RARLAB WinRar 2.90/3.x UUE/XXE Invalid Filename Error Message Format String

No description provided by source. source: http://www.securityfocus.com/bid/15062/info WinRAR is prone to multiple remote vulnerabilities. These issues include a format string and a buffer overflow vulnerability. Successful exploitation may allow an attacker to execute arbitrary code on a...

BRS WebWeaver 0.x FTP Root Path Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2676/info BRS WebWeaver is an ftpd and webserver from Blaine Southam. WebWeaver's FTP component has a flaw which can permit a remote user to learn the physcial path to the FTP service's root directory. By submitting the F...

Joomla 3.2.1 - SQL Injection Vulnerability

No description provided by source. Exploit Title: Joomla 3.2.1 sql injection Date: 05/02/2014 Exploit Author: [email protected] Vendor Homepage: http://www.joomla.org/ Software Link: http://joomlacode.org/gf/download/frsrelease/19007/134333/Joomla3.2.1-Stable-FullPackage.zip Version: 3.2.1 default...

TIPS MailPost 5.1.1 Error Message Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/11598/info MailPost is reported prone to a cross-site scripting vulnerability. This issue presents itself due to insufficient sanitization of user-supplied data and can allow an attacker to execute arbitrary HTML and scri...

Virtual Hosting Control System 2.2/2.4 Error Message Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/15538/info Virtual Hosting Control System is prone to cross-site scripting attacks. The vulnerability arises when error messages are rendered and could let an attacker inject hostile HTML and script code into the browser...

Microsoft Internet Explorer 6.0 Resource Detection Weakness

No description provided by source. source: http://www.securityfocus.com/bid/11026/info Microsoft Internet Explorer is prone to a security weakness that may permit an attacker to determine the existence of resources on a vulnerable computer. An attacker can use an IFRAME that is accessible within...

TOPO 1.41 Remote Path Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/6768/info It has been reported that TOPo may return information to users that is sensitive in nature. Under some circumstances, it is possible to produce an error message that reveals information about web directory...

Round Cube Webmail 0.1 -20051021 Path Disclosure Weakness

No description provided by source. source: http://www.securityfocus.com/bid/15920/info Round Cube will reportedly reveal its installation path in an error message output to the client. The filesystem layout can be sensitive information that is useful in other attacks against the target server. Th...

M-TECH P-Synch 6.2.5 Path Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7740/info Reportedly an attacker may make a malicious HTTP request for specific P-Synch executables passing an empty URI parameter to trigger the condition. Although unconfirmed, it is likely that the request will cause...

Quicktime Player <= 7.3.1.70 (rtsp) Buffer Overflow Vulnerability

No description provided by source. Luigi Auriemma Application: Quicktime Player http://www.apple.com/quicktime Versions: = 7.3.1.70 Platforms: Windows and Mac Bug: buffer-overflow Exploitation: remote Date: 10 Jan 2008 Thanx to: swirl for the help during the re-testing of the bug Author: Luigi...

HostAdmin 0 Path Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/8401/info HostAdmin is prone to a path disclosure vulnerability. Passing invalid data to the HostAdmin site will cause an error message to be displayed, which contains installation path information...

CXF: HTML content posted to SOAP endpoint could cause OOM errors

A denial of service flaw was found in the way Apache CXF created error messages for certain POST requests. A remote attacker could send a specially crafted request which, when processed by an application using Apache CXF, could consume an excessive amount of memory on the system, possibly...

RelateIQ: SSRF (Portscan) via Register Function (Custom Server)

Hi, the custom server option during registration allows performing portscans or "Server Side Request Forgery" from "relateiq" systems to external and potential internal systems. the following is a sample request used excluding cookies: POST /app/GWT.rpc HTTP/1.1 Host: app.relateiq.com User-Agent:...

openSUSE Security Update : mozilla-nss (openSUSE-2011-100) (BEAST)

Added a patch to fix errors in the pkcs11n.h header file. bmo702090 - update to 3.13.1 RTM - better SHA-224 support bmo647706 - fixed a regression causing hangs in some situations introduced in 3.13 bmo693228 - update to 3.13.0 RTM - SSL 2.0 is disabled by default - A defense against the SSL 3.0...

Operation was canceled by user

Challenge Job fails with error message: Error Operation was canceled by user Cause The two main causes of this error are: 1. A backup window has been configured within the job. 2. The user canceled the job. Solution If the issue was caused by a backup window, please reconfigure the backup window...

Localize: Bug on registration as new Translator user

It tells me "Please make sure to enter a valid password and to re-type the verification correctly", I selected "Translator", entered my username as "tarzxvf", entered the password as "tarzxvfismypassword" im just wondering where the verification is? And my suggestion you can use modal when tellin...

Design/Logic Flaw

DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, allows remote attackers to obtain sensitive information via a .. dot dot in the "l" parameter, which reveals the installation path in an error message...

CVE-2013-4728

DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, allows remote attackers to obtain sensitive information via a .. dot dot in the "l" parameter, which reveals the installation path in an error message...

CVE-2013-1804

Multiple cross-site scripting XSS vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to inject arbitrary web script or HTML via the 1 highlight parameter to forum/viewthread.php; or remote authenticated users with certain permissions to inject arbitrary web script or HTML via the...

CVE-2014-2890

Cross-site scripting XSS vulnerability in the wraphtml function in MyID.php in phpMyID 0.9 allows remote attackers to inject arbitrary web script or HTML via the openiderror parameter to MyID.config.php when the openid.mode parameter is set to error, which is not properly handled in an error...