81 matches found
CVE-2013-4277
CVE-2013-4277 affects Svnserve in Apache Subversion; affected versions are 1.4.0–1.7.12 and 1.8.0–1.8.1. Local users can overwrite arbitrary files or kill arbitrary processes via a symlink attack on the file specified by the --pid-file option. Root cause: symlink race on pid-file handling. Impact...
Updated subversion package fixes security vulnerability.
svnserve takes a --pid-file option which creates a file containing the process id it is running as. It does not take steps to ensure that the file it has been directed at is not a symlink. If the pid file is in a directory writeable by unprivileged users, the destination could be replaced by a...
Fedora Update for subversion FEDORA-2013-15717
The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2012-4277
Cross-site scripting XSS vulnerability in the smartyfunctionhtmloptionsoptoutput function in distribution/libs/plugins/function.htmloptions.php in Smarty before 3.1.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2012-4277
Cross-site scripting XSS vulnerability in the smartyfunctionhtmloptionsoptoutput function in distribution/libs/plugins/function.htmloptions.php in Smarty before 3.1.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2012-4277
Cross-site scripting XSS vulnerability in the smartyfunctionhtmloptionsoptoutput function in distribution/libs/plugins/function.htmloptions.php in Smarty before 3.1.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2012-4277
Cross-site scripting XSS vulnerability in the smartyfunctionhtmloptionsoptoutput function in distribution/libs/plugins/function.htmloptions.php in Smarty before 3.1.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2012-4277
CVE-2012-4277 describes a Cross‑site Scripting (XSS) vulnerability in the Smarty template engine: the function_html_options_optoutput in distribution/libs/plugins/function.html_options.php is affected when using Smarty versions before 3.1.8. The issue allows remote attackers to inject arbitrary J...
CVE-2011-4277
CVE-2011-4277 describes a cross‑site scripting (XSS) vulnerability in CourseForum ProjectForum 7.0.1.3038 . The issue allows remote attackers to inject arbitrary web script or HTML via a crafted name of an object within a wiki page. The available documentation provides the impact as user‑level sc...
CVE-2010-4277
CVE-2010-4277 affects the Embedded Video WordPress plugin (version 4.1) where lembedded-video.php does not sanitize the content parameter in wp-admin/post.php, enabling an attacker to inject arbitrary web script/HTML via crafted input. This XSS can impact posts created or edited through the WordP...
CVE-2010-4277
Cross-site scripting XSS vulnerability in lembedded-video.php in the Embedded Video plugin 4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the content parameter to wp-admin/post.php...
Embedded Video WordPress Plugin Cross Site Vulnerability (XSS) - CVE-2010-4277
Dear List, I'm writing on behalf of the Check Point Vulnerability Discovery Team to publish the following vulnerability. Check Point Software Technologies - Vulnerability Discovery Team VDT http://www.checkpoint.com/defense/ Embedded Video WordPress Plugin Cross Site Scripting Vulnerability...
CVE-2007-4277
CVE-2007-4277 : Local privilege-escalation in Trend Micro’s AntiVirus engine (pre-8.550-1001) via insecure permissions on the DOS device \.\Tmfilter and an IOCTL handler (0xa0284403) that copies attacker-supplied data into a fixed-size buffer. Local users can send arbitrary content to the device,...
Trend Micro病毒扫描引擎Tmxpflt.sys多个本地安全漏洞
BUGTRAQ ID: 26209 CVECAN ID: CVE-2007-4277 Trend Micro病毒扫描引擎为桌面、服务器和网关提供杀毒功能。 Trend Micro病毒扫描引擎的驱动实现上存在多个安全漏洞，本地攻击者可能利用此漏洞提升权限。 Trend Micro的杀毒引擎中所捆绑的Tmxpflt.sys驱动中没有对\.\Tmfilter DOS设备接口设置安全的权限，允许Everyone写访问，因此任何本地登录的用户都可以访问仅有特权用户才可以访问的功能。 此外这个DOS设备接口的IOCTL...
Trend Micro Scan Engine Tmxpflt.sys Buffer Overflow
The version of Trend Micro AntiVirus installed on the remote Windows host contains a buffer overflow in its 'Tmxpflt.sys' kernel driver. A local attacker may be able to leverage this issue to execute arbitrary code on the affected system in kernel context. C Tenable Network Security, Inc...
iDefense Security Advisory 10.25.07: Trend Micro Tmxpflt.sys IOCTL 0xa0284403 Buffer Overflow Vulnerability
Trend Micro Tmxpflt.sys IOCTL 0xa0284403 Buffer Overflow Vulnerability iDefense Security Advisory 10.25.07 http://labs.idefense.com/intelligence/vulnerabilities/ Oct 25, 2007 I. BACKGROUND The Trend Micro AntiVirus scan engine provides AntiVirus capabilities to desktop, server, and gateway system...
CVE-2006-4277
CVE-2006-4277 concerns multiple PHP remote file inclusion vulnerabilities in Tutti Nova 1.6 and earlier. The flaw allows an attacker to execute arbitrary PHP code by supplying a URL in the TNLIB_DIR parameter to include/novalib/class.novaAdmin.mysql.php or novalib/class.novaRead.mysql.php. Severi...
CVE-2005-4277
Cross-site scripting XSS vulnerability in index.php in toendaCMS before 0.7 Beta allows remote attackers to inject arbitrary web script or HTML via the id parameter...
CVE-2005-4277
CVE-2005-4277 is an XSS vulnerability in toendaCMS prior to 0.7 Beta. The flaw resides in index.php where the id parameter can be manipulated to inject arbitrary script/HTML, enabling remote attackers to execute client-side code. Affected product: toendaCMS (before 0.7 Beta). The provided documen...
