PYSEC-2011-28

The administrative interface in django.contrib.admin in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not properly restrict use of the query string to perform certain object filtering, which allows remote authenticated users to obtain sensitive information via a series...

Atlassian JIRA < 4.1.2 Multiple Vulnerabilities

Binary data 5577.prm...

tomcat5 security update

CentOS Errata and Security Advisory CESA-2009:1164 Updated tomcat packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Apache Tomcat is a servlet container...

[oCERT-2009-010] mimeTeX and mathTeX buffer overflows and command injection

2009-010 mimeTeX and mathTeX buffer overflows and command injection Description: The mimeTeX and mathTeX CGIs are widely used helper executables that allow mathematical equation rendering in the form of images. Both applications suffer from several buffer overflows as well as command injection...

UBUNTU-CVE-2009-1553

Multiple cross-site scripting XSS vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow remote attackers to inject arbitrary web script or HTML via the query string to 1 applications/applications.jsf, 2 configuration/configuration.jsf, 3 customMBeans/customMBeans.jsf, ...

codeigniter-multi.txt

CodeIgniter is a powerful PHP framework with a very small footprint, built for PHP coders who need a simple and elegant toolkit to create full-featured web applications. http://www.codeigniter.com 1. sanitizeglobals global variables unsetting By setting e.g. "SERVER=anonymous" cookie in the...

CVE-2007-3422

The getcgi function in cgi-bin/cgi-lib/subs.pl in web-app.org WebAPP before 0.9.9.7 attempts to parse query strings that contain 1 non-printing characters, 2 certain printing characters that do not commonly occur in URLs, or 3 invalid URL encoding sequences, which has unknown impact and remote...

PT-2006-6339 · Ig · Ig Shop

Name of the Vulnerable Software and Affected Versions: iG Shop version 1.4 Description: The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via arbitrary query strings in the change pass.php file when the action...

Ubuntu 4.10 / 5.04 / 5.10 : mysql-dfsg vulnerability (USN-274-1)

A logging bypass was discovered in the MySQL query parser. A local attacker could exploit this by inserting NUL characters into query strings even into comments, which would cause the query to be logged incompletely. This only affects you if you enabled the 'log' parameter in the MySQL...

security flaw

Cross-site scripting XSS vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message...

InterScan VirusWall Remote Configuration Vulnerability

The management interface used with the Interscan VirusWall uses several cgi programs that may allow a malicious user to remotely change the configuration of the server without any authorization using maliciously constructed querystrings. SPDX-FileCopyrightText: 2001 INTRANODE Some text descriptio...

CVE-2004-1837

Cross-site scripting XSS vulnerability in Modsurvey 3.0.x before 3.0.16-pre2 and 3.2.x before 3.2.0-pre4 allows remote attackers to inject arbitrary web script or HTML via the certain survey fields or error messages for malformed query strings...

PHP-Nuke 5.6 - modules.php SQL Injection

PHP-Nuke 5.6 - modules.php SQL Injection source: https://www.securityfocus.com/bid/6088/info A SQL injection vulnerability has been reported for PHP-Nuke 5.6. The vulnerability is due to insufficient sanitization of variables used to construct SQL queries in some scripts. It is possible to modify...