable URL: http://www.malawiyp.com/browse-business-directory/char:D" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 5587479 Google Pagerank| 3 VIP website status:| No Check...

myanmaryp.com XSS vulnerability

Vulnerable URL: http://www.myanmaryp.com/browse-business-directory/char:D" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 264942 Google Pagerank| 3 VIP website status:| No Check...

businesslist.ph XSS vulnerability

Vulnerable URL: http://www.businesslist.ph/browse-business-directory/char:A" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 138829 Google Pagerank| 3 VIP website status:| No Check...

Flash Player < 13.0.0.305 / 18.0.0.209 Multiple RCE (APSB15-18)

Binary data 8822.prm...

reviversoft.com XSS vulnerability

Open Bug Bounty ID: OBB-74438 Description| Value ---|--- Affected Website:| reviversoft.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

SUSE SLED11 Security Update : flash-player (SUSE-SU-2015:1258-1)

flash-player was updated to fix two security issues. These security issues were fixed : - CVE-2015-5123: Use-after-free vulnerability in the BitmapData class in the ActionScript 3 AS3 implementation in Adobe Flash Player allowed remote attackers to execute arbitrary code or cause a denial of...