CiscoWorks Common Services 3.1.1 - Auditing Directory Traversal

source: https://www.securityfocus.com/bid/47905/info CiscoWorks Common Services is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input. A remote attacker could exploit this vulnerability using directory-traversal strings such as '../' to gain...

PHP Directory Listing Script 3.1 - index.php Cross-Site Scripting

PHP Directory Listing Script 3.1 - index.php Cross-Site Scripting source: https://www.securityfocus.com/bid/47727/info PHP Directory Listing is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execut...

LotusCMS 3.0.3 - Multiple Vulnerabilities

Vulnerability ID: HTB22886 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinlotuscms.html Product: LotusCMS Vendor: Arboroia Network http://www.lotuscms.org/ Vulnerable Version: 3.0.3 and probably prior versions Vendor Notification: 01 March 2011 Vulnerability Type: CSRF Cross-Site Request...

PT-2011-1075 · Suse +2 · Suse Linux Enterprise +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 2.6.36 Description: The issue is related to the cifs find smb ses function in fs/cifs/connect.c, which does not properly determine the associations between users and sessions. This allows local users to bypass...

DEBIAN-CVE-2011-0490

Tor before 0.2.1.29 and 0.2.2.x before 0.2.2.21-alpha makes calls to Libevent within Libevent log handlers, which might allow remote attackers to cause a denial of service daemon crash via vectors that trigger certain log messages...

flash-plugin: security bulletin APSB10-26

Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service memory corruption via unknown vectors, a different vulnerability...

SoftX FTP Client 3.3 Directory Traversal

Vulnerability ID: HTB22541 Reference: http://www.htbridge.ch/advisory/directorytraversalinsoftxftpclient.html Product: SoftX FTP Client Vendor: SoftX.Org http://www.softx.org/ftp.html Vulnerable Version: 3.3 for windows and Probably Prior Versions Vendor Notification: 27 July 2010 Vulnerability...

Allinta CMS 22.07.2010 - Multiple SQL Injections / Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/42320/info Allinta CMS is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these vulnerabilities could allow an attacker to steal...

cPanel XSS Vulnerability

cPanel 11.25 is vulnerable to an XSS exploit as it fails to clean user-supplied input. All versions prior to 47010 are affected. Please note that whilst this vulnerability is patched in version 47010, 47010 is currently on the bleeding-edge and isn't recommended for the stable environment...

PT-2010-1186 · Michaelliao · Openid

Name of the Vulnerable Software and Affected Versions: michaelliao jopenid versions prior to 1.08 Description: The issue is related to a timing discrepancy in the getAuthentication function of the OpenIdManager.java file. This discrepancy can be exploited by a remote attacker to gain unauthorized...

CMSQLite SQL Injection Vulnerability

Exploit for php platform in category web applications ==================================== CMSQLite SQL Injection Vulnerability ==================================== Product: CMSQLite Vendor: CMSQLite-Team Vulnerable Version: 1.3 and Probably Prior Versions June 2010 Vulnerability Type: SQL...

XSS vulnerability in CruxPA

Vulnerability ID: HTB22449 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityincruxpa.html Product: CruxPA Vendor: CruxSoftware Vulnerable Version: 2.00 and Probably Prior Versions Vendor Notification: 21 June 2010 Vulnerability Type: XSS Cross Site Scripting Status: Not Fixed, Vendor...

PT-2010-3390 · Apple · Ios +1

Name of the Vulnerable Software and Affected Versions: Apple iOS versions prior to 4 Description: A stack-based buffer overflow issue in CFNetwork allows remote attackers to execute arbitrary code or cause a denial of service, specifically an application crash, via vectors related to URL handling...

Acroread: Multiple code execution flaws (APSB10-09)

Adobe Reader and Acrobat 9.x before 9.3.2, and 8.x before 8.2.2 on Windows and Mac OS X, allow attackers to cause a denial of service memory corruption or execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2010-0194, CVE-2010-0197, and CVE-2010-0201...

httpd: request header information leak

The apreadrequest function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15, when a multithreaded MPM is used, does not properly handle headers in subrequests in certain circumstances involving a parent request that has a body, which might allow remote attackers to obtain...

Zenoss 2.3.3 - Multiple Cross-Site Request Forgery Vulnerabilities

Zenoss 2.3.3 - Multiple Cross-Site Request Forgery Vulnerabilities source: https://www.securityfocus.com/bid/37843/info Zenoss is prone to multiple cross-site request-forgery vulnerabilities. Exploiting these issues may allow a remote attacker to perform certain administrative actions, execute...

PT-2009-5890 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 2.6.27.22 Description: The issue allows remote attackers to cause a denial of service, resulting in IOMMU space exhaustion and system crash. This can be achieved by using jumbo frames for a large amount of netwo...

Apple iTunes 9.0 - .pls Buffer Overflow

Apple iTunes 9.0 - .pls Buffer Overflow source: https://www.securityfocus.com/bid/36478/info Apple iTunes is prone to a buffer-overflow vulnerability because the software fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer. An attacker can exploit this...

PT-2009-1036 · Mimetex +1 · Mimetex +1

Name of the Vulnerable Software and Affected Versions: mimetex versions prior to 20090713 Description: The issue concerns multiple unspecified vulnerabilities in mimetex. These vulnerabilities are related to the environ, input, and counter TeX directives and may allow for remote exploitation,...

PT-2009-4302 · Mozilla +1 · Firefox +1

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions prior to 3.0.11 Description: A race condition in the NPObjWrapper NewResolve function might allow remote attackers to execute arbitrary code via a page transition during Java applet loading, related to a use-after-fre...