CVE-2012-0301

Symantec Message Filter’s Brightmail Control Center (web interface) 6.3 is tied to CVE-2012-0301, a session-fixation vulnerability that can allow an attacker to hijack a legitimate user session via unspecified vectors. The linked open-source advisories and vendor notes confirm that this issue aff...

CVE-2012-0302

CVE-2012-0302 concerns an XSS vulnerability in Brightmail Control Center (the web management interface for Symantec Message Filter) version 6.3. The issue arises from insufficient input validation in the Brightmail Control Center, allowing remote attackers to inject arbitrary web script or HTML v...

CVE-2012-0301

Session fixation vulnerability in Brightmail Control Center in Symantec Message Filter 6.3 allows remote attackers to hijack web sessions via unspecified vectors...

Moderate: Red Hat Security Advisory: Red Hat Enterprise Linux 6 kernel security, bug fix and enhancement update

Updated kernel packages that fix two security issues, address several hundred bugs and add numerous enhancements are now available as part of the ongoing support and maintenance of Red Hat Enterprise Linux version 6. This is the third regular update. The Red Hat Security Response Team has rated...

java-1.6.0-openjdk security update

1:1.6.0.0-1.48.1.11.3 - Access gnome bridge jar is forced to have 644 permissions - Resolves: rhbz828751 1:1.6.0.0-1.47.1.11.3 - Modified patch3, java-1.6.0-openjdk-java-access-bridge-security.patch: - com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils. - packages...

SA-CONTRIB-2012-086 - Amadou - Cross Site Scripting

The Amadou theme outputs additional first and last classes to the list of links to help out themers. This was being done in a way that was not secure. A Cross Site Scripting XSS vulnerability was identified in Amadou theme's themeslinks function in the template.php file, which was fixed in the...

qemu-kvm security, bug fix, and enhancement update

qemu-kvm-0.12.1.2-2.209.el62.4 - kvm-e1000-prevent-buffer-overflow-when-processing-legacy.patch bz772081 - Resolves: bz772081 EMBARGOED CVE-2012-0029 qemu-kvm: e1000: processtxdesc legacy mode packets heap overflow rhel-6.2.z qemu-kvm-0.12.1.2-2.209.el62.3 -...

Sybase Easerver 6.3 Directory Traversal

This module exploits a directory traversal vulnerability found in Sybase EAserver's Jetty webserver on port 8000. Code execution seems unlikely with EAserver's default configuration unless the web server allows WRITE permission. Module Options msf use auxiliary/scanner/http/sybase/easervertravers...

Null pointer dereference

IBM solidDB 4.5.x before 4.5.182, 6.0.x before 6.0.1069, 6.1.x and 6.3.x before 6.3 FP8 aka 6.3.49, and 6.5.x before 6.5 FP4 aka 6.5.0.4 does not properly handle the 1 rpctestsvcreadwrite and 2 rpctestsvcdone commands, which allows remote attackers to cause a denial of service NULL pointer...

HP/HPE System Management Homepage (SMH) Multiple Vulnerabilities (HPSBMA02662)

HP/HPE System Management Homepage SMH is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2010-4789

The CVE-2010-4789 issue is a use-after-free in the proxy-server component of IBM Tivoli Directory Server (TDS). Affected versions are TDS 6.0 prior to 6.0.0.65 (aka 6.0.0.8-TIV-ITDS-IF0007) and 6.3 prior to 6.3.0.1 (aka 6.3.0.0-TIV-ITDS-IF0001). The vulnerability allows remote authenticated users...

Multiple vulnerabilities in IBM Tivoli Directory Server !

Multiple vulnerabilities in IBM Tivoli Directory Server Multiple vulnerabilities have been reported in IBM Tivoli Directory Server, which can be exploited by malicious users to disclose sensitive information and by malicious people to cause a Denial of Service and compromise a vulnerable system,...

Ashton Kutcher's Twitter account hacked !

TV prankster Ashton Kutcher has been Punk'd – jokers hacked into his beloved Twitter account on Wednesday. The actor famously fooled celebrities including Beyoncé, Kanye West, and Pete Wentz on his MTV hidden camera show in which he played outrageous practical jokes on his unsuspecting victims...

LiteSpeed Web Server 4.0.17 w/ PHP Remote Exploit for FreeBSD

LiteSpeed Web Server 4.0.17 w/ PHP Remote Exploit for FreeBSD bug discovered & exploited by Kingcope Dec 2010 Lame Xploit Tested with success on FreeBSD 8.0-RELEASE - LiteSpeed WebServer 4.0.17 Standard & Enterprise x86 FreeBSD 6.3-RELEASE - LiteSpeed WebServer 4.0.17 Standard & Enterprise x86...

Memory corruption

VBE6.DLL in Microsoft Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Visual Basic for Applications VBA, and VBA SDK 6.3 through 6.5 does not properly search for ActiveX controls that are embedded in documents, which allows remote attackers to execute arbitrary code via ...

CVE-2010-1227

CVE-2010-1227 describes a cross-site scripting (XSS) vulnerability in Sun Java System Communications Express 6.2 and 6.3 that allows remote attackers to inject arbitrary Web script or HTML via the subject field of a message, demonstrated by a subject containing an IMG element whose SRC attribute ...

Horde 3.3.5 - PHP_SELF Cross-Site Scripting

Horde 3.3.5 - PHPSELF Cross-Site Scripting ============================================= INTERNET SECURITY AUDITORS ALERT 2009-012 - Original release date: October 13th, 2009 - Last revised: December 16th, 2009 - Discovered by: Juan Galiana Lara - CVE ID: CVE-2009-3701 - Severity: 6.3/10 CVSS Bas...

CVE-2009-3527

CVE-2009-3527: Concrete details exist in connected docs. A race condition in FreeBSD 6.3/6.4’s Pipe (IPC) close function can lead to a use-after-free via kqueues, causing local denial of service (crash) or privilege gain through NULL pointer dereference/memory corruption. Affected software: FreeB...

CVE-2009-1729

Multiple cross-site scripting XSS vulnerabilities in Sun Java System Communications Express 6 2005Q4 aka 6.2 and 6.3 allow remote attackers to inject arbitrary web script or HTML via 1 the abpersondisplayName parameter to uwc/abs/search.xml in the Add Contact implementation in the Personal Addres...

WordPress MU < 2.7 - 'HOST' HTTP Header Cross-Site Scripting

============================================= INTERNET SECURITY AUDITORS ALERT 2009-004 - Original release date: December 3rd, 2008 - Last revised: March 10th, 2009 - Discovered by: Juan Galiana Lara - Severity: 6.3/10 CVSS scored ============================================= I. VULNERABILITY...