CVE-2011-5107

Cross-site scripting XSS vulnerability in postalert.php in Alert Before Your Post plugin, possibly 0.1.1 and earlier, for WordPress allows remote attackers to inject arbitrary web script or HTML via the name parameter...

PT-2012-1275 · Red Hat · Jboss Eap +1

Name of the Vulnerable Software and Affected Versions: JBoss AS versions 5.0 and earlier JBoss EAP versions 5.0 and earlier Description: The issue allows local users to read credentials by listing the process and its arguments, as twiddle.sh in JBoss AS and EAP accepts credentials as command-line...

DEBIAN-CVE-2012-3355

1 AlbumTab.py, 2 ArtistTab.py, 3 LinksTab.py, and 4 LyricsTab.py in the Context module in GNOME Rhythmbox 0.13.3 and earlier allows local users to execute arbitrary code via a symlink attack on a temporary HTML template file in the /tmp/context directory...

PT-2012-2895 · Phpldapadmin · Phpldapadmin

Name of the Vulnerable Software and Affected Versions: phpLDAPadmin versions 1.2.2 and earlier Description: The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the base parameter in a query engine...

PT-2012-1988 · WordPress +1 · Wordpress +1

Name of the Vulnerable Software and Affected Versions: WordPress versions 3.3.1 and earlier Description: The installation component in WordPress generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid. This makes it easier fo...

UBUNTU-CVE-2011-2896

The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gifreadlzw function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadByte function in plug-ins/common/file-gif-load.c in GIMP 2.6.11 and earlier, the LZWReadByte functio...

ESA-2011-021: EMC Data Protection Advisor sensitive information disclosure vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2011-021: EMC Data Protection Advisor sensitive information disclosure vulnerability. EMC Identifier: ESA-2011-021 CVE Identifier: CVE-2011-1742 Severity Rating: CVSS v2 Base Score: 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C Affected products: EMC SW: EMC Dat...

CVE-2009-5064

ldd in the GNU C Library aka glibc or libc6 2.13 and earlier allows local users to gain privileges via a Trojan horse executable file linked with a modified loader that omits certain LDTRACELOADEDOBJECTS checks. NOTE: the GNU C Library vendor states "This is just nonsense. There are a gazillion...

CVE-2007-1783

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2007-1685. Reason: This candidate is a duplicate of CVE-2007-1685. Notes: All CVE users should reference CVE-2007-1685 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

OpenJDK untrusted code allowed to replace DSIG/C14N implementation (6994263)

Unspecified vulnerability in the Java Runtime Environment JRE in Oracle Java SE and Java for Business 6 Update 23 and earlier allows remote attackers to affect availability, related to XML Digital Signature and unspecified APIs. NOTE: the previous information was obtained from the February 2011...

PT-2011-1643 · Cisco · Cisco Asa

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliances ASA 5500 series devices versions prior to 8.32 Description: The issue is related to an unspecified vulnerability in the SIP inspection feature, which allows remote attackers to cause a denial of service by...

PT-2010-4439

Name of the Vulnerable Software and Affected Versions Wind River VxWorks versions 6.x, 5.x, and earlier Description The issue allows remote attackers to read or modify arbitrary memory locations, perform function calls, or manage tasks via requests to UDP port 17185. This is related to a previous...

CVE-2010-2006

Directory traversal vulnerability in op/op.Login.php in LetoDMS formerly MyDMS 1.7.2 and earlier allows remote authenticated users to include and execute arbitrary local files via a .. dot dot in the lang parameter...

httpd: request header information leak

The apreadrequest function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15, when a multithreaded MPM is used, does not properly handle headers in subrequests in certain circumstances involving a parent request that has a body, which might allow remote attackers to obtain...

DEBIAN-CVE-2009-4078

Multiple cross-site scripting XSS vulnerabilities in Redmine 0.8.5 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

JVN#75694913 Roundcube Webmail vulnerable to cross-site request forgery

Roundcube Webmail is an open source webmail client from the Roundcube Webmail Project. Roundcube Webmail contains a cross-site request forgery vulnerability. This issue is different from JVN33820033 and JVN72974205. Impact An attacker may be able to send arbitrary emails. Solution Update the...

DEBIAN-CVE-2009-3379

Multiple unspecified vulnerabilities in libvorbis, as used in Mozilla Firefox 3.5.x before 3.5.4, allow remote attackers to cause a denial of service application crash or possibly execute arbitrary code via unknown vectors. NOTE: this might overlap CVE-2009-2663...

squirrelmail: CSRF issues in all forms

Multiple cross-site request forgery CSRF vulnerabilities in SquirrelMail 1.4.19 and earlier, and NaSMail before 1.7, allow remote attackers to hijack the authentication of unspecified victims via features such as send message and change preferences, related to 1 functions/mailboxdisplay.php, 2...

PT-2009-4942 · Opera · Opera

Name of the Vulnerable Software and Affected Versions: Opera versions 9.64 and earlier Description: The issue allows remote attackers to cause a denial of service, specifically memory consumption, by setting a large integer value for the length property of a Select object. Recommendations: For...

PT-2009-4084 · Ignite Realtime · Openfire

Name of the Vulnerable Software and Affected Versions: Openfire versions prior to 3.6.5 Description: The issue is related to the improper implementation of the register.password also known as canChangePassword console configuration setting. This allows remote authenticated users to bypass the...