43 matches found
CVE-2020-5749
TCExam 14.2.2 is affected by insufficient output sanitization, enabling remote, authenticated attackers to perform persistent cross-site scripting by creating specially crafted groups. The issue is documented across multiple sources (NVD/Red Hat etc.) with impact described as persistent XSS; no s...
CVE-2018-5749
install.php in Minecraft Servers List Lite before commit c1cd164 and Premium Minecraft Servers List before 2.0.4 does not sanitize input before saving database connection information in connect.php, which might allow remote attackers to execute arbitrary PHP code via the 1 databaseserver, 2...
CVE-2018-5749
CVE-2018-5749 affects Minecraft Servers List Lite (pre-commit c1cd164) and Premium Minecraft Servers List (pre-2.0.4). The root cause is failure to sanitize/filter database connection information before storing it in connect.php, enabling a remote attacker to execute arbitrary PHP code via the pa...
CVE-2016-5749
The vulnerability CVE-2016-5749 affects NetIQ Access Manager. Affected: NAM 4.1 before 4.1.2 HF 1 and 4.2 before 4.2.2. Root cause: NAM parses incoming SAML requests with External Entity (XXE) resolution enabled. Impact: potential local file disclosure through XML External Entity injection. Explo...
Details Surface on Patched Sandbox Violation Vulnerability in iOS
Apple patched an issue last week in iOS that could have allowed attackers to bypass the third-party app-sandbox protection mechanism on devices and read arbitrary managed preferences via a special app. The issue, which was present in versions of iOS prior to 8.4.1, stems from a vulnerability with...
CVE-2015-5749
The Sandboxprofiles component in Apple iOS before 8.4.1 allows attackers to bypass the third-party app-sandbox protection mechanism and read arbitrary managed preferences via a crafted app...
CVE-2015-5749
The CVE-2015-5749 issue affects Apple iOS prior to 8.4.1, where the Sandbox_profiles component (and CFPreferences under the third‑party app sandbox) could be bypassed by a crafted app to read arbitrary managed preferences. Apple and ThreatPost describe an in enterprise context where MDM‑provided ...
CVE-2014-5749
The CVE-2014-5749 entry concerns the Jelly Splash (com.wooga.jelly_splash) Android app running version 1.11.3. The vulnerability is due to the app not verifying X.509 certificates from SSL servers, enabling man‑in‑the‑middle attackers to spoof servers and access sensitive information via a crafte...
SimpleRisk 20130915-01 - Multiple Vulnerabilities
No description provided by source. 1. Advisory Information Title: SimpleRisk v.20130915-01 CSRF-XSS Account Compromise Advisory ID: RS-2013-0001 Date Published: 2013-09-30 2. Vulnerability Information Type: Cross-Site Request Forgery CSRF CWE-352, OWASP-A8, Cross-Site Scripting XSS CWE-79, OWASP-...
CVE-2013-5749
Cross-site scripting XSS vulnerability in management/prioritizeplanning.php in SimpleRisk before 20130916-001 allows remote attackers to inject arbitrary web script or HTML via the newproject parameter...
CVE-2013-5749
Cross-site scripting XSS vulnerability in management/prioritizeplanning.php in SimpleRisk before 20130916-001 allows remote attackers to inject arbitrary web script or HTML via the newproject parameter...
CVE-2013-5749
CVE-2013-5749 describes a cross-site scripting (XSS) vulnerability in SimpleRisk, specifically in management/prioritize_planning.php, exploitable via the new_project parameter. It affects SimpleRisk versions before 20130916-001, enabling remote attackers to inject arbitrary web script/HTML. The c...
SimpleRisk 20130915-01 - Multiple Vulnerabilities
Exploit for php platform in category web applications 1. Advisory Information Title: SimpleRisk v.20130915-01 CSRF-XSS Account Compromise Advisory ID: RS-2013-0001 Date Published: 2013-09-30 2. Vulnerability Information Type: Cross-Site Request Forgery CSRF CWE-352, OWASP-A8, Cross-Site Scripting...
SimpleRisk 20130915-01 - Multiple Vulnerabilities
Advisory Information Title: SimpleRisk v.20130915-01 CSRF-XSS Account Compromise Advisory ID: RS-2013-0001 Date Published: 2013-09-30 2. Vulnerability Information Type: Cross-Site Request Forgery CSRF CWE-352, OWASP-A8, Cross-Site Scripting XSS CWE-79, OWASP-A3 Impact: Full Account Compromise...
Mandriva Update for kernel MDKSA-2007:040 (kernel)
Check for the Version of kernel OpenVAS Vulnerability Test Mandriva Update for kernel MDKSA-2007:040 kernel Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under t...
Mandriva Update for kernel MDKSA-2007:012 (kernel)
Check for the Version of kernel OpenVAS Vulnerability Test Mandriva Update for kernel MDKSA-2007:012 kernel Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under t...
SuSE Update for kernel-bigsmp SUSE-SA:2007:018
Check for the Version of kernel-bigsmp OpenVAS Vulnerability Test $Id: gbsuse2007018.nasl 8050 2017-12-08 09:34:29Z santu $ SuSE Update for kernel-bigsmp SUSE-SA:2007:018 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is...
SuSE Update for kernel SUSE-SA:2007:021
Check for the Version of kernel OpenVAS Vulnerability Test $Id: gbsuse2007021.nasl 8050 2017-12-08 09:34:29Z santu $ SuSE Update for kernel SUSE-SA:2007:021 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software;...
CVE-2008-5749
CVE-2008-5749 affects Google Chrome 1.0.154.36 on Windows XP SP3 and is an argument-injection vulnerability in the chromehtml URI via the --renderer-path option, enabling remote command execution. OpenVAS entries corroborate a Google Chrome argument-injection vulnerability; the core issue is the ...
