SOL13231 - PHP vulnerability CVE-2009-2626

In PHP 5.3.0 and PHP 5.2.10 and earlier, the zendrestoreinientrycb function in zendini.c allows context-specific attackers to obtain sensitive information memory contents and causes PHP to fail by using the iniset function to declare a variable, and then using the inirestore function to restore t...

Sage vulnerable to arbitrary script execution

Overview Sage is vulnerable to arbitrary script execution. Note that this vulnerability is different from JVN30221194. Sage is an addon for Mozilla Firefox that adds an RSS/Atom feed reader. Sage is vulnerable to arbitrary script execution due to the improper processing during HTML page output...

Sage vulnerable to arbitrary script execution

Overview Sage is vulnerable to arbitrary script execution. Note that this vulnerability is different from JVN99203127. Sage is an addon for Mozilla Firefox that adds an RSS/Atom feed reader. Sage is vulnerable to arbitrary script execution due to the improper processing during HTML page output...

PDD - Packet Dump Decode Released

PDD - Packet Dump Decode Released PDD is an open-source program created by Srivats.Packet Dump Decode pdd is a simple convenient GUI wrapper around the Wireshark/Ethereal tools to convert packet hexdumps into well formatted xml containing the decoded protocols and protocol contents.You need to...

subversion: security udpate (important)

Subversion was updated to version 1.6.17 to fix several security issues: - CVE-2011-1752: The moddavsvn Apache HTTPD server module can be crashed though when asked to deliver baselined WebDAV resources. - CVE-2011-1783: The moddavsvn Apache HTTPD server module can trigger a loop which consumes al...

SmartFTP Client Information Disclosure Vulnerability

This host is installed with SmartFTP Client and is prone to information disclosure vulnerability. OpenVAS Vulnerability Test $Id: secpodsmartftpclientinfodiscvuln.nasl 7006 2017-08-25 11:51:20Z teissa $ SmartFTP Client Information Disclosure Vulnerability Authors: Antu Sanadi Copyright: Copyright...

Debian DSA-2251-1 : subversion - several vulnerabilities

Several vulnerabilities were discovered in Subversion, the version control system. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2011-1752 The moddavsvn Apache HTTPD server module can be crashed though when asked to deliver baselined WebDAV resources. ...

FreeBSD : Subversion -- multiple vulnerabilities (e27a1af3-8d21-11e0-a45d-001e8c75030d)

Subversion team reports : Subversion's moddavsvn Apache HTTPD server module will dereference a NULL pointer if asked to deliver baselined WebDAV resources. This can lead to a DoS. An exploit has been tested, and tools or users have been observed triggering this problem in the wild. Subversion's...

Nmap NSE net: ssl-cert

Retrieves a server's SSL certificate. The amount of information printed about the certificate depends on the verbosity level. With no extra verbosity, the script prints the validity period and the commonName, organizationName, stateOrProvinceName, and countryName of the subject. '443/tcp open htt...

Subversion -- multiple vulnerabilities

Subversion team reports: Subversion's moddavsvn Apache HTTPD server module will dereference a NULL pointer if asked to deliver baselined WebDAV resources. This can lead to a DoS. An exploit has been tested, and tools or users have been observed triggering this problem in the wild. Subversion's...

eclipse: Help Content web application vulnerable to multiple XSS

Multiple cross-site scripting XSS vulnerabilities in the Help Contents web application aka the Help Server in Eclipse IDE before 3.6.2 allow remote attackers to inject arbitrary web script or HTML via the query string to 1 help/index.jsp or 2 help/advanced/content.jsp...

Atlassian Confluence 2.x >= 2.7 / 3.x < 3.4.9 Multiple XSS

According to its self-reported version number, the instance of Atlassian Confluence on the remote host is a 2.x version that is 2.7 or later, or else version 3.x prior to 3.4.9. It is, therefore, affected by multiple cross-site scripting vulnerabilities. Errors in the validation of input data to...

Atlassian's Confluence Cross Site Scripting

A while back I reported some bugs in Atlassian's Confluence. As everyone should have upgraded by now I feel that I can now release my proof of concept for CONF-21508 and CONF-21819. note - I uncovered and reported these bugs at different times. Issue 1 CONF-21508: the document macro did not...

Design/Logic Flaw

The keycertify function in usr.bin/ssh/key.c in OpenSSH 5.6 and 5.7, when generating legacy certificates using the -t command-line option in ssh-keygen, does not initialize the nonce field, which might allow remote attackers to obtain sensitive stack memory contents or make it easier to conduct...

"The Daily" Hacked, Unauthorized Web Index Created !

One affair about The Daily that ashamed me from the additional I aboriginal laid eyes on the iPad bi-weekly that launched bygone is that there is no one abode area you can see a simple account of every news in the issue. There is a table of contents, but it shows alone ten featured stories. Like...

Design/Logic Flaw

Ruby Version Manager RVM before 1.2.1 writes file contents to a terminal without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via a crafted file, related to an "escape sequence injection vulnerability." NOTE: some of these details are...

CVE-2010-3928

Ruby Version Manager (RVM) prior to 1.2.1 contains an escape sequence injection vulnerability. The issue arises because RVM writes file contents to a terminal without sanitizing non‑printable characters, enabling a crafted file to cause the terminal to process escape sequences. This could allow a...

CVE-2010-3925

Contents-Mall before 15 does not properly handle passwords, which allows remote attackers to discover the administrative password, and consequently obtain sensitive information or modify data, via unspecified vectors...

CVE-2008-7271

Multiple cross-site scripting XSS vulnerabilities in the Help Contents web application aka the Help Server in Eclipse IDE, possibly 3.3.2, allow remote attackers to inject arbitrary web script or HTML via 1 the searchWord parameter to help/advanced/searchView.jsp or 2 the workingSet parameter in ...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Help Contents web application aka the Help Server in Eclipse IDE, possibly 3.3.2, allow remote attackers to inject arbitrary web script or HTML via 1 the searchWord parameter to help/advanced/searchView.jsp or 2 the workingSet parameter in ...