Authentication bypass and file manipulation in Sitecore Staging Module 5.4.0

No description provided by source. SEC Consult Security Advisory 20091217-0 ========================================================================== title: Authentication bypass and file manipulation in Sitecore Staging Module products: Sitecore Staging Module vulnerable version: Sitecore Stagi...

Sitecore Staging Module Authentication Bypass

SEC Consult Security Advisory ========================================================================== title: Authentication bypass and file manipulation in Sitecore Staging Module products: Sitecore Staging Module vulnerable version: Sitecore Staging Module = 5.4.0 rev.080625 fixed version:...

Authentication bypass+file manipulation in Sitecore Staging Mod 5.4.0

Exploit for unknown platform in category web applications ============================================================================ Authentication bypass and file manipulation in Sitecore Staging Module 5.4.0 ============================================================================ SEC...

SEC Consult SA-20091217-0 :: Authentication bypass and file manipulation in Sitecore Staging Module

SEC Consult Security Advisory 20091217-0 ========================================================================== title: Authentication bypass and file manipulation in Sitecore Staging Module products: Sitecore Staging Module vulnerable version: Sitecore Staging Module = 5.4.0 rev.080625 fixed...

Sitecore Staging Module 5.4.0 - Authentication Bypass File Manipulation

Sitecore Staging Module 5.4.0 - Authentication Bypass File Manipulation SEC Consult Security Advisory ========================================================================== title: Authentication bypass and file manipulation in Sitecore Staging Module products: Sitecore Staging Module vulnerab...

Sitecore Staging Module 5.4.0 - Authentication Bypass / File Manipulation

SEC Consult Security Advisory ========================================================================== title: Authentication bypass and file manipulation in Sitecore Staging Module products: Sitecore Staging Module vulnerable version: Sitecore Staging Module = 5.4.0 rev.080625 fixed version:...

Bundled infection ideas implemented-vulnerability warning-the black bar safety net

This is the written bundle of infection, scribbled ideas recorded, originally wanted to write a detailed tutorial, but see the current situation is a complete no. Made a bundle ， the effect is quite good is not difficult slightly recording ...learned this ideas of your own then do also not...

Design/Logic Flaw

Argument injection vulnerability in the sendmail implementation of the Mail::Send method Mail/sendmail.php in the Mail package 1.1.14 for PEAR allows remote attackers to read and write arbitrary files via a crafted $from parameter, a different vector than CVE-2009-4111...

CVE-2009-4111

Argument injection vulnerability in Mail/sendmail.php in the Mail package 1.1.14, 1.2.0b2, and possibly other versions for PEAR allows remote attackers to read and write arbitrary files via a crafted $recipients parameter, and possibly other parameters, a different vulnerability than CVE-2009-402...

CVE-2009-3898

Directory traversal vulnerability in src/http/modules/ngxhttpdavmodule.c in nginx aka Engine X before 0.7.63, and 0.8.x before 0.8.17, allows remote authenticated users to create or overwrite arbitrary files via a .. dot dot in the Destination HTTP header for the WebDAV 1 COPY or 2 MOVE method...

GLSA-200911-02 : Sun JDK/JRE: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200911-02 Sun JDK/JRE: Multiple vulnerabilities Multiple vulnerabilities have been reported in the Sun Java implementation. Please review the CVE identifiers referenced below and the associated Sun Alerts for details. Impact : A...

Code injection

Multiple unspecified vulnerabilities in the 1 UNIX and 2 Linux backup-archive clients, and the 3 OS/400 API client, in IBM Tivoli Storage Manager TSM 5.3 before 5.3.6.6, 5.4 before 5.4.2, and 5.5 before 5.5.1, when the MAILPROG option is enabled, allow attackers to read, modify, or delete arbitra...

CVE-2009-3855

In the provided documents, CVE-2009-3855 refers to multiple unspecified vulnerabilities in the IBM Tivoli Storage Manager (TSM) backups clients (UNIX/Linux) and the OS/400 API client. Affected versions are TSM 5.3 prior to 5.3.6.6, 5.4 prior to 5.4.2, and 5.5 prior to 5.5.1, with exploitation ass...

Multiple Browsers Telnet URI Handler File Manipulation (CVE-2004-0411; CVE-2004-0473)

There exists a vulnerability that affects various web-browsers. Insufficient input validation for telnet URI e.g., telnet://hostname can cause the Telnet software activated by the browsers to treat specially crafted Telnet URI as command-line options. As such, a malicious attacker may be able to...

Firefox 3.5.x < 3.5.4 Multiple Vulnerabilities

The installed version of Firefox 3.5 is earlier than 3.5.4. Such versions are potentially affected by the following security issues : - It may be possible for a malicious web page to steal form history. MFSA 2009-52 - By predicting the filename of an already downloaded file in the downloads...

Safari Archive Metadata Command Execution

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3...

CVE-2009-3573

CVE-2009-3573 affects EMC Captiva PixTools Distributed Imaging 2.2, specifically the PDIControl.PDI.1 ActiveX (PDIControl.dll) 2.2. The vulnerability arises from insecure methods SetLogFileName and WriteToLog, which allow remote attackers to create or overwrite arbitrary files via the affected Co...

CVE-2009-3573

Multiple insecure method vulnerabilities in the PDIControl.PDI.1 ActiveX control PDIControl.dll 2.2.3160.0 in EMC Captiva PixTools Distributed Imaging 2.2 allow remote attackers to create or overwrite arbitrary files via the 1 SetLogFileName and 2 WriteToLog methods...

CVE-2009-3478

Argument injection vulnerability in 1 src/content/js/connection/sftp.js and 2 src/content/js/connection/controlSocket.js.in in FireFTP Extension 1.0.5 for Firefox allows remote authenticated SFTP users to cause victims to alter permissions, delete, download, or move the wrong file via a filename...

SuSE9 Security Update : Java2 (YOU Patch Number 12206)

Sun Java was updated to 1.4.2u18 to fix following security vulnerabilities : - Unspecified vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.218 allows context-dependent attackers to obtain sensitive informatio...