913 matches found
CVE-2012-0731
CVE-2012-0731 affects IBM Rational AppScan Enterprise 5.x and 8.x prior to 8.5.0.1. The root cause is failure to prevent service-account impersonation, which could allow remote authenticated users to read arbitrary files through unspecified vectors. The known impact is read access to arbitrary fi...
CVE-2012-0737
CVE-2012-0737 describes a cross-site scripting (XSS) vulnerability in IBM Rational AppScan Enterprise, impacting versions 5.x and 8.x before 8.5.0.1. The flaw allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. The provided documents do not specify th...
CVE-2012-0733
CVE-2012-0733 affects IBM Rational AppScan Enterprise versions 5.x and 8.x prior to 8.5.0.1. When Integrated Windows authentication is enabled, remote authenticated users can hijack a session associated with the service account to obtain administrative privileges. The issue is rooted in how sessi...
Design/Logic Flaw
The administrative management interface on Cisco Wireless LAN Controller WLC devices with software 4.x, 5.x, 6.0, and 7.0 before 7.0.220.0, 7.1 before 7.1.91.0, and 7.2 before 7.2.103.0 allows remote attackers to cause a denial of service device crash via a malformed URL in an HTTP request, aka B...
PHP 5.x < 5.2.2 Multiple vulnerabilities
According to its banner, the version of PHP 5.x installed on the remote host is older than 5.2.2. It is, therefore, affected by multiple vulnerabilities: - A heap-based buffer overflow vulnerability was found in PHP's gd extension. A script that could be forced to process WBMP images from an...
Jcow Social Networking Script 4.2 <= 5.2 Arbitrary Code Execution
Exploit for php platform in category web applications Exploit Title: Jcow CMS 4.x:4.2 Software Link: http://sourceforge.net/projects/jcow/files/jcow4/jcow.4.2.1.zip/download Version: 4.x:4.2 5.6.7.8:34441 at Sat Jun 04 00:00:44 +0000 2011 require 'msf/core' class Metasploit3 'JCow CMS Remote...
SA-CONTRIB-2011-026 - Secure Password Hashes (phpass) - Multiple Vulnerabilities
This module uses the PHPass hashing library to try to store users hashed passwords securely. The module sets a fixed string for the 'pass' column in the users database column but does not replace the pass attribute of the account object used for password reset links. This leads to a vulnerability...
CVE-2011-1504
CVE-2011-1504 is an XSS vulnerability in Liferay Portal Community Edition (CE) 5.x and 6.x up to, but not including, 6.0.6 GA . It allows remote authenticated users to inject arbitrary web script or HTML via a blog title. The issue is remedied by upgrading to 6.0.6 GA (or later) where the fix is ...
PHP 5.x<5.3.6 Zip扩展stream_get_contents拒绝服务漏洞
No description provided by source...
CVE-2011-1158
Cross-site scripting XSS vulnerability in feedparser.py in Universal Feed Parser aka feedparser or python-feedparser 5.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via an unexpected URI scheme, as demonstrated by a javascript: URI...
6-year FreeBSD-SA-05:02.sendfile exploit
Hi, This is almost 0-day. In a sense. I wrote this for a pentesting company. I found it ethically OK to do since the FreeBSD advisory was already out for a couple of weeks. It turns out I was not alone to write an exploit for this bug, and to publish the exploit this year. Timeline: 2005/04/04 -...
CVE-2011-0442
The service utility in EMC Avamar 5.x before 5.0.4 uses cleartext to transmit event details in 1 service requests and 2 e-mail messages, which might allow remote attackers to obtain sensitive information by sniffing the network...
Bacula-Web 1.3.x Cross Site Scripting / SQL Injection
GotGeek Labs http://www.gotgeek.com.br/ Bacula-web 1.3.x - 5.0.3 Multiple Remote Vulnerabilities + Description Bacula-Web is a web based tool that provide you a summarized view of your bacula director. It obtain his information from your bacula catalog's database. It provide some usefull...
SA-CONTRIB-2010-113 - Image - Cross Site Scripting
The Image module project contains supplemental modules, one of which, Image gallery, allows users to create and maintain galleries of image nodes using taxonomy terms. The Image gallery module does not sanitize some user-supplied data before displaying it, leading to a Cross Site Scripting XSS...
Sql injection
Unspecified vulnerability in Movable Type 4.x before 4.35 and 5.x before 5.04 has unknown impact and attack vectors related to the "dynamic publishing error message."...
CVE-2008-7267
SQL injection vulnerability in announcements.php in SiteEngine 5.x allows remote attackers to execute arbitrary SQL commands via the id parameter...
CVE-2008-7269
Open redirect vulnerability in api.php in SiteEngine 5.x allows user-assisted remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the forward parameter in a logout action...
CVE-2008-7268
The phpinfo function in SiteEngine 5.x allows remote attackers to obtain system information by setting the action parameter to phpinfo in misc.php...