Phorum 3.4 Email Subject Line Script Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7262/info It has been reported that it is possible to inject script code into the subject of a message in Phorum. This may be done by constructing a malicious subject line or other fields before sending an email to the...

TutorialCMS <= 1.01 Authentication Bypass Vulnerability

No description provided by source. TutorialCMS = 1.01 Authentication Bypass Discovered by: Silentz Payload: Authentication Bypass Website: http://www.w4ck1ng.com Vulnerability: Variables $loggedIn & $activated are not predefined. Vulnerable Files: login.php headerLinks.php submit1.php myFav.php...

IBM Lotus Domino 6.x/7.0 iNotes Email Subject XSS

No description provided by source. source: http://www.securityfocus.com/bid/16577/info IBM Lotus Domino iNotes is prone to multiple HTML- and script-injection vulnerabilities. These vulnerabilities can allow attackers to carry out a variety of attacks, including theft of cookie-based authenticati...

Microsoft Outlook Express 4.x/5.x/6.0 Attachment Processing File Extension Obfuscation Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/13837/info Microsoft Outlook Express is prone to an attachment file extension obfuscation vulnerability that may present a risk under certain configurations. The issue manifests due to Microsoft Outlook Express behavior...

WebBiblio Subject Gateway System LFI Vulnerability

No description provided by source. Exploit Title: WebBiblio Subject Gateway System Local File Inclusion Vulnerability Date: June 06 2010 Author: AntiSecurity Software Link: http://webbiblio.sourceforge.net/ http://sourceforge.net/projects/webbiblio/files/ Version: WebBiblio version 3.0 Tested on:...

CVE-2012-2579: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the WP SimpleMail plugin 1.0.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 To, 2 From, 3 Date, or 4 Subject field of an email...

CVE-2012-2572

Cross-site scripting XSS vulnerability in the ThreeWP Email Reflector plugin before 1.16 for WordPress allows remote attackers to inject arbitrary web script or HTML via the Subject of an email...

Cross site scripting

Cross-site scripting XSS vulnerability in the ThreeWP Email Reflector plugin before 1.16 for WordPress allows remote attackers to inject arbitrary web script or HTML via the Subject of an email...

CVE-2012-2572

Cross-site scripting XSS vulnerability in the ThreeWP Email Reflector plugin before 1.16 for WordPress allows remote attackers to inject arbitrary web script or HTML via the Subject of an email...

CVE-2012-2572: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the ThreeWP Email Reflector plugin before 1.16 for WordPress allows remote attackers to inject arbitrary web script or HTML via the Subject of an email...

OpenJDK: insecure subject principals set handling (JAAS, 8024306)

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect integrity via vectors related to JAAS. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the...

CVE-2014-3786: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the contact module admin/modules/contact.php in Pixie CMS 1.04 allow remote attackers to inject arbitrary web script or HTML via the 1 uemail or 2 subject parameter in the Contact form to contact/...

UBUNTU-CVE-2012-5662

x3270 before 3.3.12ga12 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

AZL-44784 CVE-2013-6444 affecting package pywbem 0.17.6-12

PyWBEM 0.7 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

PYSEC-2014-94

PyWBEM 0.7 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2014-0469

Stack-based buffer overflow in a certain Debian patch for xbuffy before 3.3.bl.3.dfsg-9 allows remote attackers to execute arbitrary code via the subject of an email, possibly related to indent subject lines...

DEBIAN-CVE-2014-0469

Stack-based buffer overflow in a certain Debian patch for xbuffy before 3.3.bl.3.dfsg-9 allows remote attackers to execute arbitrary code via the subject of an email, possibly related to indent subject lines...

CVE-2014-0469

Stack-based buffer overflow in a certain Debian patch for xbuffy before 3.3.bl.3.dfsg-9 allows remote attackers to execute arbitrary code via the subject of an email, possibly related to indent subject lines...

CVE-2014-0469

Stack-based buffer overflow in a certain Debian patch for xbuffy before 3.3.bl.3.dfsg-9 allows remote attackers to execute arbitrary code via the subject of an email, possibly related to indent subject lines...

Stack overflow

Stack-based buffer overflow in a certain Debian patch for xbuffy before 3.3.bl.3.dfsg-9 allows remote attackers to execute arbitrary code via the subject of an email, possibly related to indent subject lines...