CVE-2011-1499

acl.c in Tinyproxy before 1.8.3, when an Allow configuration setting specifies a CIDR block, permits TCP connections from all IP addresses, which makes it easier for remote attackers to hide the origin of web traffic by leveraging the open HTTP proxy server...

DEBIAN-CVE-2011-1507

Asterisk Open Source 1.4.x before 1.4.40.1, 1.6.1.x before 1.6.1.25, 1.6.2.x before 1.6.2.17.3, and 1.8.x before 1.8.3.3 and Asterisk Business Edition C.x.x before C.3.6.4 do not restrict the number of unauthenticated sessions to certain interfaces, which allows remote attackers to cause a denial...

Code injection

Asterisk Open Source 1.4.x before 1.4.40.1, 1.6.1.x before 1.6.1.25, 1.6.2.x before 1.6.2.17.3, and 1.8.x before 1.8.3.3 and Asterisk Business Edition C.x.x before C.3.6.4 do not restrict the number of unauthenticated sessions to certain interfaces, which allows remote attackers to cause a denial...

CVE-2011-1507

Asterisk Open Source 1.4.x before 1.4.40.1, 1.6.1.x before 1.6.1.25, 1.6.2.x before 1.6.2.17.3, and 1.8.x before 1.8.3.3 and Asterisk Business Edition C.x.x before C.3.6.4 do not restrict the number of unauthenticated sessions to certain interfaces, which allows remote attackers to cause a denial...

CVE-2011-1507

Asterisk Open Source 1.4.x before 1.4.40.1, 1.6.1.x before 1.6.1.25, 1.6.2.x before 1.6.2.17.3, and 1.8.x before 1.8.3.3 and Asterisk Business Edition C.x.x before C.3.6.4 do not restrict the number of unauthenticated sessions to certain interfaces, which allows remote attackers to cause a denial...

CVE-2011-1507

Asterisk Open Source 1.4.x before 1.4.40.1, 1.6.1.x before 1.6.1.25, 1.6.2.x before 1.6.2.17.3, and 1.8.x before 1.8.3.3 and Asterisk Business Edition C.x.x before C.3.6.4 do not restrict the number of unauthenticated sessions to certain interfaces, which allows remote attackers to cause a denial...

FreeBSD : Asterisk -- multiple vulnerabilities (3c7d565a-6c64-11e0-813a-6c626dd55a41)

The Asterisk Development Team reports : It is possible for a user of the Asterisk Manager Interface to bypass a security check and execute shell commands when they should not have that ability. Sending the 'Async' header with the 'Application' header during an Originate action, allows authenticat...

Wing FTP Server SFTP Connection Unspecified DoS

The remote FTP server is running a version of Wing FTP Server earlier than 3.8.0. Such versions reportedly are affected by a denial of service vulnerability that can be triggered when handling SFTP connections. A remote, unauthenticated attacker may be able to leverage this issue to crash the...

Fedora 14 : libvirt-0.8.3-9.fc14 (2011-4896)

Fix for CVE-2011-1486, error reporting in libvirtd is not thread safe Fix specfil to create /var/lib/libvirt with proper permissions. fix a lack of API check on read-only connections this build fix one crash in the the error handling fix a lack of API check on read-only connections Note that...

CVE-2011-1492

steps/utils/modcss.inc in Roundcube Webmail before 0.5.1 does not properly verify that a request is an expected request for an external Cascading Style Sheets CSS stylesheet, which allows remote authenticated users to trigger arbitrary outbound TCP connections from the server, and possibly obtain...

DEBIAN-CVE-2011-1492

steps/utils/modcss.inc in Roundcube Webmail before 0.5.1 does not properly verify that a request is an expected request for an external Cascading Style Sheets CSS stylesheet, which allows remote authenticated users to trigger arbitrary outbound TCP connections from the server, and possibly obtain...

CVE-2011-1492

steps/utils/modcss.inc in Roundcube Webmail before 0.5.1 does not properly verify that a request is an expected request for an external Cascading Style Sheets CSS stylesheet, which allows remote authenticated users to trigger arbitrary outbound TCP connections from the server, and possibly obtain...

Cross site request forgery (csrf)

steps/utils/modcss.inc in Roundcube Webmail before 0.5.1 does not properly verify that a request is an expected request for an external Cascading Style Sheets CSS stylesheet, which allows remote authenticated users to trigger arbitrary outbound TCP connections from the server, and possibly obtain...

CVE-2011-1492

steps/utils/modcss.inc in Roundcube Webmail before 0.5.1 does not properly verify that a request is an expected request for an external Cascading Style Sheets CSS stylesheet, which allows remote authenticated users to trigger arbitrary outbound TCP connections from the server, and possibly obtain...

Family Connections CMS 2.3.2 (POST) Stored XSS And XPath Injection

Exploit for php platform in category web applications Family Connections CMS 2.3.2 Stored XSS And XPath Injection function xpathdocument.forms"xpath".submit; function xssdocument.forms"xss".submit; input type="hidden" name="message" valu...

Family Connections CMS 2.3.2 stored cross site and XPath injection vulnerability-vulnerability warning-the black bar safety net

Family Connections is an open source content management system, it can be easy and convenient to create a private family site. Family Connections 2.3.2 the presence of the stored cross site and XPath injection vulnerability may lead to sensitive information disclosure. +info: Family Connections C...

Family Connections CMS 2.3.2 - Persistent Cross-Site Scripting XML Injection

Family Connections CMS 2.3.2 - Persistent Cross-Site Scripting XML Injection Family Connections CMS 2.3.2 Stored XSS And XPath Injection function xpathdocument.forms"xml".submit; function xssdocument.forms"xss".submit; a href="javascri...

Family Connections CMS 2.3.2 - Persistent Cross-Site Scripting / XML Injection

Family Connections CMS 2.3.2 Stored XSS And XPath Injection function xpathdocument.forms"xml".submit; function xssdocument.forms"xss".submit; br...

Family Connections CMS 2.3.2 (POST) Stored XSS And XML Injection

Summary Family Connections is an open source content management system. It makes creating a private, family website easy and fun. Description FCMS suffers from a stored XSS vulnerability post-auth in messageboard.php script thru the 'subject' post parameter. XML Inj. lies in the /inc/getChat.php...

Family Connections 2.3.2 - subject HTML Injection

Family Connections 2.3.2 - subject HTML Injection source: https://www.securityfocus.com/bid/47037/info Family Connections is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in...