CVE-2010-0804

CVE-2010-0804 : The vulnerability is a cross-site scripting (XSS) flaw in the iBoutique 4.0 application, specifically in index.php. The issue arises when a crafted value is supplied to the key parameter in a products action, allowing remote attackers to inject arbitrary web script or HTML. The af...

JQL breaks issue security levels based on custom fields

The MultiSelectCustomFieldIndexer does 2 things: index but don't store a case-folded version in the field "customfield10017:retail" store a "raw" version in a new field with the raw added to the end "customfield10017raw:Retail" The problem is that com.atlassian.jira.security.type.GroupCF looks fo...

JQL breaks issue security levels based on custom fields

The MultiSelectCustomFieldIndexer does 2 things: index but don't store a case-folded version in the field "customfield10017:retail" store a "raw" version in a new field with the raw added to the end "customfield10017raw:Retail" The problem is that com.atlassian.jira.security.type.GroupCF looks fo...

[ MDVSA-2010:049 ] sudo

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2010:049 http://www.mandriva.com/security/ Package : sudo Date : February 25, 2010 Affected: 2008.0, 2009.0, 2009.1, 2010.0, Corporate 4.0, Enterprise Server 5.0 Problem Description: A vulnerabilitiy has been fou...

Slaed CMS 4.0 - Multiple Vulnerabilities

======================================================================================== | Title : Script Slaed Cms 4 Mullti Vulnerability | Author : indoushka | email : [email protected] | Home : www.sec-war.com | Web Site : | Dork : Powered by SLAED CMS © 2005-2008 SLAED. All rights reserve...

PHP Ask & Answer (XSS) Cross Site Scripting Vulnerability

Exploit for unknown platform in category web applications ========================================================= PHP Ask & Answer XSS Cross Site Scripting Vulnerability =========================================================...

SBD Directory 4.0 (XSS) Cross Site Scripting Vulnerability

Exploit for unknown platform in category web applications ========================================================== SBD Directory 4.0 XSS Cross Site Scripting Vulnerability ==========================================================...

Debian DSA-1883-1 : nagios2 - missing input sanitising

Several vulnerabilities have been found in nagios2, a host/service/network monitoring and management system. The Common Vulnerabilities and Exposures project identifies the following problems : Several cross-site scripting issues via several parameters were discovered in the CGI scripts, allowing...

Document Manager Information Disclosure Vulnerability

Document Manager is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Lintian多个本地安全漏洞

Bugraq ID: 37975 CVE ID：CVE-2009-4013 CVE-2009-4014 CVE-2009-4015 Debian Lintian是一款软件包检查程序。 Debian Lintian存在多个安全漏洞，本地攻击者可以利用这些漏洞执行任意代码或者提升特权或获得敏感信息。 CVE-2009-4013：控制文件过滤缺失 CNCVE ID：CNCVE-20094013 CNCVE-20094014 CNCVE-20094015 CNCVE-20094013 控制字段名称和值在使用前没有充分过滤，在部分操作下可导致目录遍历。 Patch...

iBoutique 4.0 Cross Site Scripting

x Author: Andrea Bocchetti x Contact: [email protected] x Homepage : www.geekit.it // Software Info x Name : iBoutique v.4.0 x Vendor : http://www.wscreator.com/iboutique/ x Version : v.4.0 ------------------------------------------------------------------------------------------- x Exploi...

[SECURITY] [DSA-1975-1] Security Support for Debian 4.0 to be discontinued on February 15th

------------------------------------------------------------------------ Debian Security Advisory DSA-1975-1 [email protected] http://www.debian.org/security/ Stefan Fritsch January 20, 2010 http://www.debian.org/security/faq -...

[SECURITY] [DSA-1975-1] Security Support for Debian 4.0 to be discontinued on February 15th

------------------------------------------------------------------------ Debian Security Advisory DSA-1975-1 [email protected] http://www.debian.org/security/ Stefan Fritsch January 20, 2010 http://www.debian.org/security/faq -...

DSA-1975-1 etch - end of life

Security Support for Debian GNU/Linux 4.0 to be discontinued on February 15th One year after the release of Debian GNU/Linux 5.0 alias 'lenny' and nearly three years after the release of Debian GNU/Linux 4.0 alias 'etch' the security support for the old distribution 4.0 alias 'etch' is coming to ...

[SECURITY] [DSA 1973-1] New glibc packages fix information disclosure

------------------------------------------------------------------------ Debian Security Advisory DSA-1973-1 [email protected] http://www.debian.org/security/ Aurelien Jarno January 19, 2010 http://www.debian.org/security/faq -...

CVE-2010-0002

The /etc/profile.d/60alias.sh script in the Mandriva bash package for Bash 2.05b, 3.0, 3.2, 3.2.48, and 4.0 enables the --show-control-chars option in LSOPTIONS, which allows local users to send escape sequences to terminal emulators, or hide the existence of a file, via a crafted filename...

SBD Directory 4.0 Cross Site Scripting

============================================================================== SBD Directory 4.0 XSS Cross Site Scripting Vulnerability ============================================================================== + My home http://hack-tech.com + Date Submitted: January 11 2010 + Founder: Crux +...

Sun Java System Web Server 6.17.0 - TRACE Heap Buffer Overflow (PoC)

Sun Java System Web Server 6.17.0 - TRACE Heap Buffer Overflow PoC source: https://www.securityfocus.com/bid/37648/info Sun Java System Web Server is prone to a remote heap-based buffer-overflow vulnerability. Attackers can exploit this issue to crash the affected application or to obtain...

风讯4.0 user/SetNextOptions.asp sql注入漏洞

/user/SetNextOptions.asp中对用户数据验证不严，存在sql注入漏洞。 风讯4.0 SEBUG临时解决办法： 对ReqSql参数进行过滤 请参考官方补丁 构造注入 user/SetNextOptions.asp?sType=1&EquValue=aaaa&SelectName=aaa&ReqSql=select+1,adminname,3,4,5,6,7,8++from+FSMFAdmin“adminname”管理用户名数据库表...

ASP PD Portal 4.0 Database Disclosure

======================================================================================== | Title : ASp PD PORTAL 4.0 DB Download Vulnerability | Author : indoushka | email : [email protected] | Home : Souk Naamane - 04325 - Oum El Bouaghi - Algeria -00213771818860 | DAte : 16/12/2009 | Web Si...