Mezzanine 4.2.0 Cross Site Scripting Vulnerability

Mezzanine version 4.2.0 suffers from persistent cross site scripting vulnerabilities. 1. Introduction Affected Product: Mezzanine 4.2.0 Fixed in: 4.2.1 Fixed Version Link: https://github.com/stephenmcd/mezzanine/releases/tag/4.2.1 Vendor Website: http://mezzanine.jupo.org/ Vulnerability Type: XSS...

Mezzanine 4.2.0 Cross Site Scripting

Security Advisory - Curesec Research Team 1. Introduction Affected Product: Mezzanine 4.2.0 Fixed in: 4.2.1 Fixed Version Link: https://github.com/stephenmcd/mezzanine/releases/tag/4.2.1 Vendor Website: http://mezzanine.jupo.org/ Vulnerability Type: XSS Remote Exploitable: Yes Reported to vendor:...

"Allowed review participants" isn't restricting the scope for groups

h3. Summary The "Allowed review participants" option in the project settings isn't restricting the scope for groups when searching for reviewers to be added to a review, therefore all the groups are listed, even the ones not included as allowed groups. h3. Environment Tested on Crucible 4.2.0 h3...

Cybozu Garoon Cross-Site Scripting Vulnerability (CNVD-2016-06712)

Cybozu Garoon is a portal-type OA office system of Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, etc. and supports free switching among three languages Chinese, Japanese, and English. A cross-site scripting vulnerability exists in...

CVE-2015-5664

CVE-2015-5664 is a cross-site scripting (XSS) vulnerability in QNAP QTS File Station prior to 4.2.0. Multiple connected sources (JVN/JVNDB, CNVD, OpenVAS, Tenable/NASL) confirm that remote attackers can inject arbitrary script/HTML via unspecified vectors, potentially affecting web browser sessio...

Cybozu Garoon 3.x < 4.2.0 Information Disclosure and XSS Vulnerabilities

Cybozu Garoon is prone to information disclosure and cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Linux DoS Xen 4.2.0 2012-5525

This module causes a hypervisor crash in Xen 4.2.0 when invoked from a paravirtualized VM, including from dom0. Successfully tested on Debian 7 3.2.0-4-amd64 with Xen 4.2.0. This module requires Metasploit: https://metasploit.com/download Current source:...

[SECURITY] Fedora 22 Update: rubygem-actionview-4.2.0-5.fc22

Simple, battle-tested conventions and helpers for building web pages...

RT -- two XSS vulnerabilities

Best Practical reports: RT 4.0.0 and above are vulnerable to a cross-site scripting XSS attack via the user and group rights management pages. This vulnerability is assigned CVE-2015-5475. It was discovered and reported by Marcin Kopec at Data Reliance Shared Service Center. RT 4.2.0 and above ar...

[SECURITY] Fedora 22 Update: rubygem-activesupport-4.2.0-2.fc22

Utility library which carries commonly used classes and goodies from the Rails framework...

TWiki 4.2.0 /bin/configure 任意文件下载漏洞

No description provided by source...

Out-of-bounds

The RandR extension in XFree86 4.2.0, X.Org X Window System aka X11 or X X11R6.7, and X.Org Server aka xserver and xorg-server before 1.16.3 allows remote authenticated users to cause a denial of service out-of-bounds read or write or possibly execute arbitrary code via a crafted length or index...

FreeBSD : rt42 -- vulnerabilities related to shellshock (81e2b308-4a6c-11e4-b711-6805ca0b3d42)

Best Practical reports : RT 4.2.0 and above may be vulnerable to arbitrary execution of code by way of CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, or CVE-2014-6271 -- collectively known as 'Shellshock.' This vulnerability requires a privileged user with access to an RT instance...

rt42 -- vulnerabilities related to shellshock

Best Practical reports: RT 4.2.0 and above may be vulnerable to arbitrary execution of code by way of CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, or CVE-2014-6271 -- collectively known as "Shellshock." This vulnerability requires a privileged user with access to an RT instance...

CVE-2014-1474

Algorithmic complexity vulnerability in Email::Address::List before 0.02, as used in RT 4.2.0 through 4.2.2, allows remote attackers to cause a denial of service CPU consumption via a string without an address...

PHP 4.x/5.0.1 PHP_Variables Remote Memory Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/11334/info A vulnerability is reported to present itself in the array parsing functions of the 'phpvariables.c' PHP source file. The vulnerability occurs when a PHP script is being used to print URI parameters or data, th...

w-Agora <= 4.2.0 (inc_dir) Remote File Include Exploit

No description provided by source...

w-Agora <= 4.2.0 (quicklist.php) Remote Code Execution Exploit

No description provided by source. ?php --- wagora420xpl.php 13.33 14/10/2005 W-Agora 4.2.0 possibly prior versions Remote commands execution through quicklist.php and/or upload features by rgod site: http://rgod.altervista.org make these changes in php.ini if you have troubles to launch this...

LibreOffice < 4.1.5 / 4.2.0 Python Multiple Vulnerabilities (Mac OS X)

A version of LibreOffice prior to 4.1.5 / 4.2.0 is installed on the remote Mac OS X host. It is, therefore, reportedly affected by multiple vulnerabilities including a denial of service vulnerability related to Python. A remote attacker could use these flaws to cause a denial of service or to...

Sql injection

The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer and conduct SQL injection attacks via a direct request to the "second layer" of the API, related to contact.getquick...