10929 matches found
Habari CMS 0.9.2 Cross Site Scripting Vulnerability
Habari CMS version 0.9.2 suffers from a cross site scripting vulnerability. Document Title: =============== Habari CMS v0.9.2 - Backend Comments XSS Vulnerability Product & Service Introduction: =============================== While there are a number of technical reasons that highlight the...
Insecure Unserialize and SQL Injection in extension "Code Highlighter" (mh_code_highlighter)
It has been discovered that the extension "Code Highlighter" mhcodehighlighter is susceptible to Insecure Unserialize and SQL Injection. Release Date: November 14, 2016 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: versio...
Multiple vulnerabilities in extension "TC Directmail " (tcdirectmail)
It has been discovered that the extension "TC Directmail " tcdirectmail is susceptible to Cross Site-Scripting and SQL Injection. Release Date: November 11, 2016 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: version 3.1.1...
Server: SMB User Authentication Bypass
ownCloud includes an optional and not by default enabled SMB authentication component that allows to authenticate users against an SMB server. This backend is implemented in a way that it tries to connect to a SMB server and if that succeeded consider the user logged-in. The backend did not...
Habari CMS v0.9.2 - (Backend Comments) XSS Vulnerability
Document Title: =============== Habari CMS v0.9.2 - Backend Comments XSS Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1999 Release Date: ============= 2016-11-09 Vulnerability Laboratory ID VL-ID: ==================================== 19...
sudo security, bug fix, and enhancement update
1.8.6p7-20 - RHEL 7.3 erratum - fixed visudo's -q flag Resolves: rhbz1350828 1.8.6p7-19 - RHEL 7.3 erratum - removed INPUTRC from envkeep to prevent a potential info leak Resolves: rhbz1340700 1.8.6p7-18 - RHEL 7.3 erratum - removed requiretty flag from the default sudoers policy - backported...
Habari CMS v0.9.2 - (Backend Comments) XSS Vulnerability
Document Title: =============== Habari CMS v0.9.2 - Backend Comments XSS Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1999 Release Date: ============= 2016-11-09 Vulnerability Laboratory ID VL-ID: ==================================== 19...
SQL Injection Vulnerability in Background Management System of Zhongyi Design Studio
Zhongyi Design Studio Backend Management System is a website building system. The loginName parameter of the CEE Design Studio backend management system has a SQL injection vulnerability parameter that allows attackers to exploit the vulnerability to obtain sensitive information from the database...
Weak Password Vulnerability in NetSense Information Security Audit System
NetShen Security Audit System is a hardened computer that can defend against attacks with strong security protection. A weak password vulnerability exists in the NetShen Information Security Audit System, which allows an attacker to exploit the vulnerability to log in to the system's backend and...
Information Disclosure Vulnerability in IceFlow VPN Router
ICEFLOW VPN is a new generation of IPSEC-based Layer 3 intelligent router products developed by Shanghai Bingfeng Networks in response to the actual needs of modern enterprise and public utility users. There is an information leakage vulnerability in IceFlow VPN Router. Attackers can use the...
Multiple SQL Injection Vulnerabilities in Douphp Backend
Douphp is a lightweight enterprise website management system, based on PHP+Mysql architecture, running on Linux, Windows, MacOSX, Solaris and other platforms. Douphp background there are a number of SQL injection vulnerabilities, 1 due to the background is not sufficient to filter the parameters...
XenMobile 10 MDM SSL Offload Configuration
A Citrix XenMobile environment is typically configured with a NetScaler appliance that front ends and load balances the MDM traffic which it passes on to the XenMobile Servers in the backend. This NetScaler can be configured to handle this traffic in either SSL Bridge or SSL Offload mode. Though...
SQL injection vulnerability in mallbuilder background admin/index.php page
MallBuilder is a multi-user online shopping mall solution system based on PHP+MYSQL. A SQL injection vulnerability exists in the admin/index.php page of the mallbuilder backend, which allows attackers to exploit the vulnerability to obtain sensitive database information...
X-Forwarded-For Header Insert
Use Case X-Forwarded-For header can be used to pass the Client IP information to the backend server. When HTTP request contains X-Forwarded-For header, the values will be replaced with single client IP address. If there is no X-Forwarded-For header, it will be added and assigned with the client I...
RDL Web Tasarim Administration Page Authentication Bypass Vulnerability
An authentication bypass vulnerability exists in the RDL Web Tasarim administrator page, which could allow an attacker to bypass login authentication to access backend administration pages...
Updated pdns packages fix security vulnerability
PowerDNS Authoritative Server accepts queries with a qname's length larger than 255 bytes CVE-2016-5426. PowerDNS Authoritative Server does not properly handle dot inside labels CVE-2016-5427. These issues allow a remote, unauthenticated attacker to cause an abnormal load on the PowerDNS backend ...
Error in handleInterruptedCoalesceLeaf when trying to scan the Storage on XenServer
Error in XenCenter - SR failed to complete the operation Error in /var/log/SMlog -25840 2012-12-14 10:52:35.402274 lock: released /var/lock/sm/lvm-579fdc35-f120-398e-397e-b12179c9531c/83b6fcfd-e9ed-432b-b662-d8d28f9ccca525840 2012-12-14 10:52:35.402380 lock: closed...
Weak Password Vulnerability in Netnifty Security Management System - Log Audit System by Default
Netnifty Security Management System - Log Audit System hereinafter referred to as Leadsec-RS is a security product for information system log auditing. A weak password vulnerability exists in the Leadsec-RS. The system administrator account password is: sysadmin/leadsec.sysadmin allows an attacke...
openSUSE Security Update : pdns (openSUSE-2016-1103)
This update for pdns fixes the following issues : - CVE-2016-5426, CVE-2016-5427: Fix case where crafted queries can cause unexpected backend load. boo998159 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE...
