75 matches found
Mageia: Security Advisory (MGASA-2015-0463)
The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
DEBIAN-CVE-2015-8213
The getformat function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRETKEY...
MGASA-2015-0463 Updated python-django packages fix security vulnerability
If an application allows users to specify an unvalidated format for dates and passes this format to the date filter, then a malicious user could obtain any secret in the application's settings by specifying a settings key instead of a date format CVE-2015-8213...
UBUNTU-CVE-2015-8213
The getformat function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRETKEY...
django -- information leak vulnerability
Tim Graham reports: If an application allows users to specify an unvalidated format for dates and passes this format to the date filter, e.g. lastupdated|date:userdateformat , then a malicious user could obtain any secret in the application's settings by specifying a settings key instead of a dat...
TxtBlog (index.php m) 1.0 Alpha - Local File Inclusion Vulnerability
No description provided by source. ============================================================ TxtBlog index.php m Local File Inclusion Vulnerability ============================================================ ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Undergroun...
WordPress mySTAT plugin <= 2.6 SQL Injection Vulnerability
No description provided by source. Exploit Title: WordPress mySTAT plugin = 2.6 SQL Injection Vulnerability Date: 2011-08-28 Author: Miroslav Stampar miroslav.stamparatgmail.com @stamparm Software Link: http://downloads.wordpress.org/plugin/mystat.2.6.zip Version: 2.6 tested Note: magicquotes has...
Cross site scripting
Cross-site scripting XSS vulnerability in admin/editprefs.php in the backend in CMS Made Simple CMSMS before 1.7.1 might allow remote attackers to inject arbitrary web script or HTML via the dateformatstring parameter...
LinkLogger 2.4.10.15 - 'syslog' Denial of Service
!/usr/bin/perl LinkLogger 2.4.10.15 syslog DoS Tested against 2.4.10.15 Coded by Mike Cyr, aka h00die mcyr2 at csc dotcom Notes: 1. Based on code from http://www.pythonprasanna.com/Papers%20and%20Articles/Sockets/udpspoofpl.txt 2. The exact amount of packets to overwhelm the program and shut down...
CVE-2006-3469
Format string vulnerability in time.cc in MySQL Server 4.1 before 4.1.21 and 5.0 before 1 April 2006 allows remote authenticated users to cause a denial of service crash via a format string instead of a date as the first parameter to the dateformat function, which is later used in a formatted pri...
CVE-2006-2524
Cross-site scripting XSS vulnerability in UseBB 1.0 RC1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors when processing the user date format...
Cross site scripting
Cross-site scripting XSS vulnerability in UseBB 1.0 RC1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors when processing the user date format...
CVE-2006-2524
Cross-site scripting XSS vulnerability in UseBB 1.0 RC1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors when processing the user date format...
Solaris 2.6 (x86) : 110884-01
SunOS 5.6x86: useradd date format fixes. Date this patch was last updated by Sun : Aug/03/01 %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a recommended security fix. Disabled on 2011/09/17. C Tenable Network Security, Inc. if !...