7434 matches found
CVE-2010-1415
WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, does not properly handle libxml contexts, allows remote attackers to execute arbitrary code or cause a denial of service application crash via a crafted HTML document, related to an "API...
CVE-2010-1415
Removed by vendor...
CVE-2010-1415
WebKit vulnerability CVE-2010-1415 affects Safari prior to 5.0 on Mac OS X 10.5–10.6 and Windows, and prior to 4.1 on Mac OS X 10.4. It stems from improper handling of libxml contexts in WebKit, described as an API abuse issue. Consequences described: remote attackers could execute arbitrary code...
Wing FTP Server <= 3.5.0 'admin_loginok.html' HTML Injection Vulnerability
Wing FTP Server is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...
Pluggable CAPTCHA
panel:bgColor=e7f4fa NOTE: This suggestion is for JIRA Server. Using JIRA Cloud? See the corresponding suggestion|http://jira.atlassian.com/browse/JRACLOUD-21359. panel CAPTCHA should be pluggable in JIRA CAPTCHA|http://en.wikipedia.org/wiki/CAPTCHA is supposed to stop spam and other automated...
eScan MWAdmin Interface Detection
MWAdmin, a web interface included with multiple Linux-based eScan products, was detected on the remote host. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid45344; scriptversion"1.9"; scriptcvsdate"Date: 2019/11/25"; scriptnameenglish:"eScan MWAdmin Interface...
Vulnerabilities in DataLife Engine
Здравствуйте 3APA3A! Сообщаю вам о найденных мною Abuse of Functionality и Insufficient Anti-automation уязвимостях в DataLife Engine DLE. Abuse of Functionality: http://site/index.php?do=register На странице регистрации функция "Проверить имя" позволяет выявить логины пользователей в системе...
Vulnerabilities in vBulletin
Здравствуйте 3APA3A! Сообщаю вам о найденных мною Abuse of Functionality и Insufficient Anti-automation уязвимостях в vBulletin. Abuse of Functionality: Логины пользователей являются их именами на форуме, что позволяет выявить логины в системе. Abuse of Functionality: На странице...
U.S. Congress Websites Defaced
A number of Congressional websites were defaced with abuse aimed at President Obama following Wednesday’s State of the Union address. Read the full article. The Register...
CGI Generic SQL Injection (blind, time based)
By sending specially crafted parameters to one or more CGI scripts hosted on the remote web server, Nessus was able to get a slower response, which suggests that it may have been able to modify the behavior of the application and directly access the underlying database. An attacker may be able to...
Vulnerabilities in plugins for WordPress
Hello Bugtraq! I want to tell you about different vulnerabilities in plugins for WordPress. About some of them there were posts to the list earlier. This August I made a summary about all vulnerabilities in plugins for WordPress http://websecurity.com.ua/3397/, which I found during 2006-2009. In...
The Story of the First Internet Worm
Robert Tappan Morris was the first person convicted by a jury under the Computer Fraud and Abuse Act of 1986. The story of the worm he created and what happened to him after it was released is a tale of mistakes, infamy, and ultimately the financial and professional success of its author. Read th...
CVE-2009-3780
Cross-site scripting XSS vulnerability in Abuse 5.x before 5.x-2.1 and 6.x before 6.x-1.1-alpha1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2009-3780
CVE-2009-3780 affects the Abuse module for Drupal, with vulnerable releases: Abuse 5.x prior to 5.x-2.1 and 6.x prior to 6.x-1.1-alpha1. The vulnerability is a Cross-site Scripting (XSS) issue that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The descrip...
CVE-2009-3780
Cross-site scripting XSS vulnerability in Abuse 5.x before 5.x-2.1 and 6.x before 6.x-1.1-alpha1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
SA-CONTRIB-2009-081 - Abuse - Cross Site Scripting
The Abuse module enables users to flag nodes and comments as offensive, bringing them to the attention of the site maintainer for review. The module suffers from a Cross Site Scripting Cross Site Scripting vulnerability. Such an attack may lead to a malicious user gaining full administrative...
Insufficient Anti-automation and Abuse of Functionality vulnerabilities in ALFcontact for Joomla
Здравствуйте 3APA3A! Сообщаю вам о найденных мною Insufficient Anti-automation и Abuse of Functionality уязвимостях в компоненте ALFcontact comalfcontact для Joomla. Insufficient Anti-automation: http://site/option,comalfcontact/ На странице контактов нет защиты от автоматизированных запросов...
acroread: Multiple DoS fixes in 8.1.7 (APSB09-15)
Stack consumption vulnerability in Adobe Reader and Acrobat 9.1.3, 9.1.2, 9.1.1, and earlier 9.x versions; 8.1.6 and earlier 8.x versions; and possibly 7.1.4 and earlier 7.x versions allows remote attackers to cause a denial of service application crash via a PDF file with a large number of open...
Geeklog <= 1.6.0sr1 Remote Arbitrary File Upload Vulnerability
No description provided by source. ============================================================================== Geeklog = v1.6.0sr1 - Remote Arbitrary File Upload Software Site: http://www.geeklog.net Dork: "By Geeklog" "Created this page in" +seconds +powered inurl:publichtml...
Geeklog 1.6.0sr1 - Arbitrary File Upload
Geeklog 1.6.0sr1 - Arbitrary File Upload ============================================================================== Geeklog = v1.6.0sr1 - Remote Arbitrary File Upload Software Site: http://www.geeklog.net Dork: "By Geeklog" "Created this page in" +seconds +powered inurl:publichtml...