CVE-2013-4356

Xen 4.3.x writes hypervisor mappings to certain shadow pagetables when live migration is performed on hosts with more than 5TB of RAM, which allows local 64-bit PV guests to read or write to invalid memory and cause a denial of service crash...

CVE-2013-4355

Xen 4.3.x and earlier does not properly handle certain errors, which allows local HVM guests to obtain hypervisor stack memory via a 1 port or 2 memory mapped I/O write or 3 other unspecified operations related to addresses without associated memory...

CVE-2013-4355

Xen 4.3.x and earlier does not properly handle certain errors, which allows local HVM guests to obtain hypervisor stack memory via a 1 port or 2 memory mapped I/O write or 3 other unspecified operations related to addresses without associated memory...

Design/Logic Flaw

Xen 4.3.x and earlier does not properly handle certain errors, which allows local HVM guests to obtain hypervisor stack memory via a 1 port or 2 memory mapped I/O write or 3 other unspecified operations related to addresses without associated memory...

CVE-2013-1442

Xen 4.0 through 4.3.x, when using AVX or LWP capable CPUs, does not properly clear previous data from registers when using an XSAVE or XRSTOR to extend the state components of a saved or restored vCPU after touching other restored extended registers, which allows local guest OSes to obtain...

CVE-2012-4747

Bugzilla 2.x and 3.x through 3.6.11, 3.7.x and 4.0.x before 4.0.8, 4.1.x and 4.2.x before 4.2.3, and 4.3.x before 4.3.3 stores potentially sensitive information under the web root with insufficient access control, which allows remote attackers to read 1 template aka .tmpl files, 2 other custom...

CVE-2012-1968

Bugzilla 4.1.x and 4.2.x before 4.2.2 and 4.3.x before 4.3.2 uses bug-editor privileges instead of bugmail-recipient privileges during construction of HTML bugmail documents, which allows remote attackers to obtain sensitive description information by reading the tooltip portions of an HTML e-mai...

CVE-2012-1969

The getattachmentlink function in Template.pm in Bugzilla 2.x and 3.x before 3.6.10, 3.7.x and 4.0.x before 4.0.7, 4.1.x and 4.2.x before 4.2.2, and 4.3.x before 4.3.2 does not check whether an attachment is private before presenting the attachment description within a public comment, which allow...

CVE-2010-5097

Cross-site scripting XSS vulnerability in the click enlarge functionality in TYPO3 4.3.x before 4.3.9 and 4.4.x before 4.4.5 when the caching framework is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the click enlarge functionality in TYPO3 4.3.x before 4.3.9 and 4.4.x before 4.4.5 when the caching framework is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2010-5097

Cross-site scripting XSS vulnerability in the click enlarge functionality in TYPO3 4.3.x before 4.3.9 and 4.4.x before 4.4.5 when the caching framework is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

XSS Vulnerability in Administration Interface of JIRA Bamboo Plugin

We have identified and fixed a cross-site scripting XSS vulnerability in JIRA administration interface. Affected version is JIRA 4.3.x XSS vulnerabilities potentially allow an attacker to embed their own JavaScript into a JIRA page. You can read more about XSS attacks at various places on the web...

Bugzilla Multiple Vulnerabilities

Bugzilla is prone to the following vulnerabilities: 1. A security bypass issue. 2. Multiple information disclosure vulnerabilities. 3. A denial-of-service vulnerability. Successfully exploiting these issues may allow an attacker to bypass certain security restrictions, obtain sensitive informatio...

CVE-2010-1153

CVE-2010-1153 affects TYPO3 4.3.x prior to 4.3.3. The autoloader component is vulnerable to PHP remote file inclusion, allowing an attacker to execute arbitrary PHP code by supplying a URL in the className input field. This results in remote code execution with the attacker exploiting a network-b...

Horde IMP Webmail客户端跨站脚本和HTML注入漏洞

BUGTRAQ ID: 33492 CVECAN ID: CVE-2009-0930 IMP是一款基于Web的强大的邮件程序，由Horde项目组开发，可使用在Linux/Unix或者Windows操作系统下。 IMP没有正确地过滤对smime.php、pgp.php和message.php模块的输入参数便返回给了用户，远程攻击者可以通过向这些模块提交恶意请求执行跨站脚本和HTML注入攻击，导致在用户浏览器会话中执行任意HTML和脚本代码。 Horde IMP 4.3.x Horde IMP 4.2.x 厂商补丁： Horde -----...

CVE-2008-1367

gcc 4.3.x does not generate a cld instruction while compiling functions used for string manipulation such as memcpy and memmove on x86 and i386, which can prevent the direction flag DF from being reset in violation of ABI conventions and cause data to be copied in the wrong direction during signa...

CVE-2008-1367

gcc 4.3.x does not generate a cld instruction while compiling functions used for string manipulation such as memcpy and memmove on x86 and i386, which can prevent the direction flag DF from being reset in violation of ABI conventions and cause data to be copied in the wrong direction during signa...

CVE-2008-1367

CVE-2008-1367 corresponds to a Linux kernel issue where gcc 4.3.x may not emit a cld instruction while compiling string manipulation code (e.g., memcpy/memmove), preventing the direction flag (DF) from being reset and potentially causing memory copy in the wrong direction during signal handling. ...

PHP 4.3.x - Microsoft Windows Shell Escape functions Command Execution

source: https://www.securityfocus.com/bid/10471/info PHP is reportedly prone to a command execution vulnerability in its shell escape functions. This issue is due to a failure of PHP to properly sanitize function arguments. This issue might allow an attacker to execute arbitrary shell commands on...

CVE-2003-0863

The phpchecksafemodeincludedir function in fopenwrappers.c of PHP 4.3.x returns a success value 0 when the safemodeincludedir variable is not specified in configuration, which differs from the previous failure value and may allow remote attackers to exploit file include vulnerabilities in PHP...