Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the MailChimp module 7.x-2.x before 7.x-2.7 for Drupal allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 a predictable "webhook URL key" and 2 improper sanitization of "Webhook variables from POST requests."...

CVE-2012-5551

Multiple cross-site scripting XSS vulnerabilities in the MailChimp module 7.x-2.x before 7.x-2.7 for Drupal allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 a predictable "webhook URL key" and 2 improper sanitization of "Webhook variables from POST requests."...

PT-2012-6021

Name of the Vulnerable Software and Affected Versions MailChimp module versions 7.x-2.x before 7.x-2.7 for Drupal Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The attack vecto...

CVE-2012-5551: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the MailChimp module 7.x-2.x before 7.x-2.7 for Drupal allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 a predictable "webhook URL key" and 2 improper sanitization of "Webhook variables from POST requests."...

SA-CONTRIB-2012-162 - RESTful Web Services - Cross site request forgery (CSRF)

This module enables you to expose Drupal entities as RESTful web services. It provides a machine-readable interface to exchange resources in JSON, XML and RDF. The module doesn't sufficiently verify POST requests thereby exposing a Cross Site Request Forgery vulnerability. This vulnerability is...

Ubuntu 11.04 / 11.10 / 12.04 LTS / 12.10 : python3.2 vulnerabilities (USN-1615-1)

It was discovered that Python distutils contained a race condition when creating the /.pypirc file. A local attacker could exploit this to obtain sensitive information. CVE-2011-4944 It was discovered that SimpleXMLRPCServer did not properly validate its input when handling HTTP POST requests. A...

PHP < 5.3.13, 5.4.x < 5.4.3 Multiple Vulnerabilities - Active Check

PHP is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.103482"...

Limesurvey (PHPSurveyor v.1.91+ stable) Blind SQL Injection

Exploit for php platform in category web applications Exploit Title: LimeSurvey Blind SQL injection Author: TorTukiTu - OpenSphere Version: 1.91+ build 11804 Tested on: php ckeprotectedCckeprotectedC ------------------------------------------------------------------------- TorTukiTu - Killing...

PHP Version 5 Hash Collision Form Parameter Parsing Remote DoS

Binary data php5hashcollisiondos.nbin...

FreeBSD : Multiple implementations -- DoS via hash algorithm collision (91be81e7-3fea-11e1-afc7-2c4138874f7d)

oCERT reports : A variety of programming languages suffer from a denial-of-service DoS condition against storage functions of key/value pairs in hash data structures, the condition can be leveraged by exploiting predictable collisions in the underlying hashing algorithms. The issue finds particul...

Exploit Code Released for ASP.NET Flaw

A few days after MIcrosoft released a patch to fix a vulnerability in ASP.NET that could enable a denial-of-service attack, someone has released exploit code for the vulnerability. The proof-of-concept exploit code was posted to the Full Disclosure mailing list and is available for download from...

Multiple implementations -- DoS via hash algorithm collision

oCERT reports: A variety of programming languages suffer from a denial-of-service DoS condition against storage functions of key/value pairs in hash data structures, the condition can be leveraged by exploiting predictable collisions in the underlying hashing algorithms. The issue finds particula...

Codesys CmpWebServer Multiple Vulnerabilities

Codesys is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

phpmyfaq -- Remote PHP Code Injection Vulnerability

The phpMyFAQ project reports: The phpMyFAQ Team has learned of a serious security issue that has been discovered in our bundled ImageManager library we use in phpMyFAQ 2.6 and 2.7. The bundled ImageManager library allows injection of arbitrary PHP code via POST requests...

GoAhead Webserver multiple stored XSS vulnerabilities

Overview GoAhead Webserver 2.18 and possibly previous or newer versions, are vulnerable to multiple stored and reflective cross site scripting XSS vulnerabilities. Description GoAhead Webserver software fails to sanitize POST requests sent to the multiple functions. As a result, stored and...

IBM Lotus Domino HPRAgentName Parameter Stack Buffer Overflow

A stack buffer overflow vulnerability has been reported in IBM Lotus Domino. IBM Lotus Domino is a software suite which provides enterprise-class messaging, calendaring, and scheduling capabilities for collaborative applications. The vulnerability is due to insufficient input validation by IBM...

Citrix XenApp / XenDesktop XML Service - Heap Corruption

n.runs AG http://www.nruns.com/ securityatnruns.com n.runs-SA-2011.002 28-Jul-2011 Vendor: Citrix, http://www.citrix.com Affected Products: XenApp and XenDesktop Affected Version: See the Citrix security bulletin 2 for a list Vulnerability: Heap Corruption in Citrix XML Service Risk: HIGH Vendor...

Symantec Web Gateway forget.php SQL Injection Vulnerability

This vulnerability allows remote attackers to inject arbitrary SQL on vulnerable installations of the Symantec Web Gateway appliance. Authentication is not required to exploit this vulnerability. The specific flaw exists within the username parameter of POST requests to the forget.php script. The...

IP Power 9258+ Authentication Bypass

| | | | | | | | \ | | | \ | | | \ | | | | | | | | | | | / | / | |,|||/ |,|||,| | \ \ \ | | \ | | | | / / ./ ,||| | |Teach, Learn, Party|Teach, Learn, Party|Teach, Learn, Party| irc.efnet.net unallocatedspace --=+Multiple Remote Exploits in IP Power 9258+=-- by Crypt0s IP Power is a...

IP Power 9258+ Authentication Bypass

Exploit for windows platform in category remote exploits | | | | | | | | \ | | | \ | | | \ | | | | | | | | | | | / | / | |,|||/ |,|||,| | \ \ \ | | \ | | | | / / ./ ,||| | |Teach, Learn, Party|Teach, Learn, Party|Teach, Learn, Party| irc.efnet.net unallocatedspace --=+Multiple Remote...