7397 matches found
CVE-2008-1386
Multiple cross-site scripting XSS vulnerabilities in the installer in Serendipity S9Y 1.3 allow remote attackers to inject arbitrary web script or HTML via 1 unspecified path fields or 2 the database host field. NOTE: the timing window for exploitation of this issue might be limited...
CVE-2008-1386
CVE-2008-1386 affects Serendipity (S9Y) 1.3 and its installer, where multiple XSS vulnerabilities exist in the installer (via unspecified path fields and the database host field) and in the referrer plugin of the blog application. The underlying issue is improper escaping that allows injection of...
CVE-2008-1386
Multiple cross-site scripting XSS vulnerabilities in the installer in Serendipity S9Y 1.3 allow remote attackers to inject arbitrary web script or HTML via 1 unspecified path fields or 2 the database host field. NOTE: the timing window for exploitation of this issue might be limited...
[Full-disclosure] Cross site scripting issues in s9y (CVE-2008-1386, CVE-2008-1387)
Two smaller issues in s9y, published here: http://int21.de/cve/CVE-2008-1386-s9y.html http://int21.de/cve/CVE-2008-1387-s9y.html Cross Site Scripting XSS in serendipity 1.3 referrer plugin, CVE-2008-1385 References https://vulners.com/cve/CVE-2008-1385 http://www.s9y.org/ Description In the...
serendipity -- multiple cross site scripting vulnerabilities
Hanno Boeck reports: The installer of serendipity 1.3 has various Cross Site Scripting issues. This is considered low priority, as attack scenarios are very unlikely. Various path fields are not escaped properly, thus filling them with javascript code will lead to XSS. MySQL error messages are no...
AIX 530007 : U813870
The remote host is missing AIX PTF U813870 which is related to the security of the package devices.pci.14107802.rte You should install this PTF for your system to be up-to-date. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if ! definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc'...
CVE-2007-6536
The Custom Button Installer dialog in Google Toolbar 4 and 5 beta presents certain domain names in the 1 "Downloaded from" and 2 "Privacy considerations" sections without verifying domain names, which makes it easier for remote attackers to spoof domain names and trick users into installing...
CVE-2007-6536
The Custom Button Installer dialog in Google Toolbar 4 and 5 beta presents certain domain names in the 1 "Downloaded from" and 2 "Privacy considerations" sections without verifying domain names, which makes it easier for remote attackers to spoof domain names and trick users into installing...
CVE-2007-6536
The CVE-2007-6536 issue affects Google Toolbar 4 and 5 beta where the Custom Button Installer dialog may display domain names in the “Downloaded from” and “Privacy considerations” fields without validating them. The root cause is lack of domain verification, enabling remote attackers to spoof dom...
Ubuntu 6.06 LTS / 6.10 / 7.04 : php5 vulnerabilities (USN-462-1)
A flaw was discovered in the FTP command handler in PHP. Commands were not correctly filtered for control characters. An attacker could issue arbitrary FTP commands using specially crafted arguments. CVE-2007-2509 Ilia Alshanetsky discovered a buffer overflow in the SOAP request handler in PHP...
Ubuntu 6.06 LTS : Installer vulnerability (USN-316-1)
Iwan Pieterse discovered that, if you select 'Go Back' at the final message displayed by the alternate or server CD installer 'Installation complete' and then continue with the installation from the installer's main menu, the root password is left blank rather than locked. This was due to an erro...
CVE-2002-2361
The installer in Yahoo! Messenger 4.0, 5.0 and 5.5 does not verify package signatures which could allow remote attackers to install trojan programs via DNS spoofing...
CVE-2002-2361
The vulnerability CVE-2002-2361 affects Yahoo! Messenger installers (versions 4.0, 5.0, 5.5). The root cause is that the installer does not verify package signatures, allowing a remote attacker to substitute a trojan-laden package via DNS spoofing. Practical impact is installation of unauthentica...
CVE-2003-1422
Technical details for CVE-2003-1422 are not provided in the supplied documents; no concrete affected products, versions, or remediation are disclosed. Monitor for updates.
CVE-2003-1422
Multiple unspecified vulnerabilities in the installer for SYSLINUX 2.01, when running setuid root, allow local users to gain privileges via unknown vectors...
drupal --- multiple vulnerabilities
The Drupal Project reports: In some circumstances Drupal allows user-supplied data to become part of response headers. As this user-supplied data is not always properly escaped, this can be exploited by malicious users to execute HTTP response splitting attacks which may lead to a variety of...
SA-2007-025 - Drupal core - Arbitrary code execution via installer.
The Drupal installer allows any visitor to provide credentials for a database when the site's own database is not reachable. This allows attackers to run arbitrary code on the site's server. An immediate workaround is the removal of the file install.php in the Drupal root directory. Versions...
Design/Logic Flaw
administrator/index.php in the installer component cominstaller in Joomla! 1.5 Beta1, Beta2, and RC1 allows remote authenticated administrators to upload arbitrary files to tmp/ via the "Upload Package File" functionality, which is accessible when cominstaller is the value of the option parameter...
CVE-2007-4781
administrator/index.php in the installer component cominstaller in Joomla! 1.5 Beta1, Beta2, and RC1 allows remote authenticated administrators to upload arbitrary files to tmp/ via the "Upload Package File" functionality, which is accessible when cominstaller is the value of the option parameter...
CVE-2007-4781
CVE-2007-4781 affects Joomla! 1.5 Beta1, Beta2, and RC1, where the installer component (com_installer) allows remote authenticated administrators to upload arbitrary files to the tmp/ directory via the Upload Package File function when com_installer is selected as the option. This vulnerability e...