Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the nodereference module in Drupal Content Construction Kit CCK before 4.7.x-1.6, and 5.x before 5.x-1.6 ,allow remote attackers to inject arbitrary web script or HTML via nodereference fields, when using 1 the plain formatter or 2 the...

CVE-2007-4363

CVE-2007-4363 affects the Drupal Content Construction Kit (CCK) nodereference module. The vulnerability exists in nodereference fields when using (1) the plain formatter or (2) the autocomplete text field widget without Views.module, allowing remote attackers to inject arbitrary web script or HTM...

CVE-2007-4363: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in the nodereference module in Drupal Content Construction Kit CCK before 4.7.x-1.6, and 5.x before 5.x-1.6 ,allow remote attackers to inject arbitrary web script or HTML via nodereference fields, when using 1 the plain formatter or 2 the...

CVE-2007-3930

Interpretation conflict between Microsoft Internet Explorer and DocuWiki before 2007-06-26b allows remote attackers to inject arbitrary JavaScript and conduct cross-site scripting XSS attacks when spellchecking UTF-8 encoded messages via the spellutf8test function in lib/exe/spellcheck.php, which...

[Full-disclosure] heise Security: Password exposure in Lotus Notes

Excerpt from: http://www.heise-security.co.uk/news/92958 ------ Password exposure in Lotus Notes A debug function in version 5 and up of Lotus Notes can be used to write a file containing the new password in plain text when a user password is changed. This function has been designed to bring more...

Important: gnupg security update

1.4.5-13 - incorporate patch from Werner to work around clients which can't tell that multiple plain messages have been processed 230457...

Juniper Networks IVE OS LDAP Referrals TLS明文密码漏洞

Juniper IVE OS是一款即时虚拟外网技术，用于安全访问SSL VPN设备。 使用TLS的Juniper IVE OS存在密码泄露问题，远程攻击者可以利用漏洞获得明文密码信息对系统进行进一步攻击。 攻击者可以通过嗅探网络通信获得用户敏感信息。目前没有详细漏洞细节提供。 Juniper Networks IVE OS 6.0 Juniper Networks IVE OS 5.4 目前没有详细解决方案提供： http://www.juniper.net...

Microsoft Windows Win32 API fails to properly validate function parameters

Overview The Microsoft Windows Win32 API fails to properly validate function parameters, which could allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description The Microsoft Windows Win32 API is a set of application programming interfaces for the...

Vulnerability in Credant Mobile Guardian Shield for Windows

Vulnerability in Credant Mobile Guardian Shield for Windows Vendor: Credant Technologies Inc. http://www.credant.com/ Product: Credant Mobile Guardian Shield for Windows Version: 5.2.1.105 and prior Affected Operating Systems: Windows XP SP2 and likely others Product Overview: Credant Technologie...

CVE-2007-2746: Undefined Security Weakness

The viewList function in lib/WebGUI/Asset/Wobject/DataForm.pm in Plain Black WebGUI before 7.3.14 does not properly use data structures containing privilege information, which allows remote authenticated users to obtain sensitive information or possibly have other unspecified impact...

Chatness <= 2.5.3 (options.php/save.php) Remote Code Execution Exploit

Exploit for unknown platform in category web applications ====================================================================== Chatness = 2.5.3 options.php/save.php Remote Code Execution Exploit ====================================================================== ?/ Files: options.php, save.p...

Chatness 2.5.3 - options.phpsave.php Remote Code Execution

Chatness 2.5.3 - options.phpsave.php Remote Code Execution ?/ Files: options.php, save.php Affects: Chatness = 2.5.3 Date: 12th April 2007 Issue Description: =========================================================================== Chatness suffers with two main vulnerabilities, the first of...

Important: gnupg security update

1.2.6-9 - incorporate backport of patch from Werner to work around clients which can't tell that multiple plain messages have been processed 230456...

CVE-2006-7037

Mathcad 12 through 13.1 allows local users to bypass the security features by directly accessing or editing the XML representation of the worksheet with a text editor or other program, which allows attackers to 1 bypass password protection by replacing the password field with a hash of a known...

CVE-2007-1068

The CVE-2007-1068 entry describes a credential leakage issue where authentication credentials used by Cisco Secure Services Client (CSSC) 4.x, Trust Agent 1.x/2.x, Cisco Security Agent (CSA) 5.0/5.1 (with vulnerable Trust Agent), and Meetinghouse AEGIS SecureConnect Client are stored in plaintext...

Directory traversal

Directory traversal vulnerability in the Plain Old Webserver POW add-on before 0.0.9 for Mozilla Firefox allows remote attackers to read arbitrary files via a .. dot dot in the URI...

EUVD-2007-0868

Directory traversal vulnerability in the Plain Old Webserver POW add-on before 0.0.9 for Mozilla Firefox allows remote attackers to read arbitrary files via a .. dot dot in the URI...

CVE-2007-0872: Undefined Security Weakness

Directory traversal vulnerability in the Plain Old Webserver POW add-on before 0.0.9 for Mozilla Firefox allows remote attackers to read arbitrary files via a .. dot dot in the URI...

RHEL 2.1 / 3 / 4 : fetchmail (RHSA-2007:0018)

Updated fetchmail packages that fix two security issues are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Fetchmail is a remote mail retrieval and forwarding utility. A denial of service flaw was found when Fetchmail was run in...

Information disclosure

The wwwpurgeList method in Plain Black WebGUI before 7.3.8 does not properly check user permissions, which allows attackers to delete unauthorized assets. NOTE: some of these details are obtained from third party information...