Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in apps/common/templates/calculateformtitle.html in Mayan EDMS 0.13 allow remote authenticated users to inject arbitrary web script or HTML via a 1 tag or the 2 title of a source in a Staging folder, 3 Name field in a bootstrap setup, or Title fie...

PT-2014-5542

Name of the Vulnerable Software and Affected Versions Mayan EDMS version 0.13 Description The issue allows remote authenticated users to inject arbitrary web script or HTML. This can be achieved via a tag or the title of a source in a Staging folder, the Name field in a bootstrap setup, or the...

PT-2014-9074

Name of the Vulnerable Software and Affected Versions Mayan EDMS version 0.13 Description The issue allows remote authenticated users to inject arbitrary web script or HTML. This can be achieved via a tag or the title of a source in a Staging folder, the Name field in a bootstrap setup, or the...

大汉Jvideo两处漏洞小合集（可能导致管理后台权限劫持）

简要描述： 两处。 详细说明： 一个是任意文件下载，一个是sql注入。 先看任意文件下载吧，任意文件下载可以下载到setup的相关安装信息，从而可以登录setup目录的管理后台 http://222.66.10.88:8081/jvideo/down.jsp?pathfile=WEB-INF/web.xml 来点好东西 http://222.66.10.88:8081/jvideo/down.jsp?pathfile=WEB-INF/ini/merpserver.ini 可以看见setup下Admin的密码（屏蔽了），登录成功 另外一个网站...

Cobbler Local File Inclusion Vulnerability

Cobbler versions 2.4.x through 2.6.x suffer from a local file inclusion vulnerability. Exploit Title: Local File Inclusion vulnerability in cobbler Exploit author: Dolev Farhi @f1nhack Date 07/05/2014 Vendor homepage: http://www.cobblerd.org Affected Software version: 2.4.x - 2.6.x Alerted vendor...

bug vulnerability handling mechanism system-bugtracker-bug warning-the black bar safety net

For the company configured a Bug tracking system, 找到BugTracker.NET,read a bit, the translation of which is configuration. After a research experience then put up to share. A friend in need can be the following URL to download http://sourceforge.net/project/showfiles.php?groupid=66812 BugTracker...

PT-2016-6649

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 4.0.10.x through 4.0.10.15 phpMyAdmin versions 4.4.15.x through 4.4.15.6 phpMyAdmin versions 4.6.x through 4.6.2 Description The issue allows remote attackers to conduct BBCode injection attacks against HTTP sessions via a...

PT-2015-6339

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 4.0.x through 4.0.10.9 phpMyAdmin versions 4.2.x through 4.2.13.2 phpMyAdmin versions 4.3.x through 4.3.13.0 phpMyAdmin versions 4.4.x through 4.4.6.0 Description The issue allows remote attackers to hijack the authenticati...

[SECURITY] Fedora 20 Update: ndjbdns-1.06-1.fc20

New djbdns: is a usable fork of djbdns. djbdns' is a Domain Name System originally written by the eminent author of Qmail, Dr D. J. Bernstein. This new version of djbdns is a complete makeover to the original sourcedjbdns-1.05 and is meant to make life a lot more pleasant. The notable changes so...

CVE-2013-3069

Multiple cross-site scripting XSS vulnerabilities in NETGEAR WNDR4700 with firmware 1.0.0.34 allow remote authenticated users to inject arbitrary web script or HTML via the 1 UserName or 2 Password to the NAS User Setup page, 3 deviceName to USBadvanced.htm, or 4 Network Key to the Wireless Setup...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in NETGEAR WNDR4700 with firmware 1.0.0.34 allow remote authenticated users to inject arbitrary web script or HTML via the 1 UserName or 2 Password to the NAS User Setup page, 3 deviceName to USBadvanced.htm, or 4 Network Key to the Wireless Setup...

CVE-2013-3069

Multiple cross-site scripting XSS vulnerabilities in NETGEAR WNDR4700 with firmware 1.0.0.34 allow remote authenticated users to inject arbitrary web script or HTML via the 1 UserName or 2 Password to the NAS User Setup page, 3 deviceName to USBadvanced.htm, or 4 Network Key to the Wireless Setup...

CVE-2013-3069: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in NETGEAR WNDR4700 with firmware 1.0.0.34 allow remote authenticated users to inject arbitrary web script or HTML via the 1 UserName or 2 Password to the NAS User Setup page, 3 deviceName to USBadvanced.htm, or 4 Network Key to the Wireless Setup...

ionCube loader-wizard.php Accessible

ionCube, an encoding and PHP file security tool written in PHP, is running on the remote host. The 'loader-wizard.php' script that contains setup and configuration assistance and provides access to sensitive information about the web server is accessible to remote, unauthenticated users...

DEBIAN-CVE-2013-7348

Double free vulnerability in the ioctxalloc function in fs/aio.c in the Linux kernel before 3.12.4 allows local users to cause a denial of service system crash or possibly have unspecified other impact via vectors involving an error condition in the aiosetupring function...

UBUNTU-CVE-2013-7348

Double free vulnerability in the ioctxalloc function in fs/aio.c in the Linux kernel before 3.12.4 allows local users to cause a denial of service system crash or possibly have unspecified other impact via vectors involving an error condition in the aiosetupring function...

CSGuestbook csGuestbook.cgi setup Parameter Code Execution - Ver2 (CVE-2002-1750)

A code execution vulnerability has been reported in Cgiscript.net Csguestbook. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Design/Logic Flaw

The setup script in Domain Technologie Control DTC before 0.34.1 uses world-readable permissions for /etc/apache2/apache2.conf, which allows local users to obtain the dtcdaemons MySQL password by reading the file...

CVE-2011-3196

The setup script in Domain Technologie Control DTC before 0.34.1 uses world-readable permissions for /etc/apache2/apache2.conf, which allows local users to obtain the dtcdaemons MySQL password by reading the file...

CVE-2011-3196

The CVE-2011-3196 issue affects Domain Technologie Control (DTC) prior to version 0.34.1. The root cause is world-readable permissions on /etc/apache2/apache2.conf, which allowed local users to read a configuration file and obtain the dtcdaemons MySQL password. Impact was local, with confidential...