osCMax 2.5 - '/admin/information_manager.php?information_id' Cross-Site Scripting

source: https://www.securityfocus.com/bid/52886/info osCMax is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input. Exploiting these vulnerabilities could allow an attacker to steal...

FreeBSD UIPC socket stack overflow-vulnerability warning-the black bar safety net

!/ bin/sh fbsd-uipcsock-heap.sh, by Shaun Colley a, 29/09/11 proof-of-concept crash for the freebsd unix domain sockets heap overflow. this was tested on freebsd 8.2-RELEASE. just a PoC for now. see advisory & patches for details: http://www.securityfocus.com/archive/1/519864/30/0/threaded this P...

Sockso < 1.5.1 Directory Traversal Vulnerability - Active Check

Sockso is prone to a directory traversal vulnerability. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Synology Photo Station 5 DSM 3.2 - photo_one.php Script Cross-Site Scripting

Synology Photo Station 5 DSM 3.2 - photoone.php Script Cross-Site Scripting source: https://www.securityfocus.com/bid/52416/info Synology Photo Station is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input. An attacker may leverage this issue to execute...

TP-Link TL-WR740N 111130 - ping_addr HTML Injection

TP-Link TL-WR740N 111130 - pingaddr HTML Injection source: https://www.securityfocus.com/bid/52424/info TP-LINK TL-WR740N is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data. Attacker-supplied HTML or script code could run in the context of the...

TP-Link TL-WR740N 111130 - 'ping_addr' HTML Injection

source: https://www.securityfocus.com/bid/52424/info TP-LINK TL-WR740N is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data. Attacker-supplied HTML or script code could run in the context of the affected site, potentially allowing the attacker t...

Barracuda CudaTel Communication Server 2.0.029.1 - Multiple HTML Injection Vulnerabilities

source: https://www.securityfocus.com/bid/52358/info Barracuda CudaTel Communication Server is prone to multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data. Attacker-supplied HTML or JavaScript code could run in the context of the affected site,...

Exponent CMS 2.0 - src SQL Injection

Exponent CMS 2.0 - src SQL Injection source: https://www.securityfocus.com/bid/52328/info Exponent CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromi...

Joomla! 2.5.1 - redirect.php Blind SQL Injection

Joomla! 2.5.1 - redirect.php Blind SQL Injection source: https://www.securityfocus.com/bid/52312/info Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to...

11in1 CMS 1.2.1 - 'admin/tps?id' SQL Injection

source: https://www.securityfocus.com/bid/52306/info 11in1 CMS is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the applicatio...

Microsoft RDP Server Private Key Information Disclosure Vulnerability

Remote Desktop Protocol server is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescripti...

GNOME NetworkManager 0.x - Local Arbitrary File Access

GNOME NetworkManager 0.x - Local Arbitrary File Access source: https://www.securityfocus.com/bid/52206/info GNOME NetworkManager is prone to a local arbitrary file-access vulnerability. Local attackers can exploit this issue to read arbitrary files. This may lead to further attacks. NetworkManage...

Fork CMS Cross Site Scripting and Local File Include Vulnerabilities

Fork CMS is prone to multiple cross-site scripting vulnerabilities and a local file include vulnerability. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication...

webgrind 'dataFile' Parameter Cross Site Scripting Vulnerability

webgrind is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to stea...

OpenJDK: KeyboardFocusManager focus stealing (AWT, 7110683)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, 5.0 Update 33 and earlier, and 1.4.235 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality an...

RealNetworks RealPlayer Atrac Sample Decoding Remote Code Execution Vulnerability - Mac OS X

RealPlayer is prone to a remote code execution vulnerability. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

VOXTRONIC Voxlog Professional 3.7.x - 'get.php?v' Arbitrary File Access

source: https://www.securityfocus.com/bid/52081/info VOXTRONIC Voxlog Professional is prone to a file-disclosure vulnerability and multiple SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input. An remote attacker can exploit these issues to obtain potentially...

swDesk Multiple Input Validation Vulnerabilities

swDesk is prone to the following vulnerabilities: 1. An arbitrary file-upload vulnerability. 2. Multiple cross-site scripting vulnerabilities. 3. Multiple PHP code-injection vulnerabilities. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced...

FreePBX Information Disclosure Vulnerability (Feb 2012) - Active Check

FreePBX is prone to an information disclosure vulnerability that may expose administrator SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

11in1 CMS 1.2.1 - Cross-Site Request Forgery (Admin Password)

11in1 CMS 1.2.1 - Cross-Site Request Forgery Admin Password source: https://www.securityfocus.com/bid/52025/info 11in1 is prone to a cross-site request-forgery and a local file include vulnerability. An attacker may leverage these issues to execute arbitrary script code in the browser of an...