CVE-2011-2979

Bugzilla 4.1.x before 4.1.3 generates different responses for certain assignee queries depending on whether the group name is valid, which allows remote attackers to determine the existence of private group names via a custom search. NOTE: this vulnerability exists because of a CVE-2010-2756...

CVE-2011-2979

Bugzilla 4.1.x before 4.1.3 generates different responses for certain assignee queries depending on whether the group name is valid, which allows remote attackers to determine the existence of private group names via a custom search. NOTE: this vulnerability exists because of a CVE-2010-2756...

CVE-2011-2977

Bugzilla 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 on Windows does not delete the temporary files associated with uploaded attachments, which allows local users to obtain sensitive information by reading these files. NOTE: this issue exists because of a regression in 3...

CVE-2011-2979

Bugzilla 4.1.x before 4.1.3 generates different responses for certain assignee queries depending on whether the group name is valid, which allows remote attackers to determine the existence of private group names via a custom search. NOTE: this vulnerability exists because of a CVE-2010-2756...

Zope未明安全绕过漏洞

Bugtraq ID: 48498 Zope是一款开放源代码的WEB应用服务器。 Zope存在一个未明错误，允许攻击者绕过安全限制未授权访问应用服务器。 目前没有详细漏洞细节提供。 Zope Zope 2.12.3 Zope Zope 2.13 Zope Zope 2.12 Plone Plone 3.3.5 Plone Plone 3.3.4 Plone Plone 3.3.3 Plone Plone 3.3.2 Plone Plone 3.3.1 Plone Plone 3.2.3 Plone Plone 3.2.2 Plone Plone 3.1.6 Plone Plone 3.0...

CVE-2011-1948

Cross-site scripting XSS vulnerability in Plone 4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

Design/Logic Flaw

plone.app.users in Plone 4.0 and 4.1 allows remote authenticated users to modify the properties of arbitrary accounts via unspecified vectors, as exploited in the wild in June 2011...

Cross site scripting

Cross-site scripting XSS vulnerability in the safehtml filter in Products.PortalTransforms in Plone 2.1 through 4.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2010-2422...

CVE-2011-1948

Cross-site scripting XSS vulnerability in Plone 4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2011-1948

Cross-site scripting XSS vulnerability in Plone 4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2011-1949

CVE-2011-1949 is a Plone XSS issue in the PortalTransforms safe_html filter (Plone 2.1–4.1). The vulnerability allows remote authenticated users to inject arbitrary script or HTML via unspecified vectors, caused by the safe_html transform path. This is described as a different vulnerability from ...

CVE-2011-1948

CVE-2011-1948 is a documented cross-site scripting (XSS) vulnerability affecting Plone 4.1 and earlier, where a crafted URL could cause remote attackers to inject arbitrary web script or HTML. Several connected sources corroborate XSS in Plone-related components (e.g., GHSA- P7H9-VF92-5FJ5 and re...

Code injection

vCenter Server in VMware vCenter 4.0 before Update 3 and 4.1 before Update 1 allows local users to discover the SOAP session ID via unspecified vectors...

CVE-2011-1786

lsassd in Likewise Open /Enterprise 5.3 before build 7845, Open 6.0 before build 8325, and Enterprise 6.0 before build 178, as distributed in VMware ESXi 4.1 and ESX 4.1 and possibly other products, allows remote attackers to cause a denial of service daemon crash via an Active Directory login...

CVE-2011-1786

lsassd in Likewise Open /Enterprise 5.3 before build 7845, Open 6.0 before build 8325, and Enterprise 6.0 before build 178, as distributed in VMware ESXi 4.1 and ESX 4.1 and possibly other products, allows remote attackers to cause a denial of service daemon crash via an Active Directory login...

Design/Logic Flaw

The vCenter Tomcat Management Application in VMware vCenter Server 4.1 before Update 1 stores log-on credentials in a configuration file, which allows local users to gain privileges by reading this file...

CVE-2010-2928

The vCenter Tomcat Management Application in VMware vCenter Server 4.1 before Update 1 stores log-on credentials in a configuration file, which allows local users to gain privileges by reading this file...

CVE-2011-0413

The DHCPv6 server in ISC DHCP 4.0.x and 4.1.x before 4.1.2-P1, 4.0-ESV and 4.1-ESV before 4.1-ESV-R1, and 4.2.x before 4.2.1b1 allows remote attackers to cause a denial of service assertion failure and daemon crash by sending a message over IPv6 for a declined and abandoned address...

CVE-2010-4573

Summary (CVE-2010-4573) : VMware ESXi 4.1 Update Installer may improperly configure SFCB authentication if /etc/sfcb/sfcb.cfg was modified during an upgrade from ESXi 3.5 or 4.0. The result is that SFCB authentication could allow login with any username and password, enabling remote access. The i...

CVE-2010-4573

The Update Installer in VMware ESXi 4.1, when a modified sfcb.cfg is present, does not properly configure the SFCB authentication mode, which allows remote attackers to obtain access via an arbitrary username and password...