mantis -- multiple vulnerabilities

Mantis reports: Roland Becker and Damien Regad MantisBT developers found that any user able to report issues via the SOAP interface could also modify any bugnotes comments created by other users. In a default/typical MantisBT installation, SOAP API is enabled and any user can sign up to report ne...

Cross site scripting

Cross-site scripting XSS vulnerability in Roundcube Webmail before 0.7, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via vectors involving an embedded image attachment...

CVE-2012-1253

Cross-site scripting XSS vulnerability in Roundcube Webmail before 0.7, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via vectors involving an embedded image attachment...

Microsoft Wordpad 5.1 - .doc Null Pointer Dereference

Microsoft Wordpad 5.1 - .doc Null Pointer Dereference Microsoft Wordpad 5.1 .doc Null Pointer Dereference Vulnerability Found by condis Tested on Windows XP SP 3 Proffesional PL MS Wordpad 5.1 Compilation 2600.xpsp.080413-2111 SP 3 This isn't bug from CWE 2009-0259 $ Binnary diff of template file...

Threat Outbreak Alert: Fake Annual Conference Notification Email Messages on May 23, 2012

Low Alert ID: 25995 First Published: 2012 May 24 15:58 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam e-mail messages that claim to contain a science conference notification for the recipient. The text in the e-mail message attempts to convince the recipie...

User can upload attachments to restricted pages that adopt restrictions from parent page

Users that should have no access to restricted pages that adopt restrictions from the parent page are able to upload attachments if they know the page ID. How to reproduce: 1. Create 2 users, user1 and user2 2. Create a page with user1 and set the page view and edit restrictions to "Me" 3. Create...

persistent xss through flash swf file attachment download

It is possible to upload a flash swf file which when the attachment 'download' url is visited the flash swf file is executed in the browser and as such can use ExternalInterface.call method to inject javascript defined in the swf file into the browser...

persistent xss through flash swf file attachment download

It is possible to upload a flash swf file which when the attachment 'download' url is visited the flash swf file is executed in the browser and as such can use ExternalInterface.call method to inject javascript defined in the swf file into the browser...

persistent xss through flash swf file attachment download

It is possible to upload a flash swf file which when the attachment 'download' url is visited the flash swf file is executed in the browser and as such can use ExternalInterface.call method to inject javascript defined in the swf file into the browser...

persistent xss through flash swf file attachment download

It is possible to upload a flash swf file which when the attachment 'download' url is visited the flash swf file is executed in the browser and as such can use ExternalInterface.call method to inject javascript defined in the swf file into the browser...

Apple QuickTime MPEG Parsing Memory Corruption

Executive Summary Microsoft is providing notification of the discovery and remediation of a vulnerability affecting Apple QuickTime Player software version 7.7.1 and earlier verisons. Microsoft discovered and disclosed the vulnerability under coordinated vulnerability disclosure to the affected...

Threat Outbreak Alert: Fake Order Request Details Email Messages on May 16, 2012

Low Alert ID: 25938 First Published: 2012 May 16 14:32 GMT Version: 1 Summary Cisco Security has detected significant activity related to German-language spam e-mail messages that claim to contain order request details for the recipient. The text in the e-mail message attempts to convince the...

Threat Outbreak Alert: Fake Terra Greeting Card Notification Email Messages on May 11, 2012

Low Alert ID: 25908 First Published: 2012 May 14 14:50 GMT Version: 1 Summary Cisco Security has detected significant activity related to Spanish-language spam e-mail messages that claim to contain a Terra greeting card for the recipient. The text in the e-mail message attempts to convince the...

persistent xss through svg file attachment download

The fix for CONF-22132 was not sufficient because "svg" files are not "said" to be xml by the isXml method. This means that is possible for a malicious party to upload a svg file containing html/javascript which will be rendered in victim's web browser. This bug should have been raised a while ag...

Proman Xpress 5.0.1 SQL Injection / XSS

Title: ====== Proman Xpress v5.0.1 - Multiple Web Vulnerabilities Date: ===== 2012-05-09 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=513 VL-ID: ===== 512 Common Vulnerability Scoring System: ==================================== 7.5 Introduction: ============= Proman...

Proman Xpress v5.0.1 - Multiple Web Vulnerabilities

Exploit for php platform in category web applications Title: ====== Proman Xpress v5.0.1 - Multiple Web Vulnerabilities Introduction: ============= Proman Xpress v5.0.1 is a super project management script coded in PHP & MySQL. It s highly customizable and is used across industries. No Encryption...

Threat Outbreak Alert: Fake Product Order Quotation Email Messages on July 5, 2015.

Low Alert ID: 25838 First Published: 2012 May 7 17:05 GMT Last Updated: 2015 July 15 12:27 GMT Version: 91 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a product order quotation for the recipient. The text in the email message...

siteserver cms 3.4.5 tasteless vulnerabilities and fixes-vulnerability warning-the black bar safety net

This vulnerability with the original vulnerability approach is very similar to that! To meet the two conditions of the system open up iis6 Register account-the document attachment management-Upload File we create a new layer directory of course before is can be established. the asp directory in t...

CVE-2011-4014

The TAC Case Attachment tool in Cisco Wireless Control System WCS 7.0 allows remote authenticated users to read arbitrary files under webnms/Temp/ via unspecified vectors, aka Bug ID CSCtq86807...

Threat Outbreak Alert: Fake FedEx Parcel Delivery Failure Notification Email Messages on May 11, 2015

Medium Alert ID: 25717 First Published: 2012 April 20 16:52 GMT Last Updated: 2015 May 12 14:46 GMT Version: 70 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a parcel delivery failure notification for the recipient. The text in the...