Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Cgi/confirm.py in GNU Mailman 2.1.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 full name or 2 username field in a confirmation message...

CVE-2011-0707

Multiple cross-site scripting XSS vulnerabilities in Cgi/confirm.py in GNU Mailman 2.1.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 full name or 2 username field in a confirmation message...

Angel Learning Management System 7.3 - pdaview.asp Cross-Site Scripting

Angel Learning Management System 7.3 - pdaview.asp Cross-Site Scripting source: https://www.securityfocus.com/bid/44689/info Angel Learning Management System is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker may leverage th...

Confluence features that require password confirmation (websudo, captcha) do not work with custom authentication

When user is required to confirm the password, Confluence always checks the entered password against the internally stored user/password. If an instance is configured to use custom authentication which is different from atlassian-user, the password validation will fail. h3. Resolution This is fix...

Confluence features that require password confirmation (websudo, captcha) do not work with custom authentication

When user is required to confirm the password, Confluence always checks the entered password against the internally stored user/password. If an instance is configured to use custom authentication which is different from atlassian-user, the password validation will fail. h3. Resolution This is fix...

Confluence features that require password confirmation (websudo, captcha) do not work with custom authentication

When user is required to confirm the password, Confluence always checks the entered password against the internally stored user/password. If an instance is configured to use custom authentication which is different from atlassian-user, the password validation will fail. h3. Resolution This is fix...

osDate - uploadvideos.php Arbitrary File Upload

osDate - uploadvideos.php Arbitrary File Upload ==================================================== osDate Upload Shell Vulnerability uploadvideos.php ==================================================== Date : 05/08/2010 Author : Xa7m3d Tested ON : ubuntu 9.10 MY Team : Currently no Software Li...

Booking System for Planyo Multiple VUlnerabilty

Exploit for php platform in category web applications =============================================== Booking System for Planyo Multiple VUlnerabilty =============================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 ...

lftp file overwrite

Downloaded file name in lftpget may be set by server without user confirmation...

CVE-2010-2714

creationtimestamp| type| source ---|---|--- 2010-07-04 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/14203...

Users can be tricked into uploading unexpected files

Plug-ins may be used to seed the system clipboard with paths to a target file, while the user may not expect that to be the contents of the clipboard. If the user can be convinced to focus a file input and paste the contents of the clipboard, the file can then be immediately uploaded without...

TornadoStore 1.4.3 SQL Injection Vulnerability

Exploit for php platform in category web applications ============================================== TornadoStore 1.4.3 SQL Injection Vulnerability ============================================== 1. Advisory Information Title: Multiple SQL Injection in TornadoStore 1.4.3 Advisory ID:...

Users can be tricked into uploading unexpected files – Opera Security Advisories

Users can be tricked into uploading unexpected files – Opera Security Advisories OPCOM Team | June 29, 2010 Severity Less severe Description Plug-ins may be used to seed the system clipboard with paths to a target file, while the user may not expect that to be the contents of the clipboard. If th...

CVE-2010-2033

creationtimestamp| type| source ---|---|--- 2010-05-19 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/34008...

Mandriva Linux Security Advisory : kdenetwork4 (MDVSA-2010:098)

Multiple vulnerabilities has been discovered and fixed in kget kdenetwork4 : Directory traversal vulnerability in KGet in KDE SC 4.0.0 through 4.4.3 allows remote attackers to create arbitrary files via directory traversal sequences in the name attribute of a file element in a metalink file...

CVE-2010-1511

CVE-2010-1511 affects KGet 2.4.2 within KDE SC 4.0.0–4.4.3. The flaw arises from not properly requesting download confirmation when processing a metalink, enabling a remote attacker to overwrite arbitrary files via a crafted metalink. CVSS metrics from NVD indicate Network access, Low attack comp...

CVE-2010-1511

KGet 2.4.2 in KDE SC 4.0.0 through 4.4.3 does not properly request download confirmation from the user, which makes it easier for remote attackers to overwrite arbitrary files via a crafted metalink file...

Ubuntu 9.04 / 9.10 / 10.04 LTS : kdenetwork vulnerabilities (USN-938-1)

It was discovered that KGet did not properly perform input validation when processing metalink files. If a user were tricked into opening a crafted metalink file, a remote attacker could overwrite files via directory traversal, which could eventually lead to arbitrary code execution. CVE-2010-100...

USN-938-1: KDENetwork vulnerabilities

It was discovered that KGet did not properly perform input validation when processing metalink files. If a user were tricked into opening a crafted metalink file, a remote attacker could overwrite files via directory traversal, which could eventually lead to arbitrary code execution. CVE-2010-100...

JIRA is vulnerable to clickjacking attacks

A clickjacking attack on JIRA would most likely take the form of a third-party site, containing an invisible iframe on top of an unrelated page. The iframe would contain a page in JIRA. The victim would believe he was clicking on the other site but would actually be clicking in JIRA and performin...