YaBB 9.1.2000 Cross-Agent Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/3828/info YaBB Yet Another Bulletin Board is freely available web forums/community software that is written in Perl. YaBB will run on most Unix/Linux variants, MacOS, and Microsoft Windows 9x/ME/NT/2000/XP platforms. YaBB...

dsock <= 1.3 (buf) Remote Buffer Overflow PoC

No description provided by source. !-- dsock = 1.3 buf Remote Buffer Overflow PoC Original Author: Michael Adams parasite a sdf.lonestar.org A buffer overflow in variable 'buf' exists due to insufficient validation of variable 'name' in function torresolve line 218 of software at...

Viscosity setuid-set ViscosityHelper Privilege Escalation

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex' require...

Cogent DataHub Web Server GetPermissions.asp Command Injection (CVE-2014-3789)

A remote command injection vulnerability has been reported in Cogent DataHub. The vulnerability is due to insufficient validation within the GetPermissions.asp page. A remote attacker can exploit this vulnerability by submitting a maliciously crafted request to GetPermissions.asp. This can result...

Eppler Software WebTester install2.php Script Command Execution

A command execution vulnerability has been reported in Eppler Software WebTester 5.x. The vulnerability is due to insufficient validation of the 'cpusername', 'cppassword' and 'cpdomain' parameters provided by the user. A remote unauthenticated attacker could exploit this vulnerability by sending...

gnutls26 security update

Package : gnutls26 Version : 2.8.6-1+squeeze4 CVE ID : CVE-2014-3466 Joonas Kuorilehto discovered that GNU TLS performed insufficient validation of session IDs during TLS/SSL handshakes. A malicious server could use this to execute arbitrary code or perform denial or service...

gnutls26 security update

Package : gnutls26 Version : 2.8.6-1+squeeze4 CVE ID : CVE-2014-3466 Joonas Kuorilehto discovered that GNU TLS performed insufficient validation of session IDs during TLS/SSL handshakes. A malicious server could use this to execute arbitrary code or perform denial or service...

ownCloud Multiple Cross Site Scripting Vulnerabilities -02 (May 2014)

ownCloud is prone to multiple cross-site scripting vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

ownCloud Multiple Cross-Site Scripting & Directory Traversal Vulnerabilities

ownCloud is prone to session fixation vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud"; if...

Oracle Java FileDialog.Show Heap Buffer Overflow - Ver2 (CVE-2011-0802)

A remote code execution vulnerability has been reported in Oracle Java Runtime Environment.The vulnerability is due to insufficient validation of the selected file's default values size. A remote attacker could exploit this vulnerability by enticing an unsuspecting user to open a web page...

HP LoadRunner Virtual User Generator saveCodeRuleFile Directory Traversal (CVE-2013-4838)

A directory traversal vulnerability exists in HP LoadRunner Virtual User Generator. The vulnerability exists in the EmulationAdmin web service. The vulnerability is due to insufficient validation on the parameters of saveCodeRuleFile method sent via SOAP requests. A remote unauthenticated attacke...

Cisco WebEx Player ATAS32.DLL Remote Code Execution (CVE-2011-4004)

A remote code execution vulnerability has been reported in Cisco WebEx Player. The vulnerability is due to insufficient validation of some values in record Type 0x1F and Type 0xBB while processing WebEx Recording Format WRF files. A remote unauthenticated attacker can leverage this vulnerability ...

Zen Cart Multiple Vulnerabilities (Feb 2014)

Zen Cart is prone to multiple vulnerabilities. Copyright C 2014 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Cisco Context Directory Agent Replayed RADIUS Accounting Message Vulnerability

A vulnerability in RADIUS message processing of Cisco Context Directory Agent CDA could allow an unauthenticated, remote attacker to affect the contents of the CDA cache. The vulnerability is due to insufficient validation of RADIUS accounting messages. An attacker could exploit this vulnerabilit...

SQL Injection in appRain

Advisory ID: HTB23177 Product: appRain Vendor: appRain Vulnerable Versions: 3.0.2 and probably prior Tested Version: 3.0.2 Advisory Publication: October 9, 2013 without technical details Vendor Notification: October 9, 2013 Public Disclosure: November 6, 2013 Vulnerability Type: SQL Injection...

[SECURITY] [DSA 2776-1] drupal6 security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2776-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff October 11, 2013 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2776-1] drupal6 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2776-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff October 11, 2013 http://www.debian.org/security/faq -...

Debian: Security Advisory (DSA-2776-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2013-70: Multiple Cross-Site Scripting (XSS) in Serv-U File Server

The specialists of the Positive Research center have detected Multiple Cross-Site Scripting vulnerabilities in Serv-U File Server. The application does not perform sufficient validation of parameters, which are sent by client and used in HTM scripts. This vulnerability allows an attacker to execu...

Ukrainian Banking App Vulnerable to Attack

Privat24, the mobile banking application for Ukraine’s largest commercial bank, contains an insufficient validation vulnerability in its iOS, Android, and Windows phone apps that could give an attacker the ability to steal money from user accounts after bypassing its two-factor authentication...