9633 matches found
WordPress <= 4.4.0 - Multiple XSS
Multiple cross site scripting vulnerabilities were found in wp-includes/class-wp-theme.php. These vulnerabilities allow the attackers to inject arbitrary web script or HTML via a 1. stylesheet name or 2. template name to wp-admin/customize.php. Solution Upgrade WordPress...
Joomla 3.4.3 version SQL injection vulnerability analysis-vulnerability warning-the black bar safety net
0x00 vulnerability analysis Vulnerability trigger code is located at:/administrator/components/comcontenthistory/models/history.php, the getListQueryfunction: ! 4cf1a8d2985c5601fbdeb7a9e4a09234077751bf Through the SQL and the error message, you can know that our injected payload is inserted into...
Java deserialization vulnerability of the weblogic local use to achieve article-vulnerability warning-the black bar safety net
weblogic in the domestic scope of application more widely, supporting many of the company's core business, it has not put the weblogic to use the tool to publish it. However, many recent Party a friend asked me if I had a convenient tool to detect their companies deployed in the network of...
Drupal Block Class Module HTML Injection Vulnerability
Drupal is the Drupal community maintained by a set of free, open source content management system developed in PHP. Block Class is one of the administrator through the Block configuration interface to add CSS to any Block module . An HTML injection vulnerability exists in Drupal Block Class modul...
PHP 7.0.0 - Format String
Overview -------------------------------------------- A fun little format string vulnerability exists in PHP 7.0.0 due to how non-existent class names are handled. From my limited research I believe this issue is likely exploitable for full code execution see test script below. This issue does no...
CVE-2015-6481
The login function in the RequestController class in Moxa OnCell Central Manager before 2.2 has a hardcoded root password, which allows remote attackers to obtain administrative access via a login session...
CVE-2015-6481
The login function in the RequestController class in Moxa OnCell Central Manager before 2.2 has a hardcoded root password, which allows remote attackers to obtain administrative access via a login session...
apache-commons-collections: InvokerTransformer code execution during deserialisation
It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections...
ISC BIND 9.x < 9.9.8-P2 / 9.10.x < 9.10.3-P2 Response Parsing Class Attribute Handling DoS
According to its self-reported version number, the remote installation of BIND is affected by a denial of service vulnerability due to improper parsing of incorrect class attributes in db.c. An unauthenticated, remote attacker can exploit this, via a malformed class attribute, to trigger a REQUIR...
ISC BIND named Denial of Service Vulnerability
ISC BIND is the United States Internet Systems Consortium ISC company maintains a set of open source software that implements the DNS protocol. A security vulnerability exists in the db.c file in named in ISC BIND versions 9.9.8-P2 prior to 9.x and 9.10.3-P2 prior to 9.10.x. The vulnerability can...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in information popups in Foreman before 1.10.0 allow remote attackers to inject arbitrary web script or HTML via 1 global parameters, 2 smart class parameters, or 3 smart variables in the a host or b hostgroup edit forms...
3 6 0 Free WIFI encryption signature crack get the others Wi-plaintext-password-vulnerability warning-the black bar safety net
| Vulnerability title | 3 6 0 Free WIFI encryption signature crack get the others Wi plaintext passwordyou can also brush the gold exchange carriers flow ---|--- Relevant vendor | qihoo 3 6 0 The vulnerability of the author | thin Jiao dance Submit time | 2015-09-17 1 6:3 0 Open time | 2015-12-16...
PT-2015-7560 · Foreman · Foreman
Name of the Vulnerable Software and Affected Versions: Foreman versions prior to 1.10.0 Description: The issue allows remote attackers to inject arbitrary web script or HTML via global parameters, smart class parameters, or smart variables in the host or hostgroup edit forms, potentially leading ...
CVE-2015-7518: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in information popups in Foreman before 1.10.0 allow remote attackers to inject arbitrary web script or HTML via 1 global parameters, 2 smart class parameters, or 3 smart variables in the a host or b hostgroup edit forms...
Debian DLA-370-1 : bind9 security update
It was discovered that the BIND DNS server does not properly handle the parsing of incoming responses, allowing some records with an incorrect class to be accepted by BIND instead of being rejected as malformed. This can trigger a REQUIRE assertion failure when those records are subsequently...
bind: responses with a malformed class attribute can trigger an assertion failure in db.c
A denial of service flaw was found in the way BIND processed certain records with malformed class attributes. A remote attacker could use this flaw to send a query to request a cached record with a malformed class attribute that would cause named functioning as an authoritative or recursive serve...
bind: responses with a malformed class attribute can trigger an assertion failure in db.c
A denial of service flaw was found in the way BIND processed certain records with malformed class attributes. A remote attacker could use this flaw to send a query to request a cached record with a malformed class attribute that would cause named functioning as an authoritative or recursive serve...
bind: responses with a malformed class attribute can trigger an assertion failure in db.c
A denial of service flaw was found in the way BIND processed certain records with malformed class attributes. A remote attacker could use this flaw to send a query to request a cached record with a malformed class attribute that would cause named functioning as an authoritative or recursive serve...
DEBIAN-CVE-2015-8000
db.c in named in ISC BIND 9.x before 9.9.8-P2 and 9.10.x before 9.10.3-P2 allows remote attackers to cause a denial of service REQUIRE assertion failure and daemon exit via a malformed class attribute...