ASP.NET Core 5-RC1 HTTP Header Injection

COMPASS SECURITY ADVISORY http://www.csnc.ch/en/downloads/advisories.html Product: ASP.NET Core Vendor: Microsoft https://www.microsoft.com CSNC ID: CSNC-2016-006 Subject: HTTP Header Injection Risk: Medium Effect: HTTP Header manipulation Author: Reto Schadler [email protected] Dat...

HPE Network Products Multiple Remote Vulnerabilities (HPSBHF03673)

HPE Comware 5 and Comware 7 network products are prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

JVN#28386124: ClipBucket vulnerable to cross-site scripting

Clipbucket is open source video sharing script. ClipBucket contains a cross-site scripting CWE-79 vulnerability. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update to the latest version according to the information provided by the vendor...

Microsoft Bounty Program expansion - .NET Core and ASP.NET RC2 Beta Bounty

Today I have another exciting expansion of the Microsoft Bounty Program. Please visit https://aka.ms/BugBounty to find out more. As we approach release for .NET Core and ASP.NET, we would like to get even more feedback from the security research community. We are offering a bounty on the .NET Cor...

PT-2016-5017 · Foreman · Foreman

Name of the Vulnerable Software and Affected Versions: Foreman versions prior to 1.10.3 Foreman version 1.11.0 before 1.11.0-RC2 Description: The issue allows remote authenticated users to read, modify, or delete private bookmarks by leveraging the edit bookmarks or destroy bookmarks permission...

Hive 2.0 RC2 XSS / Code Execution / SQL Injection

| Title : Hive v2.0 RC2 Multi Vulnerability | Author : indoushka | email : [email protected] | Dork : "Powered by DigitalHive" | Tested on: windows 8.1 Français V.Pro | Bug : Stop Script | Download : http:///www.digitalhive.com ======================================= Stop SCript working :...

Debian: Security Advisory (DSA-3150-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in templates/2k11/admin/overview.inc.tpl in Serendipity before 2.0-rc2 allow remote attackers to inject arbitrary web script or HTML via a blog comment in the QUERYSTRING to serendipity/index.php...

JVN#91502163: Direct Web Remoting (DWR) vulnerable to XML external entity injection

Direct Web Remoting DWR is a Java framework for developing Ajax into web applications. DWR contains an XML external entity injection vulnerability CWE-611. Impact When an application uses a function to convert DOM data DOMConverter, JDOMConverter, DOM4JConverter or XOMConverter and a specially...

JVN#52422792: Direct Web Remoting (DWR) vulnerable to cross-site scripting

Direct Web Remoting DWR is a Java framework for developing Ajax into web applications. DWR contains a cross-site scripting vulnerability CWE-79. Impact Arbitrary JavaScript may be executed on the user's web browser. Solution Update the Software Update to the latest version of DWR according to the...

CVE-2014-3711

namei in FreeBSD 9.1 through 10.1-RC2 allows remote attackers to cause a denial of service memory exhaustion via vectors that trigger a sandboxed process to look up a large number of nonexistent path names...

CVE-2014-3955

routed in FreeBSD 8.4 through 10.1-RC2 allows remote attackers to cause a denial of service assertion failure and daemon exit via an RIP request from a source not on a directly connected network...

Maintain 3.0.0-RC2 Example6.PHP Remote File Include Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/20560/info Maintain is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to include an arbitrary remote file containing malicious PH...

Caudium 1.x Remote Denial of Service Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/11567/info Caudium is reported prone to a remote denial of service vulnerability. Remote attackers may exploit this vulnerability to crash affected Web servers, denying service to legitimate users. Versions of Caudium pri...

Joomla Component com_extplorer <= 2.0.0 RC2 Local Directory Traversal

No description provided by source. -------------------------------------------------------------------------------------------------------------- ----- H-T Team HouSSaMix + ToXiC350 from MoroCCo ---------------------------------------------------------...

ATutor 1.5.x documentation/admin/index.php XSS

No description provided by source. source: http://www.securityfocus.com/bid/18857/info ATutor is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage any of these issues to...

ProFTPD <= 1.2.9 rc2 (ASCII File) Remote Root Exploit

No description provided by source. ProFTPd remote root exploit solareclipse at phreedom dot org GPG key ID: E36B11B7 http://www.exploit-db.com/sploits/12262006-proftpd-not-pro-enough.tar.gz milw0rm.com 2003-10-15...

Mambo/Joomla Com_comprofiler 1.0 Plugin.class.PHP Remote File Include Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/19725/info The Mambo and Joomla comcomprofiler component is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to include arbitrary...

Dokeos 2.2 RC2 (index.php, language param) - SQL Injection

No description provided by source. 验证链接： http://host/index.php?language=0%27%20UNION%20SELECT%201,2,3,4,version %28%29,6,7,8%20--%202...

Simple Machines Forum <= 1.1 rc2 (lngfile) Remote Exploit (windows)

No description provided by source. !/usr/bin/php -q -d shortopentag=on ? printr' -------------------------------------------------------------------------------- Simple Machines Forum = 1.1 rc2 lngfile ZendHashDelKeyOrIndex/arbitrary local inclusion exploit Win boxes by rgod [email protected]...