HP Data Protector CRS Opcode 235 Stack Buffer Overflow (CVE-2013-2325)

A stack buffer overflow has been discovered in HP Data Protector. The vulnerability exists in the Cell Request service crs.exe, which listens on a randomly chosen port. The application fails to sanitize input with opcode 235, which can result in a stack buffer overflow. A remote, unauthenticated...

Debian Security Advisory DSA 2532-1 (libapache2-mod-rpaf - denial of service)

Sebastien Bocahu discovered that the reverse proxy add forward module for the Apache webserver is vulnerable to a denial of service attack through a single crafted request with many headers. OpenVAS Vulnerability Test $Id: deb25321.nasl 14276 2019-03-18 14:43:56Z cfischer $ Auto-generated from...

Oracle Endeca Server createDataStore Remote Command Execution (CVE-2013-3763)

A command execution vulnerability exists in Oracle Endeca Server. The vulnerability is due to the controlSoapBinding web service exposing the createDataStore method which contains a flaw that allows for the injection of arbitrary commands. A remote, unauthenticated attacker could exploit this...

Cross site scripting

Cross-site scripting XSS vulnerability in Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted request, aka "SharePoint XSS Vulnerability."...

CVE-2013-3179

Cross-site scripting XSS vulnerability in Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted request, aka "SharePoint XSS Vulnerability."...

CVE-2013-3609

The web interface in the Intelligent Platform Management Interface IPMI implementation on Supermicro H8DC, H8DG, H8SCM-F, H8SGL-F, H8SM, X7SP, X8DT, X8SI, X9DAX-, X9DB, X9DR, X9QR, X9SBAA-F, X9SC, X9SPU-F, and X9SR devices relies on JavaScript code on the client for authorization checks, which...

PineApp Mail-SeCure ldapsyncnow.php Remote Command Execution

A remote command execution vulnerability has been reported in PineApp Mail-SeCure. The vulnerability is due to exposing of the ldapsyncnow.php file of the administration web interface. A remote attacker can exploit this vulnerability by sending a specially crafted request to the vulnerable server...

Design/Logic Flaw

IBM WebSphere Portal 6.1, 7.0, and 8.0 allows remote attackers to access the user directory via a crafted request for a servlet, related to the serveServletsByClassnameEnabled setting...

CVE-2013-3016

IBM WebSphere Portal 6.1, 7.0, and 8.0 allows remote attackers to access the user directory via a crafted request for a servlet, related to the serveServletsByClassnameEnabled setting...

Squid Host Header DoS Vulnerability (SQUID-2013:3)

Squid is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:squid-cache:squid";...

Open and Compact FTPD <= 1.2 Multiple Vulnerabilities - Active Check

Open and Compact FTPD server is prone to authentication bypass and directory traversal vulnerabilities. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Apache Struts 2 ExceptionDelegator Arbitrary Remote Command Execution

The remote web application appears to use Struts 2, a web framework that utilizes OGNL Object-Graph Navigation Language as an expression language. Due to an error in the way that the ExceptionDelegator component handles mismatched data types, an unauthenticated, remote attacker can execute...

Stack-based buffer overflow with specially crafted request

Stack-based buffer overflow with specially crafted request Severity: major CVE-2013-2028 Not vulnerable: 1.5.0+, 1.4.1+ Vulnerable: 1.3.9-1.4.0...

CVE-2013-4878

The default configuration of Parallels Plesk Panel 9.0.x and 9.2.x on UNIX, and Small Business Panel 10.x on UNIX, has an improper ScriptAlias directive for phppath, which makes it easier for remote attackers to execute arbitrary code via a crafted request, a different vulnerability than...

CVE-2013-2135

Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "$" and "%" sequences, which causes the OGNL code to be evaluated twice...

HP Data Protector CRS Opcode 211 Stack Buffer Overflow (CVE-2013-2333)

A stack buffer overflow has been reported in HP Data Protector. The vulnerability is in the CRS.exe service, which listens on a randomly chosen port. The application fails to sanitize input with opcode 211, which can result in a stack buffer overflow. A remote, unauthenticated attacker can exploi...

HP Data Protector CRS Opcode 259 Stack Buffer Overflow (CVE-2013-2329)

A stack buffer overflow has been reported in HP Data Protector. The vulnerability is in the CRS.exe service, which listens on a randomly chosen port. The application fails to sanitize input with opcode 259, which can result in a stack buffer overflow. A remote, unauthenticated attacker can exploi...

Code injection

Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the 1 URL or 2 A tag...

Code injection

Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the 1 URL or 2 A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966...

CVE-2013-1966

Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the 1 URL or 2 A tag...