5172 matches found
WordPress Math Comment Spam Protection Plugin <= 2.1 - CSRF
Because of these vulnerabilities, the attackers can perform actions as administrators. Solution Update the plugin...
FreeBSD : gallery2 -- multiple vulnerabilities (4aab7bcd-b294-11dc-a6f0-00a0cce0781e)
The Gallery team reports : Gallery 2.2.4 addresses the following security vulnerabilities : - Publish XP module - Fixed unauthorized album creation and file uploads. - URL rewrite module - Fixed local file inclusion vulnerability in unsecured admin controller and information disclosure in hotlink...
gallery2 -- multiple vulnerabilities
The Gallery team reports: Gallery 2.2.4 addresses the following security vulnerabilities: Publish XP module - Fixed unauthorized album creation and file uploads. URL rewrite module - Fixed local file inclusion vulnerability in unsecured admin controller and information disclosure in hotlink...
DEBIAN-CVE-2007-6277
Multiple buffer overflows in Free Lossless Audio Codec FLAC libFLAC before 1.2.1 allow user-assisted remote attackers to execute arbitrary code via large 1 Metadata Block Size, 2 VORBIS Comment String Size, 3 Picture Metadata MIME-TYPE Size, 4 Picture Description Size, 5 Picture Data Length, 6...
Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. Math Comment Spam Protection: Crossite scripting...
Format string
frame.html in Aida-Web Aida Web allows remote attackers to bypass a protection mechanism and obtain comment and task details via modified values to the 1 Mehr and 2 SUPER parameters...
CVE-2007-6056
frame.html in Aida-Web Aida Web allows remote attackers to bypass a protection mechanism and obtain comment and task details via modified values to the 1 Mehr and 2 SUPER parameters...
EEYE: Multiple Vulnerabilities In .FLAC File Format and Various Media Applications
Multiple Vulnerabilities In .FLAC File Format and Various Media Applications Release Date: November 15, 2007 Date Reported: September 28, 2007 Vendor Reporting Coordination Began With US-CERT Severity: High Remote Code Execution Vendor: Multiple Vendors Systems Affected: Applications with FLAC...
CVE-2003-1534
The CVE-2003-1534 entry concerns Justice Guestbook 1.3, specifically the jgb.php3 CGI. The vulnerability is a Cross‑Site Scripting (XSS) flaw triggered by user-supplied input in multiple fields (name, homepage, aim, yim, location, comment), with the underlying cause being insufficient input valid...
sphpblog051-multi.txt
Title: Simple PHP Blog sphpblog Released on: 2007/10/21 Changelog: ---------- L M H T Summary: Ip Spoofing X X Cross Site Scripting X X Session Fixation X X mail CRLF Injection X Local File Inclusion +CSRF X X File Deletion +CSRF X X File Upload Vulnerability X X Code Execution +CSRF X X Legend: ...
SA-2007-030 - Drupal Core - API handling of unpublished comment.
The publication status of comments is not passed during the hookcomments API operation, causing various modules that rely on the publication status such as Organic groups, or Subscriptions to mail out unpublished comments. Versions affected Drupal 4.7.x before version 4.7.8 Drupal 5.x before...
CVE-2003-1348: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in guestbook.cgi in ftls.org Guestbook 1.1 allows remote attackers to inject arbitrary web script or HTML via the 1 comment, 2 name, or 3 title field...
Moderate: kdelibs security update
3.5.4-13.el5.0.1 - Remove Version branding - Maximum rpm trademark logos removed pics/crystalsvg/-mime-rpm 3.5.4-13.el5 - Resolves: 293571 CVE-2007-0537 Konqueror improper HTML comment rendering CVE-2007-1564 FTP protocol PASV design flaw affects konqueror 3.5.4-12.el5 - resolves: 293421,...
CVE-2007-5178
contrib/mxglancesdesc.php in the mxglance 2.3.3 module for mxBB places a critical security check within a comment because of a missing comment delimiter, which allows remote attackers to conduct remote file inclusion attacks and execute arbitrary PHP code via a URL in the mxrootpath parameter...
CVE-2007-4874
Multiple cross-site scripting XSS vulnerabilities in SimpNews 2.41.03 allow remote attackers to inject arbitrary web script or HTML via the 1 lusername parameter to admin/layout2b.php, and the 2 backurl parameter to comment.php...
CVE-2007-1865
The ipv6getsockoptsticky function in the kernel in Red Hat Enterprise Linux RHEL Beta 5.1.0 allows local users to obtain sensitive information kernel memory contents via a negative value of the len parameter. NOTE: this issue has been disputed in a bug comment, stating that "len is ignored when...
Only allow basic formatting macros in comments
panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Cloud. Using Confluence Server? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFSERVER-9387. panel Currently it is possible for users with create comments permission to embed macros in these comments. This is a...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Olate Download od 3.4.2 allow remote attackers to inject arbitrary web script or HTML via 1 the PHPSELF variable in modules/core/uim.php and 2 url tags in a comment in modules/core/fldm.php...
CVE-2007-4541
Multiple cross-site scripting XSS vulnerabilities in Olate Download od 3.4.2 allow remote attackers to inject arbitrary web script or HTML via 1 the PHPSELF variable in modules/core/uim.php and 2 url tags in a comment in modules/core/fldm.php...
GeoBlog MOD_1.0 - deletecomment.php?id Arbitrary Comment Deletion
GeoBlog MOD1.0 - deletecomment.php?id Arbitrary Comment Deletion source: https://www.securityfocus.com/bid/24966/info geoBlog is prone to multiple security-bypass vulnerabilities because the application fails to properly validate users when deleting user blogs and comments. An attacker may exploi...