HP Easy Printer Care XMLCacheMgr Class ActiveX Control Remote Code Execution

This module allows remote attackers to place arbitrary files on a users file system by abusing the "CacheDocumentXMLWithId" method from the "XMLCacheMgr" class in the HP Easy Printer HPTicketMgr.dll ActiveX Control HPTicketMgr.dll 2.7.2.0. Code execution can be achieved by first uploading the...

DEBIAN-CVE-2011-4782

Cross-site scripting XSS vulnerability in libraries/config/ConfigFile.class.php in the setup interface in phpMyAdmin 3.4.x before 3.4.9 allows remote attackers to inject arbitrary web script or HTML via the host parameter...

Facebook Ward III - SQL Injection Vulnerability

Document Title: =============== Facebook Ward III - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=333 Release Date: ============= 2011-12-18 Vulnerability Laboratory ID VL-ID: ==================================== 334 Product...

Facebook Fit-ify! - SQL Injection Vulnerability

Document Title: =============== Facebook Fit-ify! - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=337 Release Date: ============= 2011-12-17 Vulnerability Laboratory ID VL-ID: ==================================== 337 Common...

PHPCMS V9 (plugin.php)本地文件包含漏洞

由于文件/plugin.php对于用户提交的变量未过滤，导致本地文件包含漏洞的产生。 相关代码如下： 文件plugin.php ifisset$GET'id' list$identification, $filename,$action = explode'-', $GET'id'; $filename = !empty$filename ? $filename : $identification; $action = !empty$action ? $action : 'init'; $cache = getcache$identification,'plugins';...

Microsoft Internet Explorer Multiple Information Disclosure Vulnerabilities

The host is installed with Internet Explorer and is prone to multiple information disclosure vulnerabilities. OpenVAS Vulnerability Test $Id: gbmsiemultinfodiscvuln.nasl 6526 2017-07-05 05:43:52Z cfischer $ Microsoft Internet Explorer Multiple Information Disclosure Vulnerabilities Authors: Soora...

HP Facing Class Action Suit For Not Disclosing Printer Vulnerability

A class action lawsuit filed in U.S. District Court in California against Hewlett-Packard could have wide ranging implications for software makers, should the court agree with the plaintiff’s claim that the company violated the state’s consumer protection laws by failing to disclose a serious...

Design/Logic Flaw

The Cascading Style Sheets CSS implementation in Google Chrome 4 does not properly handle the :visited pseudo-class, which allows remote attackers to obtain sensitive information about visited web pages via a crafted HTML document. NOTE: this may overlap CVE-2010-2264...

CVE-2010-5069

The Cascading Style Sheets CSS implementation in Google Chrome 4 does not properly handle the :visited pseudo-class, which allows remote attackers to obtain sensitive information about visited web pages via a crafted HTML document. NOTE: this may overlap CVE-2010-2264...

CVE-2002-2436

The Cascading Style Sheets CSS implementation in Mozilla Firefox before 4.0, Thunderbird before 3.3, and SeaMonkey before 2.1 does not properly handle the :visited pseudo-class, which allows remote attackers to obtain sensitive information about visited web pages via a crafted HTML document, a...

Design/Logic Flaw

The Agent service in Iron Mountain Connected Backup 8.4 allows remote attackers to execute arbitrary code via a crafted opcode 13 request that triggers use of the LaunchCompoundFileAnalyzer class to send request data to the System.getRunTime.exec method...

WikiLeaks wins Aussie Journalism Awards Australia

WikiLeaks wins Aussie Journalism Awards Australia The whistle-blowing website, WikiLeaks, has been honoured at Australia's premier journalism awards for releasing of "an avalanche of inconvenient truths in a global publishing coup" which has had "an undeniable impact". The Walkley Awards are the...

Viscom Software Image Viewer ActiveX TIFMergeMultiFiles Vulnerability

Added: 11/28/2011 BID: 50712 Background Viscom Image Viewer CP is an image viewer ActiveX control that supports many popular image file formats, zoom in, zoom out, panning, auto zoom and auto scrolling when drawing the selection rectangle. Problem The ImageViewer2.OCX ActiveX control in Image...

USN-1263-1: IcedTea-Web, OpenJDK 6 vulnerabilities

Deepak Bhole discovered a flaw in the Same Origin Policy SOP implementation in the IcedTea web browser plugin. This could allow a remote attacker to open connections to certain hosts that should not be permitted. CVE-2011-3377 Juliano Rizzo and Thai Duong discovered that the block-wise AES...

GDTelcom Speedtest Denial Of Service

Title: GDTelcom Speedtest ActiveX Control "FTPDownLoad Class"-ActiveX.dll Remote Denial of Service Vulnerability Software: GDTelcom Speedtest ActiveX Control "FTPDownLoad Class"-ActiveX.dllVersion 1.0 Vulnerability Published :2011-10-15 Vulnerability Update Time :2011-09-10 Vendor: www.gdcn.comNo...

Defense Department Sued Over Data Breach

A group of people affected by the TRICARE data breach in September has filed a class-action lawsuit against the Department of Defense, alleging that the department and its health care organization didn’t properly safeguard personal information that was stored on backup tapes stolen last month. Th...

Java RMI Server Insecure Endpoint Code Execution Scanner

Detect Java RMI endpoints Module Options msf use auxiliary/scanner/misc/java/rmiserver msf undefinedrmiserver show actions ...actions... msf undefinedrmiserver set ACTION msf undefinedrmiserver show options ...show and set options... msf undefinedrmiserver run This module requires Metasploit:...

Java RMI Server Insecure Default Configuration Java Code Execution

This module takes advantage of the default configuration of the RMI Registry and RMI Activation services, which allow loading classes from any remote HTTP URL. As it invokes a method in the RMI Distributed Garbage Collector which is available via every RMI endpoint, it can be used against both...

PYSEC-2011-26

Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p class in OFS/misc.py and the use of Python modules...

Facebook Scottsdale Inventory - SQL Injection Vulnerability

Document Title: =============== Facebook Scottsdale Inventory - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=272 Release Date: ============= 2011-09-29 Vulnerability Laboratory ID VL-ID: ====================================...