OpenNMS 1.5.96 - Multiple Vulnerabilities

OpenNMS 1.5.96 - Multiple Vulnerabilities OpenNMS Multiple Vulnerabilities -------------------------------- BugSec | Security Advisory Moshe Ben-Abu | Security Expert Advisory URL PDF: http://www.bugsec.com/upfiles/OpenNMSMultipleVulnerabilities.pdf Vendor ------ OpenNMS Group –...

LooYu Web IM 2008 Cross-Site Scripting Vulnerabilities

Application: LooYu Web IM Vendor: www.looyu.com Corporation: DuoYou, Inc. Version: Latest: 19 SEP 2008 - Home Edition, Enterprise & Professional Description: LooYu Web IM 2008 Cross-Site Scripting Vulnerabilities Background: ============== LooYu is a web-based group chat tool that lets invite a...

CORE-2008-0126: iPhone Safari JavaScript alert Denial of Service

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ iPhone Safari JavaScript alert Denial of Service 1. Advisory Information Title: iPhone Safari JavaScript alert Denial of Service Advisory ID: CORE-2008-0603 Advisory...

SECOBJADV-2008-03.2: PartyGaming PartyPoker Malicious Update Vulnerability

====================================================================== = Security Objectives Advisory SECOBJADV-2008-03.2 = ====================================================================== PartyGaming PartyPoker Malicious Update Vulnerability...

Cisco Security Advisory: Vulnerability in Cisco WebEx Meeting Manager ActiveX Control

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Vulnerability in Cisco WebEx Meeting Manager ActiveX Control Advisory ID: cisco-sa-20080814-webex Revision 1.0 For Public Release 2008 August 14 2230 UTC GMT +-------------------------------------------------------------------...

Pligg CMS 9.9.0 - Cross-Site Scripting Local File Inclusion SQL Injection

Pligg CMS 9.9.0 - Cross-Site Scripting Local File Inclusion SQL Injection GulfTech Security Research July 30, 2008 Vendor : Pligg LLC URL : http://www.pligg.com/ Version : Pligg alertdocument.cookie; The above example link would display the end users cookie to them. Of course this can also be use...

SECOBJADV-2008-02: Cygwin Installation and Update Process can be Subverted Vulnerability

====================================================================== = Security Objectives Advisory SECOBJADV-2008-02 = ====================================================================== Cygwin Installation and Update Process can be Subverted Vulnerability...

GSC privilege escalation

Privileges are only checked on client side...

gsc-kick.txt

Name: Michael Gray Website: www.ownerarium.net Contact: [email protected] Discovered Exploit: 06-05-2008 Vulnerable Software Title: GSC Vulnerable Version: = 2067 Severity: CRITICAL Website: http://www.getgsc.com Reported to vendor: Yes Actively exploited: Yes Exploit Discovery...

Cross-site scripting vulnerability in Apache HTTP Server "mod_imap" and "mod_imagemap"

Overview modimap and modimagemap modules of the Apache HTTP Server are vulnerable to cross-site scripting. The Apache HTTP Server is open source web server software. The Apache HTTP Server modules modimap and modimagemap provide server-side imagemap processing capability. The Apache HTTP Server...

Debian Security Advisory DSA 1554-2 (roundup)

The remote host is missing an update to roundup announced via advisory DSA 1554-2. OpenVAS Vulnerability Test $Id: deb15542.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1554-2 roundup Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

[SECURITY] [DSA 1554-2] New roundup packages fix regression

------------------------------------------------------------------------ Debian Security Advisory DSA-1554-2 [email protected] http://www.debian.org/security/ Thijs Kinkhorst May 06, 2008 http://www.debian.org/security/faq -...

Session fixation

Plone CMS does not record users' authentication states, and implements the logout feature solely on the client side, which makes it easier for context-dependent attackers to reuse a logged-out session...

ListManager < 9.3b / 9.2c / 8.95d Multiple Vulnerabilities

The remote host is running ListManager, a web-based commercial mailing list management application from Lyris. According to its banner, the version of ListManager installed on the remote host relies on client-side code to validate unspecified form parameters before processing them. An attacker wh...

CVE-2007-6319

Multiple unspecified vulnerabilities in Lyris ListManager 8.x before 8.95d, 9.2 before 9.2c, and 9.3 before 9.3b allow remote attackers to 1 gain list administrator privileges or 2 access arbitrary mailing lists via unknown vectors related to modification of client-side information; and 3 allow...

Ubuntu 6.06 LTS : postgresql-8.1 vulnerabilities (USN-288-2)

USN-288-1 fixed two vulnerabilities in Ubuntu 5.04 and Ubuntu 5.10. This update fixes the same vulnerabilities for Ubuntu 6.06 LTS. For reference, these are the details of the original USN : CVE-2006-2313: Akio Ishida and Yasuo Ohgaki discovered a weakness in the handling of invalidly-encoded...

CVE-2007-5738

The FlashUpload component in Korean GHBoard uses a client-side protection mechanism to prevent uploading of dangerous file extensions, which allows remote attackers to bypass restrictions and upload arbitrary files via a modified copy of component/flashupload/upload.html...

Design/Logic Flaw

The FlashUpload component in Korean GHBoard uses a client-side protection mechanism to prevent uploading of dangerous file extensions, which allows remote attackers to bypass restrictions and upload arbitrary files via a modified copy of component/flashupload/upload.html...

CVE-2002-2303

3D3.Com ShopFactory 5.8 uses client-side encryption and decryption for sensitive price data, which allows remote attackers to modify shopping cart prices by using the Javascript to decrypt the cookie that contains the data...

CVE-2002-2303

3D3.Com ShopFactory 5.8 is affected by a vulnerability where client-side encryption and decryption of sensitive price data enables remote attackers to modify shopping cart prices by using JavaScript to decrypt the cookie containing the data. This indicates a weakness in where price data is stored...