Authentication flaw

The Forms Authentication feature in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0, when sliding expiry is enabled, does not properly handle cached content, which allows remote attackers to obtain access to arbitrary user accounts via a crafted URL, ak...

PT-2011-4444 · Microsoft · .Net Framework +1

Name of the Vulnerable Software and Affected Versions: Microsoft .NET Framework versions 1.1 SP1 through 4.0 Description: The issue arises from the Forms Authentication feature in the ASP.NET subsystem when sliding expiry is enabled, leading to improper handling of cached content. This allows...

CVE-2011-4780

Multiple cross-site scripting XSS vulnerabilities in libraries/displayexport.lib.php in phpMyAdmin 3.4.x before 3.4.9 allow remote attackers to inject arbitrary web script or HTML via crafted URL parameters, related to the export panels in the 1 server, 2 database, and 3 table sections...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in libraries/displayexport.lib.php in phpMyAdmin 3.4.x before 3.4.9 allow remote attackers to inject arbitrary web script or HTML via crafted URL parameters, related to the export panels in the 1 server, 2 database, and 3 table sections...

CVE-2011-4780

Multiple cross-site scripting XSS vulnerabilities in libraries/displayexport.lib.php in phpMyAdmin 3.4.x before 3.4.9 allow remote attackers to inject arbitrary web script or HTML via crafted URL parameters, related to the export panels in the 1 server, 2 database, and 3 table sections...

CVE-2011-4780

Multiple cross-site scripting XSS vulnerabilities in libraries/displayexport.lib.php in phpMyAdmin 3.4.x before 3.4.9 allow remote attackers to inject arbitrary web script or HTML via crafted URL parameters, related to the export panels in the 1 server, 2 database, and 3 table sections...

CVE-2011-4780

Multiple cross-site scripting XSS vulnerabilities in libraries/displayexport.lib.php in phpMyAdmin 3.4.x before 3.4.9 allow remote attackers to inject arbitrary web script or HTML via crafted URL parameters, related to the export panels in the 1 server, 2 database, and 3 table sections...

XSS in export.

PMASA-2011-20 Announcement-ID: PMASA-2011-20 Date: 2011-12-21 Summary XSS in export. Description Using crafted url parameters, it was possible to produce XSS on the export panels in the server, database and table sections. Severity We consider these vulnerabilities to be non critical. Mitigation...

flash-plugin: Cross-site scripting vulnerability fixed in APSB11-26

Cross-site scripting XSS vulnerability in Adobe Flash Player before 10.3.183.10 on Windows, Mac OS X, Linux, and Solaris, and before 10.3.186.7 on Android, allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to a "universal cross-site scripting issue," as...

Code injection

The isa function in PHP 5.3.7 and 5.3.8 triggers a call to the autoload function, which makes it easier for remote attackers to execute arbitrary code by providing a crafted URL and leveraging potentially unsafe behavior in certain PEAR packages and custom autoloaders...

PT-2011-4415

Name of the Vulnerable Software and Affected Versions PHP versions 5.3.7 through 5.3.8 Description The issue allows remote attackers to execute arbitrary code by providing a crafted URL. This is made possible by the is a function triggering a call to the autoload function, which can lead to...

CVE-2011-3315

CVE-2011-3315 describes a directory-traversal vulnerability in Cisco Unified Communications Manager (CUCM) 5.x/6.x up to 6.1(5)SU2, CUCM 7.x up to 7.1(5b)SU2, CUCM 8.x up to 8.0(3), and in Cisco Unified Contact Center Express (UCCX) and Cisco Unified IP IVR up to specified revisions. The flaw all...

CVE-2011-3310

The Home Page component in Cisco CiscoWorks Common Services before 4.1 on Windows, as used in CiscoWorks LAN Management Solution, Cisco Security Manager, Cisco Unified Service Monitor, Cisco Unified Operations Manager, CiscoWorks QoS Policy Manager, and CiscoWorks Voice Manager, allows remote...

Code injection

The Home Page component in Cisco CiscoWorks Common Services before 4.1 on Windows, as used in CiscoWorks LAN Management Solution, Cisco Security Manager, Cisco Unified Service Monitor, Cisco Unified Operations Manager, CiscoWorks QoS Policy Manager, and CiscoWorks Voice Manager, allows remote...

CVE-2011-3310: Improper Control of Generation of Code

The Home Page component in Cisco CiscoWorks Common Services before 4.1 on Windows, as used in CiscoWorks LAN Management Solution, Cisco Security Manager, Cisco Unified Service Monitor, Cisco Unified Operations Manager, CiscoWorks QoS Policy Manager, and CiscoWorks Voice Manager, allows remote...

PT-2011-4384

Name of the Vulnerable Software and Affected Versions CiscoWorks Common Services versions prior to 4.1 Description The issue allows remote authenticated users to execute arbitrary commands via a crafted URL. This affects various Cisco products that utilize CiscoWorks Common Services, including...

Directory traversal

Directory traversal vulnerability in Apple Safari before 5.1.1 allows remote attackers to execute arbitrary JavaScript code, in a Safari Extensions context, via a crafted safari-extension: URL...

CVE-2011-3229

Directory traversal vulnerability in Apple Safari before 5.1.1 allows remote attackers to execute arbitrary JavaScript code, in a Safari Extensions context, via a crafted safari-extension: URL...

XSS Vulnerabilities in TWiki < 5.1.0

Information------------------Name : XSS vulnerability in TWikiSoftware : TWiki 5.0.2 and below.Vendor Hompeage : http://twiki.org/Vulnerability Type : Cross-Site ScriptingSeverity : HighResearcher : Mesut Timur mesut at mavitunasecurity dot comAdvisory Reference : NS-11-006CVE : CVE-2011-3010...

CVE-2011-2444

Cross-site scripting XSS vulnerability in Adobe Flash Player before 10.3.183.10 on Windows, Mac OS X, Linux, and Solaris, and before 10.3.186.7 on Android, allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to a "universal cross-site scripting issue," as...