FCKeditor 2.6.10 Cross Site Scripting

Class Cross-Site Scripting Remote Yes Published 2nd June 2014 Credit Robin Bailey of Dionach [email protected] Vulnerable FCKeditor alertdocument.cookie;//=zz The vendor was notified of this issue, and FCKeditor 2.6.11 was released to address this vulnerability. See the following vendor...

CVE-2012-5395

CVE-2012-5395 affects MediaWiki with the CentralAuth extension; vulnerable centralauth_Session cookie handling allows remote attackers to hijack sessions. Affected versions are MediaWiki before 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1. Root cause is session fixation via CentralAuth,...

CVE-2012-5391

CVE-2012-5391 describes a session fixation vulnerability in MediaWiki's Special:UserLogin. The issue allows remote attackers to hijack user sessions by manipulating the session_id in affected releases. Affected versions are MediaWiki < 1.18.6, < 1.19.3 (1.19.x), and

CVE-2012-5391

Session fixation vulnerability in Special:UserLogin in MediaWiki before 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1 allows remote attackers to hijack web sessions via the sessionid...

Fedora Update for moodle FEDORA-2014-6577

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2012-5572

CRLF injection vulnerability in the cookie method lib/Dancer/Cookie.pm in Dancer before 1.3114 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a cookie name, a different vulnerability than CVE-2012-5526...

CVE-2012-5560

The CVE-2012-5560 entry concerns the package mate-settings-daemon . According to the provided records, the default configuration in version 1.5.3 permits local users to change the system timezone via a crafted D-Bus call. This is documented in the NVD/NVD-derived entry and echoed in multiple down...

CVE-2012-5877

CVE-2012-5877 concerns Nero MediaHome Server (Product: Nero MediaHome, vulnerable through NMMediaServer.dll) with versions up to 4.5.8.0. The available documents describe a denial-of-service via malformed HTTP handling, notably a NULL pointer dereference triggered by ill-formed HTTP headers (e.g....

CVE-2012-5572

CVE-2012-5572 affects Dancer (Perl web framework) via a CRLF injection in the cookie method (lib/Dancer/Cookie.pm). The issue allows remote attackers to inject HTTP headers and perform HTTP response splitting through a crafted cookie name. The vulnerability is in Dancer before 1.3114; remediation...

CVE-2012-5572

CRLF injection vulnerability in the cookie method lib/Dancer/Cookie.pm in Dancer before 1.3114 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a cookie name, a different vulnerability than CVE-2012-5526...

CVE-2012-2539

creationtimestamp| type| source ---|---|--- 2014-05-30 07:06:22+00:00| seen| MISP/53882d9c-46d8-4874-b5d6-9f55950d210b 2020-10-09 16:44:55+00:00| seen| MISP/50fd2b9c-ca64-448d-9bd4-3fe22e5cbdca 2020-10-09 16:57:40+00:00| seen| MISP/f658acf9-8570-49c6-b751-a1d29924d5fe 2023-06-14 21:10:03+00:00|...

CVE-2012-4915

Directory traversal vulnerability in the Google Doc Embedder plugin before 2.5.4 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the file parameter to libs/pdf.php...

CVE-2012-4915

CVE-2012-4915 affects the Google Doc Embedder Plugin for WordPress. A directory-traversal in libs/pdf.php allows remote reading of arbitrary files via .. in the file parameter. Affected plugin versions are older than 2.5.4. Mitigation is to upgrade to 2.5.4 or later (or apply vendor-provided fixe...

CVE-2012-6452

CVE-2012-6452 affects Axway, specifically the Email Firewall deployment using the Secure Messenger component (vulnerable: 6.5 and earlier on EMF). The issue arises because authentication responses differ depending on whether the username exists, allowing remote attackers to enumerate valid userna...

CVE-2012-5662

CVE-2012-5662 affects x3270 before 3.3.12ga12. The vulnerability arises from not verifying that the server hostname matches the CN or subjectAltName in the X.509 certificate, enabling MITM spoofing with arbitrary certificates. No explicit exploit details or in-the-wild status are provided in the ...

CVE-2012-5662

x3270 before 3.3.12ga12 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

Adobe ColdFusion HTTP Response Splitting (APSB12-15) (credentialed check)

The version of Adobe ColdFusion running on the remote host is affected by an HTTP response splitting vulnerability. The coldfusion.filter.ComponentFilter class does not properly sanitize input used in the Location header of an HTTP response. A remote attacker could exploit this by tricking a user...

CVE-2012-6647

The futexwaitrequeuepi function in kernel/futex.c in the Linux kernel before 3.5.1 does not ensure that calls have two different futex addresses, which allows local users to cause a denial of service NULL pointer dereference and system crash or possibly have unspecified other impact via a crafted...

CVE-2012-6647

The CVE-2012-6647 issue affects the Linux kernel futex_wait_requeue_pi implementation in kernel/futex.c, vulnerable in versions before 3.5.1. The flaw allows a local attacker to cause a denial of service via a crafted FUTEX_WAIT_REQUEUE_PI command resulting in a NULL pointer dereference and syste...

CVE-2012-3333

CVE-2012-3333 affects IBM Maximo Asset Management and SmartCloud Control Desk via a CRLF injection that allows HTTP header manipulation and HTTP response splitting through crafted URL parameters. Affected products include Maximo Asset Management and related variants across 7.5/7.1/6.2 lines and S...