Oracle Linux 5 / 6 : java-1.6.0-openjdk (ELSA-2013-1505)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-1505 advisory. 1:1.6.0.0-1.68.1.11.14 - updated to icedtea6-1.11.14.tar.gz - added and applied 1.11.14-fixes.patch, patch10 to fix build issues - adapted patch8...

Low: python-crypto

Issue Overview: The Crypto.Random.atfork function in PyCrypto before 2.6.1 does not properly reseed the pseudo-random number generator PRNG before allowing a child process to access it, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging a race...

CVE-2011-4106: Improper Input Validation

TimThumb timthumb.php before 2.0 does not validate the entire source with the domain white list, which allows remote attackers to upload and execute arbitrary code via a URL containing a white-listed domain in the src parameter, then accessing it via a direct request to the file in the cache...

Debian DSA-2772-1 : typo3-src - XSS

Markus Pieton and Vytautas Paulikas discovered that the embedded video and audio player in the TYPO3 web content management system is suspectible to cross-site-scripting. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted fro...

[SECURITY] [DSA 2772-1] typo3-src security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2772-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff October 10, 2013 http://www.debian.org/security/faq -...

Debian Security Advisory DSA 2772-1 (typo3-src - cross-site scripting)

Markus Pieton and Vytautas Paulikas discovered that the embedded video and audio player in the TYPO3 web content management system is suspectible to cross-site-scripting. OpenVAS Vulnerability Test $Id: deb2772.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from advisory DSA 2772-1 usin...

Debian: Security Advisory (DSA-2772-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

http-referer-checker NSE Script

Informs about cross-domain include of scripts. Websites that include external javascript scripts are delegating part of their security to third-party entities. Script Arguments slaxml.debug See the documentation for the slaxml library. httpspider.doscraping, httpspider.maxdepth,...

[SECURITY] [DSA 2646-1] typo3-src security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2646-1 [email protected] http://www.debian.org/security/ Yves-Alexis Perez March 15, 2013 http://www.debian.org/security/faq -...

Debian DSA-2646-1 : typo3-src - several vulnerabilities

TYPO3, a PHP-based content management system, was found vulnerable to several vulnerabilities. - CVE-2013-1842 Helmut Hummel and Markus Opahle discovered that the Extbase database layer was not correctly sanitizing user input when using the Query object model. This can lead to SQL injection by a...

Microsoft Internet Explorer Domain Policy Bypass Vulnerability

Microsoft Internet Explorer is prone to domain policy bypass vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2012-6502

Microsoft Internet Explorer before 10 allows remote attackers to obtain sensitive information about the existence of files, and read certain data from files, via a UNC share pathname in the SRC attribute of a SCRIPT element, as demonstrated by reading a name-value pair from a local file via a...

CVE-2012-6502: Exposure of Sensitive Information to an Unauthorized Actor

Microsoft Internet Explorer before 10 allows remote attackers to obtain sensitive information about the existence of files, and read certain data from files, via a UNC share pathname in the SRC attribute of a SCRIPT element, as demonstrated by reading a name-value pair from a local file via a...

CVE-2012-6301: Improper Input Validation

The Browser application in Android 4.0.3 allows remote attackers to cause a denial of service application crash via a crafted market: URI in the SRC attribute of an IFRAME element...

Debian Security Advisory DSA 2574-1 (typo3-src)

The remote host is missing an update to typo3-src announced via advisory DSA 2574-1. OpenVAS Vulnerability Test $Id: deb25741.nasl 8972 2018-02-28 07:02:10Z cfischer $ Description: Auto-generated from advisory DSA 2574-1 typo3-src Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc...

CVE-2012-4751: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Open Ticket Request System OTRS Help Desk 2.4.x before 2.4.15, 3.0.x before 3.0.17, and 3.1.x before 3.1.11 allows remote attackers to inject arbitrary web script or HTML via an e-mail message body with whitespace before a javascript: URL in the SRC...

CVE-2012-3491: Undefined Security Weakness

src/condorschedd.V6/schedd.cpp in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 does not properly check the permissions of jobs, which allows remote authenticated users to remove arbitrary idle jobs via unspecified vectors...

CVE-2012-2575: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in NetWin SurgeMail 6.0a4 allows remote attackers to inject arbitrary web script or HTML via the SRC attribute of an IFRAME element in the body of an HTML e-mail message...

CVE-2011-5171: Improper Restriction of Operations within the Bounds of a Memory Buffer

Multiple stack-based buffer overflows in CyberLink Power2Go 7 build 196 and 8 build 1031 allow remote attackers to execute arbitrary code via the 1 src and 2 name parameters in a p2g project file...

[SECURITY] [DSA 2537-1] typo3-src security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2537-1 [email protected] http://www.debian.org/security/ Florian Weimer August 30, 2012 http://www.debian.org/security/faq -...