Fedora 18 : xen-4.2.2-3.fc18 (2013-7426)

PV guests can use non-preemptible long latency operations to mount a denial of service attack on the whole system XSA-45, CVE-2013-1918, malicious guests can inject interrupts through bridge devices to mount a denial of service attack on the whole system XSA-49, CVE-2013-1952 Note that Tenable...

Fedora 19 : xen-4.2.2-3.fc19 (2013-7406)

update to xen-4.2.2 including two security fixes and fix two possible denial of service attacks Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possib...

Fedora 18 : xen-4.2.2-1.fc18 (2013-6641)

update to xen-4.2.2 which includes security fixes, make xendomains work better with xl Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible withou...

CVE-2012-1969

The getattachmentlink function in Template.pm in Bugzilla 2.x and 3.x before 3.6.10, 3.7.x and 4.0.x before 4.0.7, 4.1.x and 4.2.x before 4.2.2, and 4.3.x before 4.3.2 does not check whether an attachment is private before presenting the attachment description within a public comment, which allow...

CVE-2012-2216 - Social Engine Multiples Vulnerabilities (XSS and CSRF)

Social Engine 4.2.2 Multiples Vulnerabilities Earlier versions are also possibly vulnerable. INFORMATION Product: Social Engine 4.2.2 Remote-Exploit: yes Vendor-URL: http://www.socialengine.net/ Discovered by: Tiago Natel de Moura aka "i4k" Discovered at: 10/04/2012 CVE Notified: 10/04/2012 CVE...

Social Engine 4.2.2 CSRF / Cross Site Scripting

Exploit for php platform in category web applications Social Engine 4.2.2 Multiples Vulnerabilities Earlier versions are also possibly vulnerable. INFORMATION Product: Social Engine 4.2.2 Remote-Exploit: yes Vendor-URL: http://www.socialengine.net/ Discovered by: Tiago Natel de Moura aka "i4k"...

CVE-2012-0742

CVE-2012-0742 affects IBM Tivoli Event Pump 4.2.2. When LOG_REQUESTS and VALIDATE_SOAP_USERS are enabled, credentials are written to the AOPSCLOG (aka AOPLOG) data set, allowing local users to read sensitive information. The vulnerability is a local information disclosure with CVSSv2 base score 1...

WordPress Theme F8 Lite 4.2.1 - 's' Cross-Site Scripting

source: https://www.securityfocus.com/bid/49867/info The F8 Lite theme for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting...

Squiz Matrix 4 - 'colour_picker.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/48118/info Squiz Matrix is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the conte...

CVE-2008-5644

Cross-site scripting XSS vulnerability in the file backend module in TYPO3 4.2.2 allows remote attackers to inject arbitrary web script or HTML via unknown vectors...

CVE-2008-5644

Cross-site scripting XSS vulnerability in the file backend module in TYPO3 4.2.2 allows remote attackers to inject arbitrary web script or HTML via unknown vectors...

TWiki 4.2.2 - action Remote Code Execution

TWiki 4.2.2 - action Remote Code Execution -----------webDEViL - w3bd3vil at gmail dot com ----------- -----------TWiki Remote Code Execution header-type = $query-param'type'; So use this instead: print 'Content-type: '.$query-param'type'."\n\n"; if openF, 'logos/'.$query-param'image' local $/ =...

NetFTPd 4.2.2 User Authentication Remote Buffer Overflow Exploit

No description provided by source. Net-ftpd 4.2.2 user autentication b0f exploit 0day coded by Sergio 'shadown' Alvarez import struct import socket import sys import time class warftpd: def initself, host, port: self.host = host self.port = port self.bsize = 512 self.ebpaddr = 0xcacacaca...

Debian DSA-1432-1 : link-grammar - buffer overflow

Alin Rad Pop discovered that link-grammar, Carnegie Mellon University's link grammar parser for English, performed insufficient validation within its tokenizer, which could allow a malicious input file to execute arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

Remote file inclusion

PHP remote file inclusion vulnerability in include/blocks/weekevents.php in MyNews 4.2.2 allows remote attackers to execute arbitrary PHP code via a URL in the myNewsConfpathsysindex parameter, a different vector than CVE-2007-0633...

CVE-2007-2014

PHP remote file inclusion vulnerability in include/blocks/weekevents.php in MyNews 4.2.2 allows remote attackers to execute arbitrary PHP code via a URL in the myNewsConfpathsysindex parameter, a different vector than CVE-2007-0633...

CVE-2007-2014

CVE-2007-2014 is a PHP remote file inclusion flaw in MyNews 4.2.2. The vulnerability resides in include/blocks/week_events.php and allows remote code execution via a URL supplied to myNewsConf[path][sys][index]. This is a different vector from CVE-2007-0633. Affected product/version: MyNews 4.2.2...

MyNews 4.2.2 - 'Week_Events.php' Remote File Inclusion

source: https://www.securityfocus.com/bid/23398/info MyNews is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to include arbitrary remote files containing malicious PHP code and execute it in the context o...

Remote file inclusion

PHP remote file inclusion vulnerability in include/themes/themefunc.php in MyNews 4.2.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the myNewsConfpathsysindex parameter...

CVE-2007-0633

CVE-2007-0633 describes a PHP remote file inclusion in MyNews 4.2.2 and earlier. The flaw is triggered by passing a URL in myNewsConf[path][sys][index], through which an attacker can execute arbitrary PHP code. Affected product is MyNews (version 4.2.2 and earlier); root cause: improper handling ...