[KIS-2014-09] X2Engine <= 4.1.7 (SiteController.php) PHP Object Injection Vulnerability

------------------------------------------------------------------------- X2Engine = 4.1.7 SiteController.php PHP Object Injection Vulnerability ------------------------------------------------------------------------- - Software Link: http://www.x2engine.com/ - Affected Versions: All versions fr...

CVE-2014-5297

The CVE-2014-5297 entry affects X2Engine 2.8–4.1.7, specifically the actionSendErrorReport method in protected/controllers/SiteController.php. The vulnerability arises from taking user-supplied data in the POST parameter report, applying base64_decode followed by unserialize without proper saniti...

X2Engine 4.1.7 PHP Object Injection

------------------------------------------------------------------------- X2Engine = 4.1.7 SiteController.php PHP Object Injection Vulnerability ------------------------------------------------------------------------- - Software Link: http://www.x2engine.com/ - Affected Versions: All versions fr...

X2Engine 4.1.7 PHP Object Injection / Unrestricted File Upload Vulnerabilies

X2Engine versions 2.8 through 4.1.7 suffer from a PHP object injection and below suffer from an unrestricted file upload vulnerability due to poor use of a blacklist. ------------------------------------------------------------------------- X2Engine = 4.1.7 SiteController.php PHP Object Injection...

CVE-2010-5297

WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once changed, which might allow remote authenticated administrators to bypass intended access restrictions in opportunistic circumstances via an add action after a...

CVE-2010-5297

WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once changed, which might allow remote authenticated administrators to bypass intended access restrictions in opportunistic circumstances via an add action after a...

CVE-2010-5297

The entry describes WordPress before 3.0.1 (Multisite) where the option “site administrators can add users”, once changed, is permanently retained and cannot be turned off. This may allow remote authenticated administrators to bypass intended access restrictions in opportunistic circumstances via...

CVE-2012-5297

CVE-2012-5297 is a SQL injection vulnerability in the edit.asp page of Mavili Guestbook, exploitable via the id parameter. The issue allows remote attackers to execute arbitrary SQL commands. The description states the flaw existed since November 2007. No specific affected versions, fixes, or rem...

Scientific Linux Security Update : mutt on SL5.x, SL4.x, SL3.x i386/x86_64

A flaw was found in the way Mutt used temporary files on NFS file systems. Due to an implementation issue in the NFS protocol, Mutt was not able to exclusively open a new file. A local attacker could conduct a time-dependent attack and possibly gain access to e-mail attachments opened by a victim...

SuSE 10 Security Update : Emacs (ZYPP Patch Number 5297)

Xemacs automatically loaded fast-lock files which allowed local attackers to execute arbitrary code as the user editing the associated files. CVE-2008-2142 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

Gentoo Security Advisory GLSA 200901-12 (noip-updater)

The remote host is missing updates announced in advisory GLSA 200901-12. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR GPL-3.0-only...

Debian Security Advisory DSA 1686-1 (no-ip)

The remote host is missing an update to no-ip announced via advisory DSA 1686-1. OpenVAS Vulnerability Test $Id: deb16861.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1686-1 no-ip Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

Debian DSA-1686-1 : no-ip - buffer overflow

A buffer overflow has been discovered in the HTTP parser of the No-IP.com Dynamic DNS update client, which may result in the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security...

[SECURITY] [DSA 1686-1] New no-ip packages fix arbitrary code execution

------------------------------------------------------------------------ Debian Security Advisory DSA-1686-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff December 14, 2008 http://www.debian.org/security/faq -...

CVE-2008-5297

The CVE-2008-5297 issue affects the No-IP DUC/no-ip-updater, where the GetNextLine() function in noip2.c lacks a length check, causing a stack-based buffer overflow. This allows a remote attacker to execute arbitrary code by sending a crafted HTTP response to DNS update traffic. Exploitation is c...

CVE-2008-5297

creationtimestamp| type| source ---|---|--- 2008-11-18 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/7151...

CVE-2007-5297

Cross-site scripting XSS vulnerability in index.php in Minki 1.30 allows remote attackers to inject arbitrary web script or HTML via the page parameter...

CVE-2007-5297

CVE-2007-5297 affects Minki 1.30, with a vulnerability in index.php where the page parameter enables cross-site scripting (XSS). The root cause is insufficient input handling in the affected script, allowing injection of arbitrary script/HTML by remote attackers. Public exploitation details or co...

Moderate: mutt security update

5:1.4.1-12.0.3.el4 - fix overflow in gecos field handling 240176, CVE-2007-2683 5:1.4.1-12.0.2.el4 - buildrequire aspell 5:1.4.1-12.0.1.el4 - validate msgid in APOP authentication 241201, CVE-2007-1558 - fix insecure temp file creation on NFS 211085, CVE-2006-5297...

DEBIAN-CVE-2006-5297

Race condition in the safeopen function in the Mutt mail client 1.5.12 and earlier, when creating temporary files in an NFS filesystem, allows local users to overwrite arbitrary files due to limitations of the use of the OEXCL flag on NFS filesystems...