Elite Bulletin Board 2.1.21 SQL Injection Vulnerability

Elite Bulletin Board version 2.1.21 suffers from multiple remote SQL injection vulnerabilities. Product: Elite Bulletin Board Vendor: elite-board.us Vulnerable Versions: 2.1.21 and probably prior Tested Version: 2.1.21 Vendor Notification: November 28, 2012 Vendor Patch: December 6, 2012 Public...

Security release: Symfony 2.0.20 and 2.1.5 released

Log in to add a reaction to this post add a reaction ❤️ 👍 🚀 Symfony 2.0.20 and Symfony 2.1.5 have just been released and they both contain two security fixes. CVE-2012-6431: Routes behind a firewall are accessible even when not logged in Affected versions All versions from 2.0.0 to 2.0.19 are...

Cross site scripting

Cross-site scripting XSS vulnerability in screens/base/webauthcustom.html on Cisco Wireless LAN Controller WLC devices with software 7.2.110.0 allows remote authenticated users to inject arbitrary web script or HTML via the headline parameter, aka Bug ID CSCud65187, a different vulnerability than...

CVE-2012-5690

RealNetworks RealPlayer before 16.0.0.282 and RealPlayer SP 1.0 through 1.1.5 allow remote attackers to execute arbitrary code via a RealAudio file that triggers access to an invalid pointer...

CVE-2012-5691

Buffer overflow in RealNetworks RealPlayer before 16.0.0.282 and RealPlayer SP 1.0 through 1.1.5 allows remote attackers to execute arbitrary code via a crafted RealMedia file...

CVE-2012-5967

SQL injection vulnerability in menuXML.php in Centreon 2.3.3 through 2.3.9-4 fixed in Centreon web 2.6.0 allows remote authenticated users to execute arbitrary SQL commands via the menu parameter...

CVE-2012-5177

Cross-site scripting XSS vulnerability in the Welcart plugin before 1.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-4431

org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery CSRF protection mechanism via a request that lacks a session identifier...

CVE-2012-4848

IBM Lotus Foundations Start before 1.2.2c contains multiple cross-site scripting (XSS) vulnerabilities that allow remote authenticated users to inject arbitrary web script or HTML via the Webconfig Users user-attribute fields (First Name or Last Name). The underlying issue is XSS in the affected ...

CVE-2012-5991

CVE-2012-5991 affects Cisco Wireless LAN Controller 7.2.110.0. The issue arises from insufficient validation of user-supplied input to the WLC web interface (web_auth_custom.html), enabling remote authenticated users to cause a denial of service (device reload) via a crafted buttonClicked value i...

CVE-2012-4846

CVE-2012-4846 is corroborated by OpenVAS entries describing IBM Lotus Notes Web Application XSS vulnerabilities across Linux, Windows, and Mac OS X. The OpenVAS tests (IDs 803216, 803215, 1361412562310803218, 1361412562310803215, 1361412562310803218) associate the CVE with an XSS issue in the Lot...

CVE-2012-5177

CVE-2012-5177 describes a cross-site scripting (XSS) vulnerability in the WordPress Welcart plugin prior to 1.2.2. The issue allows remote attackers to inject arbitrary script/HTML on the management page via unspecified vectors. Affected software: Welcart for WordPress (versions

CVE-2012-6007

Cisco Wireless LAN Controller (WLC) devices running software 7.2.110.0 are affected by CVE-2012-6007, a cross-site scripting (XSS) vulnerability in screens/base/web_auth_custom.html. The issue allows remote authenticated users to inject arbitrary web script or HTML via the headline parameter (Bug...

CVE-2012-5967

Centreon 2.3.3 through 2.3.9-4 contains a blind SQL injection in menuXML.php via the menu parameter. Exploitation requires an authenticated remote user and can lead to arbitrary SQL execution against the back-end DB. The issue is mitigated by upgrading to Centreon Web 2.6.0 or Centreon 2.4.0+ (pe...

CVE-2012-5969

Affected product/impact (as per provided documents): Huawei E585 pocket wifi 2 device suffers multiple directory traversal vulnerabilities (CVE-2012-5969) that allow remote attackers on the LAN side to read files (via .. in PATH_INFO of an sdcard/ request) or modify files (via .. in the req_page ...

CVE-2012-4431

CVE-2012-4431 affects Apache Tomcat 6.x earlier than 6.0.36 and 7.x earlier than 7.0.32. The vulnerability resides in CsrfPreventionFilter, allowing remote attackers to bypass CSRF protection via a request that lacks a session identifier. The connected documents confirm the affected component pat...

CVE-2012-5178

Cross-site request forgery CSRF vulnerability in the Welcart plugin before 1.2.2 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that complete a purchase...

CVE-2012-5690

CVE-2012-5690 affects RealNetworks RealPlayer before 16.0.0.282 and RealPlayer SP 1.0–1.1.5. The root cause is a flaw in processing RealAudio data that can trigger access to an invalid pointer, allowing remote code execution. The vulnerability is exploitable by a crafted RealAudio file sent over ...

CVE-2012-5967

SQL injection vulnerability in menuXML.php in Centreon 2.3.3 through 2.3.9-4 fixed in Centreon web 2.6.0 allows remote authenticated users to execute arbitrary SQL commands via the menu parameter...

CVE-2012-5978

CVE-2012-5978 describes directory traversal in VMware View components: View Connection Server and View Security Server. A remote, unauthenticated attacker can read arbitrary files via crafted URLs due to the tunnel-server not validating that requested URLs stay within web root and are permitted f...