94 matches found
Debian DSA-2359-1 : mojarra - EL injection
It was discovered that Mojarra, an implementation of JavaServer Faces, evaluates untrusted values as EL expressions if includeViewParameters is set to true. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...
[SECURITY] [DSA 2359-1] mojarra security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2359-1 [email protected] http://www.debian.org/security/ Florian Weimer December 06, 2011 http://www.debian.org/security/faq -...
[SECURITY] [DSA 2359-1] mojarra security update
------------------------------------------------------------------------- Debian Security Advisory DSA-2359-1 [email protected] http://www.debian.org/security/ Florian Weimer December 06, 2011 http://www.debian.org/security/faq -...
CVE-2010-4358
The CVE-2010-4358 entry concerns the MRCGIGUY (MCG) Guestbook 1.0, specifically the gb.cgi component. The vulnerability is described as multiple cross-site scripting (XSS) flaws that allow remote attackers to inject arbitrary web script or HTML via the name, email, website, and message parameters...
CVE-2009-4358
CVE-2009-4358 affects FreeBSD 8.0, 7.2, 7.1, 6.4 and 6.3. The issue is insecure permissions in the working directory (/var/db/freebsd-update) used during freebsd-update fetch or upgrade, allowing local users to read copies of sensitive files. No exploitation details are provided here. The vulnera...
CVE-2008-4358
Technical details for CVE-2008-4358 are not publicly available in the provided documents; monitor for updates.
CVE-2007-4358
Zoidcom 0.6.7 and earlier allows remote attackers to cause a denial of service application crash via a JOIN packet aka connection packet containing 0x69 in the ninth byte, which triggers a "double-delete" of trace data, a different vulnerability than CVE-2005-1643...
CVE-2007-4358
CVE-2007-4358 affects Zoidcom 0.6.7 and earlier. A JOIN/connection packet containing 0x69 in the ninth byte triggers a double-delete of trace data, leading to denial of service (application crash). This is described as a separate issue from CVE-2005-1643. Affected component: Zoidcom’s handling of...
CVE-2006-4358
CVE-2006-4358 describes a cross-site scripting (XSS) vulnerability in the Diesel Pay product, affecting the code path index.php via the read parameter. The vulnerability allows remote attackers to inject arbitrary web script or HTML. According to the NVD entry, the CVSS v2 base score is 4.3 (Medi...
CVE-2005-4358
admin/admindisallow.php in phpBB 2.0.18 allows remote attackers to obtain the installation path via a direct request with a non-empty setmodules parameter, which causes an invalid appendsid function call that leaks the path in an error message...
CVE-2005-4358
admin/admindisallow.php in phpBB 2.0.18 allows remote attackers to obtain the installation path via a direct request with a non-empty setmodules parameter, which causes an invalid appendsid function call that leaks the path in an error message...
CVE-2005-4358
CVE-2005-4358 affects phpBB 2.0.18. The vulnerability is in admin/admin_disallow.php where a direct request with a non-empty setmodules parameter leads to an invalid append_sid function call that leaks the installation path in an error message. Impact: remote attackers can obtain the path to the ...
CVE-2005-4358
admin/admindisallow.php in phpBB 2.0.18 allows remote attackers to obtain the installation path via a direct request with a non-empty setmodules parameter, which causes an invalid appendsid function call that leaks the path in an error message...
