CVE-2014-9607

Cross-site scripting XSS vulnerability in remotereporter/loadlogfiles.php in Netsweeper 4.0.3 and 4.0.4 allows remote attackers to inject arbitrary web script or HTML via the url parameter...

CVE-2014-9607

CVE-2014-9607 describes a cross-site scripting (XSS) vulnerability in Netsweeper’s remotereporter/load_logfiles.php used by version 4.0.3 and 4.0.4. The issue allows remote attackers to inject arbitrary web script or HTML via the url parameter, potentially executing code in the context of the tar...

CVE-2018-20626

PHP Scripts Mall Consumer Reviews Script 4.0.3 has directory traversal via a direct request for a listing of an uploads directory such as the wp-content/uploads/2018/12 directory...

CVE-2018-20626

PHP Scripts Mall Consumer Reviews Script 4.0.3 has directory traversal via a direct request for a listing of an uploads directory such as the wp-content/uploads/2018/12 directory...

Multiple Cross-site Scripting (XSS) Vulnerabilities

Multiple cross-site scripting XSS vulnerabilities in actionpack/lib/actionview/helpers/numberhelper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the 1 format, 2 negativeformat, or 3 units...

Apereo Bedework bw-webdav XML External Entity Injection Vulnerability

Apereo Bedework bw-webdav is a general purpose webdav server. It is primarily used to interact with the backend to access resources. A security vulnerability exists in Apereo Bedework bw-webdav versions prior to 4.0.3. An attacker can exploit this vulnerability to perform an XML external entity...

PowerDNS Security Advisory 2016-04: Insufficient validation of TSIG signatures

Two issues have been found in PowerDNS Authoritative Server allowing an attacker in position of man-in-the-middle to alter the content of an AXFR because of insufficient validation of TSIG signatures. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a...

Pivotal Software Redis 2.0.x < 3.2.12 / 4.0.x < 4.0.3 DoS

The version of Redis installed on the remote host is affected by a denial of service vulnerability and therefore requires a security update. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid109326; scriptversion"1.6...

DEBIAN-CVE-2014-8130

The TIFFmalloc function in tifunix.c in LibTIFF 4.0.3 does not reject a zero size, which allows remote attackers to cause a denial of service divide-by-zero error and application crash via a crafted TIFF image that is mishandled by the TIFFWriteScanline function in tifwrite.c, as demonstrated by...

CVE-2014-8129

LibTIFF 4.0.3 allows remote attackers to cause a denial of service out-of-bounds write or possibly have unspecified other impact via a crafted TIFF image, as demonstrated by failure of tifnext.c to verify that the BitsPerSample value is 2, and the t2psamplelabsignedtounsigned function in tiff2pdf...

CVE-2014-8130

The TIFFmalloc function in tifunix.c in LibTIFF 4.0.3 does not reject a zero size, which allows remote attackers to cause a denial of service divide-by-zero error and application crash via a crafted TIFF image that is mishandled by the TIFFWriteScanline function in tifwrite.c, as demonstrated by...

CVE-2014-8129

LibTIFF 4.0.3 allows remote attackers to cause a denial of service out-of-bounds write or possibly have unspecified other impact via a crafted TIFF image, as demonstrated by failure of tifnext.c to verify that the BitsPerSample value is 2, and the t2psamplelabsignedtounsigned function in tiff2pdf...

CVE-2014-8129

CVE-2014-8129 affects LibTIFF 4.0.3, enabling remote users to trigger a denial of service (out-of-bounds write) via a crafted TIFF image. The issue is tied to a failure to verify BitsPerSample = 2 in tif_next.c and to the t2p_sample_lab_signed_to_unsigned path in tiff2pdf.c. Various advisories no...

CVE-2017-15870

Palo Alto Networks GlobalProtect Agent before 4.0.3 allows attackers with administration rights on the local station to gain SYSTEM privileges via vectors involving "image path execution hijacking."...

Ametys CMS Unauthenticated Password Reset Vulnerability

Ametys CMS is prone to an unauthenticated password reset vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Ametys CMS 4.0.2 - Password Reset

Ametys CMS 4.0.2 - Password Reset Vulnerability Summary The following advisory describes a password reset vulnerability found in Ametys CMS version 4.0.2 Ametys is “a free and open source content management system CMS written in Java. It is based on JSR-170 for content storage, Open Social for...

Lockstep Backup for Workgroups 4.0.3 - Remote Buffer Overflow (Metasploit)

require 'msf/core' class MetasploitModule 'Lockstep Backup for Workgroups %q This module exploits a stack buffer overflow found in Lockstep Backup for Workgroups 'james fitts' , 'License' = MSFLICENSE, 'Version' = '$Revision: $', 'References' = 'URL', 'http://secunia.com/advisories/50260/' ,...

phpMyAdmin XSS Vulnerability (PMASA-2013-6) - Windows

phpMyAdmin is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Out-of-bounds

LibTIFF 4.0.3 allows remote attackers to cause a denial of service out-of-bounds read and crash via a crafted TIFF image to the 1 checkInkNamesString function in tifdir.c in the thumbnail tool, 2 compresscontig function in tiff2bw.c in the tiff2bw tool, 3 putcontig8bitCIELab function in...

CVE-2014-8127

CVE-2014-8127 affects LibTIFF 4.0.3 and is triggered by malformed TIFF images processed by multiple LibTIFF tools (thumbnail, tiff2bw, tiff2rgba, tiff2ps, tiffdither, tiffmedian, tiffset). The root cause is an out-of-bounds read in these tools, potentially enabling denial of service or crash when...