675 matches found
Palo Alto Traps Server 3.1.2.1546 - Persistent Cross-Site Scripting
!/usr/bin/ruby =begin ------------------------------------------------------------------------ Product: Palo Alto Traps Server formerly Cyvera Endpoint Protection Vendor: Palo Alto Networks Vulnerable Versions: 3.1.2.1546 Tested Version: 3.1.2.1546 Advisory Publication: 29 March 2015 Vendor...
CVE-2014-3619
CVE-2014-3619 affects GlusterFS, specifically the __socket_proto_state_machine in GlusterFS 3.5, where a crafted 00000000 fragment header can trigger a remote denial of service via an infinite loop. Multiple connected sources confirm the root cause in the network handling path and document that a...
724CMS 5.01 / 4.59 / 4.01 / 3.01 Directory Traversal
724CMS 5.01 Directory Path Traversal Security Vulnerabilities Exploit Title: 724CMS /section.php Module Parameter Directory Traversal Security Vulnerabilities Vendor: 724CMS Product: 724CMS Vulnerable Versions: 3.01 4.01 4.59 5.01 Tested Version: 5.01 Advisory Publication: March 14, 2015 Latest...
Innovative WebPAC Pro 2.0 Open Redirect
Innovative WebPAC Pro 2.0 Unvalidated Redirects and Forwards URL Redirection Security Vulnerabilities Exploit Title: Innovative WebPAC Pro 2.0 /showres url parameter URL Redirection Security Vulnerabilities Vendor: Innovative Interfaces Inc Product: WebPAC Pro Vulnerable Versions: 2.0 Tested...
NetCat CMS 5.01 / 3.12 Full Path Disclosure
NetCat CMS Full Path Disclosure Information Disclosure Security Vulnerabilities Exploit Title: NetCat CMS Full Path Disclosure Security Vulnerabilities Product: NetCat CMS Content Management System Vendor: NetCat Vulnerable Versions: 5.01 3.12 3.0 2.4 2.3 2.2 2.1 2.0 1.1 Tested Version: 5.01 3.12...
Tuleap 7.6-4 PHP Object Injection
----------------------------------------------------------------- Tuleap route$request; 35. exit; 36. 37. 38. $currentstep = $request-exist'currentstep' ? $request-get'currentstep' : 0; 39. $data = $request-exist'data' ? unserialize$request-get'data' : array; User input passed through the "data"...
SoX - (.wav) Local Buffer Overflow Exploiter
No description provided by source. //--------------------------------- Begin Code: sox-exploiter.c --------------------------------- / Copyright Rosiello Security 2004 http://www.rosiello.org CVE Reference: CAN-2004-0557 Bug Type: Stack Overflow Date: 01/08/2004 Ulf Harnhammar reported that there...
Barter Sites 1.3 Joomla Component Multiple Vulnerabilities
No description provided by source. Barter Sites 1.3 Component Joomla SQL Injection & Persistent XSS vulnerabilities Release Date Bug. 28-Oct-2011 Date Added. 01-Oct-2011 Vendor Notification Date. Never Product. Barter Sites Platform. Joomla Affected versions. 1.3 Type. Commercial Price. $99 Attac...
HP OpenView Network Node Manager <= 7.50 Remote Exploit
No description provided by source. / Web Browser info: /OvCgi/connectedNodes.ovpl?node=a|command| /str0ke / / HP OpenView Network Node Manager 6.2, 6.4, 7.01, 7.50 Remote Command Execution Name: HP OV NNM Remote Command Execution Exploit File: HPOVNNMRCE.c Description: Exploit Author: Lympex...
CVE-2013-7353
Integer overflow in the pngsetunknownchunks function in libpng/pngset.c in libpng before 1.5.14beta08 allows context-dependent attackers to cause a denial of service segmentation fault and crash via a crafted image, which triggers a heap-based buffer overflow...
Netgear D6300B Command Injection / Misconfiguration
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Advisory ID: SYSS-2013-001 Product: NETGEAR Router D6300B / Firmware: V1.0.0.141.0.14 latest Vendor: Netgear Affected Versions: until V1.0.0.141.0.14 latest Tested Versions: V1.0.0.141.0.14 latest Vulnerability Type: Root-Shell, OS Command Injection,...
DeWeS 0.4.2 - Directory Traversal
Advisory ID: HTB23167 Product: DeWeS web server Twilight CMS Vendor: Strata Technologies LLC Vulnerable Versions: 0.4.2 and probably prior Tested Version: 0.4.2 Vendor Notification: July 24, 2013 Public Disclosure: August 21, 2013 Vulnerability Type: Path Traversal CWE-22 CVE Reference:...
Cotonti 0.9.13 SQL Injection
Advisory ID: HTB23164 Product: Cotonti Vendor: Cotonti Team Vulnerable Versions: 0.9.13 and probably prior Tested Version: 0.9.13 Vendor Notification: July 10, 2013 Vendor Patch: July 17, 2013 Public Disclosure: July 31, 2013 Vulnerability Type: SQL Injection CWE-89 CVE Reference: CVE-2013-4789...
php security, bug fix and enhancement update
5.3.3-22 - php-xml provides php-xmlreader and php-xmlwriter 874987 - fix possible NULL derefence and buffer overflow 879179 - fix zend garbage collector 848186, 868375 5.3.3-21 - fix CVE reference in previous changelog entry 5.3.3-20 - remove reproducer from security fix for CVE-2012-0781 5.3.3-1...
DEBIAN-CVE-2013-1624
The TLS implementation in the Bouncy Castle Java library before 1.48 and C library before 1.8 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attack...
Buffalo Linkstation Privilege Escalation
Release Date. 5-Dec-2012 Last Update. - Vendor Notification Date. - Product. Linkstation & Others Platform. Buffalo Technology Affected versions. Including Actual Version Severity Rating. High Impact. Admin Password Reset Attack Vector. From remote Solution Status. Don't use Buffalo CVE reference...
Joomla! Component Techfolio 1.0 - SQL Injection
Techfolio 1.0 Component Joomla SQL Injection Release Date Bug. 27-Oct-2011 Date Added. 30-Sep-2011 Vendor Notification Date. Never Product. Techfolio Platform. Joomla Affected versions. 1.0 Type. Non-Commercial Attack Vector. Sql Injection Solution Status. unpublished CVE reference. Not yet...
CVE-2011-1971
The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly parse file metadata, which allows local users to cause a denial of service reboot via a crafted file, aka "Windows Kernel Metadata Parsing DOS Vulnerability."...
acroread: multiple XSS flaws (APSB11-03)
Cross-site scripting XSS vulnerability in Adobe Reader and Acrobat 10.x before 10.0.1, 9.x before 9.4.2, and 8.x before 8.2.6 on Windows and Mac OS X allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2011-0604...
