PT-2012-4120

Name of the Vulnerable Software and Affected Versions AfterLogic MailSuite Pro version 6.3 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via an e-mail message body. Specifically...

CVE-2012-2590: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ESCON SupportPortal Professional Edition 3.0 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with 1 a SCRIPT element, 2 a crafted SRC attribute of an IFRAME element, 3 a crafted CONTENT attribute of an...

CVE-2012-4070: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in system/src/dispatcher.php in Dir2web 3.0 allows remote attackers to execute arbitrary SQL commands via the oid parameter in a homepage action to index.php...

PT-2012-4704

Name of the Vulnerable Software and Affected Versions bind-dyndb-ldap version 1.1.0rc1 and earlier Description The issue arises from the dns to ldap dn escape function in src/ldap convert.c, which fails to properly escape distinguished names DN for LDAP queries. This allows remote DNS servers to...

CVE-2012-4031: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in src/acloglogin.php in Wangkongbao CNS-1000 and 1100 allow remote attackers to read arbitrary files via a .. dot dot in the 1 lang or 2 langid cookie to port 85...

PT-2012-4816

Name of the Vulnerable Software and Affected Versions Opera versions prior to 12.00 Beta Description The issue allows remote attackers to cause a denial of service, resulting in memory consumption or application hang, by utilizing an IFRAME element with the src="" syntax to embed a parent documen...

CVE-2011-1761

CVE-2011-1761 affects libmodplug prior to 0.8.8.3, with multiple stack-based buffer overflows in the ABC loader paths (abc_new_macro and abc_new_umacro) in src/load_abc.cpp. The vulnerability allows remote attackers to crash the application and potentially execute arbitrary code via a crafted ABC...

CVE-2011-1761: Improper Restriction of Operations within the Bounds of a Memory Buffer

Multiple stack-based buffer overflows in the 1 abcnewmacro and 2 abcnewumacro functions in src/loadabc.cpp in libmodplug before 0.8.8.3 allow remote attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted ABC file. NOTE: some of these details are obtained fr...

CVE-2012-2093: Improper Link Resolution Before File Access

src/common/latex.py in Gajim 0.15 allows local users to overwrite arbitrary files via a symlink attack on a temporary latex file, related to the gettmpfilename function...

PT-2012-3802

Name of the Vulnerable Software and Affected Versions Gajim version 0.15 Description The issue allows local users to overwrite arbitrary files via a symlink attack on a temporary latex file, related to the get tmpfile name function in src/common/latex.py. Recommendations For Gajim version 0.15,...

CVE-2011-3083

browser/profiles/profileimpliodata.cc in Google Chrome before 19.0.1084.46 does not properly handle a malformed ftp URL in the SRC attribute of a VIDEO element, which allows remote attackers to cause a denial of service NULL pointer dereference and application crash via a crafted web page...

CVE-2011-3083: Improper Restriction of Operations within the Bounds of a Memory Buffer

browser/profiles/profileimpliodata.cc in Google Chrome before 19.0.1084.46 does not properly handle a malformed ftp URL in the SRC attribute of a VIDEO element, which allows remote attackers to cause a denial of service NULL pointer dereference and application crash via a crafted web page...

CVE-2011-3083

browser/profiles/profileimpliodata.cc in Google Chrome before 19.0.1084.46 does not properly handle a malformed ftp URL in the SRC attribute of a VIDEO element, which allows remote attackers to cause a denial of service NULL pointer dereference and application crash via a crafted web page...

CVE-2011-3083

browser/profiles/profileimpliodata.cc in Google Chrome before 19.0.1084.46 does not properly handle a malformed ftp URL in the SRC attribute of a VIDEO element, which allows remote attackers to cause a denial of service NULL pointer dereference and application crash via a crafted web page...

PT-2012-1643

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 19.0.1084.46 Description The issue arises from improper handling of a malformed ftp URL in the SRC attribute of a VIDEO element. This can be exploited by remote attackers to cause a denial of service, resulting ...

Debian: Security Advisory (DSA-2445-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-2455-1 : typo3-src - missing input sanitization

Helmut Hummel of the TYPO3 security team discovered that TYPO3, a web content management system, is not properly sanitizing output of the exception handler. This allows an attacker to conduct cross-site scripting attacks if either third-party extensions are installed that do not sanitize this...

[SECURITY] [DSA 2455-1] typo3-src security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2455-1 [email protected] http://www.debian.org/security/ Nico Golde April 20, 2012 http://www.debian.org/security/faq -...

Debian DSA-2445-1 : typo3-src - several vulnerabilities

Several remote vulnerabilities have been discovered in the TYPO3 web content management framework : - CVE-2012-1606 Failing to properly HTML-encode user input in several places, the TYPO3 backend is susceptible to Cross-Site Scripting. A valid backend user is required to exploit these...

PT-2012-1022

Name of the Vulnerable Software and Affected Versions CVS versions 1.11 through 1.12 Description The issue concerns multiple vulnerabilities in the CVS package of the Debian GNU/Linux operating system, which can be exploited remotely to compromise the confidentiality, integrity, and availability ...