Adobe Presenter viewer.swf and loadflash.js XSS Vulnerability

The host is running Adobe Presenter, which prone to to input validation errors which can be exploited by malicious people to conduct cross-site scripting vulnerability. OpenVAS Vulnerability Test $Id: secpodadobepresenterxssvuln900110.nasl 5370 2017-02-20 15:24:26Z cfi $ Description: Adobe...

SA-2008-047 - Drupal core - Multiple vulnerabilities

Multiple vulnerabilities and weaknesses were discovered in Drupal. Cross site scripting A bug in the output filter employed by Drupal makes it possible for malicious users to insert script code into pages cross site scripting or XSS. A bug in the private filesystem trusts the MIME type sent by th...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 free tagging taxonomy terms, which are not properly handled on node preview pages, and 2 unspecified OpenID values...

Cross site scripting

The Drupal filterxssadmin function in 5.x before 5.8 and 6.x before 6.3 does not "prevent use of the object HTML tag in administrator input," which has unknown impact and attack vectors, probably related to an insufficient cross-site scripting XSS protection mechanism...

CVE-2008-3223

SQL injection vulnerability in the Schema API in Drupal 6.x before 6.3 allows remote attackers to execute arbitrary SQL commands via vectors related to "an inappropriate placeholder for 'numeric' fields."...

CVE-2008-3220

Cross-site request forgery CSRF vulnerability in Drupal 5.x before 5.8 and 6.x before 6.3 allows remote attackers to perform administrative actions via vectors involving deletion of "translated strings."...

CVE-2008-3219

The Drupal filterxssadmin function in 5.x before 5.8 and 6.x before 6.3 does not "prevent use of the object HTML tag in administrator input," which has unknown impact and attack vectors, probably related to an insufficient cross-site scripting XSS protection mechanism...

CVE-2008-3221

Cross-site request forgery CSRF vulnerability in Drupal 6.x before 6.3 allows remote attackers to perform administrative actions via vectors involving deletion of OpenID identities...

CVE-2008-3223

SQL injection vulnerability in the Schema API in Drupal 6.x before 6.3 allows remote attackers to execute arbitrary SQL commands via vectors related to "an inappropriate placeholder for 'numeric' fields."...

CVE-2008-3218

CVE-2008-3218 affects Drupal 6.x before 6.3, with XSS via free-tagging taxonomy terms on node previews and unspecified OpenID values. Remote attackers can inject arbitrary script/HTML. Connected advisories indicate remediation by upgrading to Drupal 6.4 (and related updates); no exploitation deta...

CVE-2008-2794

Unspecified vulnerability in the GUI in Symantec Altiris Notification Server Agent 6.x before 6.0 SP3 R8 allows local users to gain privileges via unknown attack vectors...

Cisco IPS平台Inline模式拒绝服务漏洞

BUGTRAQ ID: 29791 CVECAN ID: CVE-2008-2060 Cisco入侵保护系统是网络安全设备中的一部分，可提供基于网络的威胁防范服务。 某些Cisco IPS平台在处理巨型以太网报文时存在拒绝服务漏洞。如果以inline模式所部署的有漏洞Cisco IPS平台的千兆网口接收到了特定的巨型以太网帧的话，就会出现内核忙碌，导致平台完全失效和网络拒绝服务的情况。仅以混杂模式部署的平台或没有千兆网口的平台不受漏洞影响。 成功利用本文所述的漏洞可能导致网络拒绝服务，必须断电才能恢复运行。Cisco IPS...

CVE-2008-2773

Cross-site scripting XSS vulnerability in the Taxonomy Image module 5.x before 5.x-1.3 and 6.x before 6.x-1.3, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2008-1743

The CVE-2008-1743 issue affects Cisco Unified Communications Manager (CUCM) 5.x (before 5.1(3)) and 6.x (before 6.1(1)). It is a memory-leak denial-of-service in the Certificate Trust List (CTL) Provider service triggered by a series of malformed TCP packets, with CTL Provider listening on TCP 24...

CVE-2008-1745

Cisco Unified Communications Manager (CUCM) is affected by CVE-2008-1745. A DoS can be triggered by receiving a malformed SIP JOIN header, impacting CUCM 5.x before 5.1(2) and 6.x before 6.1(1). The SIP processing path is a known vulnerability area; related advisories indicate this is a denial of...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in E-Publish 5.x before 5.x-1.1 and 6.x before 6.x-1.0 beta1, a Drupal module, allows remote attackers to perform unauthorized actions as other users via unspecified vectors...

CVE-2008-0636

Level Platforms, Inc. (LPI) Managed Workplace Service Center versions 4.x–6.x expose_version and patch information via a direct request to About/SC_About.htm, enabling information disclosure to remote attackers. The underlying vulnerability is an information-leak through an unprotected About page...

Novell Groupwise Windows客户端API非授权邮件访问漏洞

BUGTRAQ ID: 18716 CVECAN ID: CVE-2006-3268 Novell GroupWise是一款跨平台协作软件。 Novell GroupWise的客户端API实现上存在漏洞，攻击者可能利用漏洞绕过安全限制，访问某些非授权的邮件。 Novell Groupwise 7.x Novell Groupwise 6.x Novell Groupwise 5.x 厂商补丁： Novell ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： GroupWise 6.5: Apply SP6 Client Update 1...

MS Internet Explorer (createTextRang) Download Shellcoded Exploit

No description provided by source. / Internet Explorer "createTextRang" Download Shellcoded Exploit Bug discovered by Computer Terrorism UK http://www.computerterrorism.com/research/ct22-03-2006 Reliable exploitation by Darkeagle of Unl0ck Research Team http://www.milw0rm.com/exploits/1606...

PR06-08: BEA Plumtree portal internal hostname disclosure vulnerability

PR06-08: BEA Plumtree portal internal hostname disclosure vulnerability Description: BEA Plumtree portal is vulnerable to a internal hostname disclosure vulnerability. The internal hostname of the server hosting BEA Plumtree portal is always included at the bottom of every requested HTML page...