CVE-2011-4532: Improper Limitation of a Pathname to a Restricted Directory

Absolute path traversal vulnerability in the ALMListView.ALMListCtrl ActiveX control in almaxcx.dll in the graphical user interface in Siemens Automation License Manager ALM 2.0 through 5.1+SP1+Upd2 allows remote attackers to overwrite arbitrary files via the Save method...

CVE-2011-4056: Undefined Security Weakness

An unspecified ActiveX control in ActBar.ocx in Siemens Tecnomatix FactoryLink 6.6.1 aka 6.6 SP1, 7.5.217 aka 7.5 SP2, and 8.0.2.54 allows remote attackers to create or overwrite arbitrary files via the save method...

Acunetix Web Vulnerability Scanner 8 BETA Released

Acunetix Web Vulnerability Scanner 8 BETA Released The next stage in the evolution of Acunetix Web Vulnerability Scanner has arrived — WVS 8 BETA! Many of you have been biting their nails in anticipation of this Beta, so sit tight and read on for the next most important stage in the evolution of...

Acunetix Web Vulnerability Scanner 8 BETA Released

Acunetix Web Vulnerability Scanner 8 BETA Released The next stage in the evolution of Acunetix Web Vulnerability Scanner has arrived — WVS 8 BETA! Many of you have been biting their nails in anticipation of this Beta, so sit tight and read on for the next most important stage in the evolution of...

ewebeditor(PHP) Ver 3.8 present an arbitrary file upload 0day-vulnerability warning-the black bar safety net

titleeWebeditoR3. 8 for php any file on the EXP/title form action=”" method=post enctype=”multipart/form-data” INPUT TYPE="hidden" name="MAXFILESIZE" value="5 1 2 0 0 0" URL:input type=text name=url value=”http://www.sitedirsec.com/ewebeditor/” size=1 0 0br INPUT TYPE=”hidden” name=”aStyle1 2”...

CVE-2011-3218

The "Save for Web" selection in QuickTime Player in Apple Mac OS X through 10.6.8 exports HTML documents that contain an http link to a script file, which allows man-in-the-middle attackers to conduct cross-site scripting XSS attacks by spoofing the http server during local viewing of an exported...

Cross site scripting

The "Save for Web" selection in QuickTime Player in Apple Mac OS X through 10.6.8 exports HTML documents that contain an http link to a script file, which allows man-in-the-middle attackers to conduct cross-site scripting XSS attacks by spoofing the http server during local viewing of an exported...

CVE-2011-3218: Improper Neutralization of Input During Web Page Generation

The "Save for Web" selection in QuickTime Player in Apple Mac OS X through 10.6.8 exports HTML documents that contain an http link to a script file, which allows man-in-the-middle attackers to conduct cross-site scripting XSS attacks by spoofing the http server during local viewing of an exported...

Windows7/win2008 mention the right of 0day-vulnerability warning-the black bar safety net

| exp the contents are as follows: Save As taskxpl. wsf job id="tasksch-wD-0day" script language="Javascript" crctable = new Array 0x00000000, 0x77073096, 0xEE0E612C, 0x990951BA, 0x076DC419, 0x706AF48F, 0xE963A535, 0x9E6495A3, 0x0EDB8832, 0x79DCB8A4, 0xE0D5E91E, 0x97D2D988, 0x09B64C2B, 0x7EB17CBD...

Paltalk Messenger 10.0 Insecure Method

Vulnerability ID: HTB23026 Reference: http://www.htbridge.ch/advisory/paltalkmessengeractivexcontrolmultipleinsecuremethods.html Product: Paltalk Messenger Vendor: Paltalk http://www.paltalk.com Vulnerable Version: 10.0 and probably prior Tested on: 10.0 Vendor Notification: 22 June 2011...

PalTalk messenger ActiveX insecure methods

It's possible to save files into arbitrary locations...

Cross site scripting

Cross-site scripting XSS vulnerability in the EditNews function in ManageNews.php in Simple Machines Forum SMF before 1.1.13, and 2.x before 2.0 RC5, might allow remote authenticated users to inject arbitrary web script or HTML via a saveitems action...

SA-CONTRIB-2011-017 - Save Draft - Validation Bypass

The Save Draft module adds a "Save as draft" button to the node form, letting content creators easily save a post in unpublished draft form. The module adds validation to individual form actions, thereby bypassing any form-wide validation that is normally performed before saving content. This is ...

Pluck CMS Cross Site Request Forgery

+Exploit Title: Pluck CMS Cross Site Request Forgery Exploit +Author : ^Xecuti0n3r + Date : 22.04.2011 + Hour : 13:37 PM + E-mail : xecuti0n3ryahoo.com +download: http://www.pluck-cms.org/?file=kop2.php + Category : Web Apps XSRF Pluck CMS Cross Site Request Forgery Exploit var pauses = new Array...

Cross-Site Scripting vulnerabilities in Icinga

Advisory: Cross-Site Scripting vulnerabilities in Icinga Advisory ID: SSCHADV2011-001 Author: Stefan Schurtz Affected Software: Successfully tested on: icinga-1.3.0 / icinga-1.2.1 Vendor URL: http://www.icinga.org Vendor Status: fixed csv export link to make it XSS save IE 1275 CVE-ID: -...

CA Internet Security / CA Host-Based Intrusion Prevention System code execution

SetXml and Save methods of HIPSEngine component allows to save file to any location...

CVE-2011-1036: Undefined Security Weakness

The XML Security Database Parser class in the XMLSecDB ActiveX control in the HIPSEngine component in the Management Server before 8.1.0.88, and the client before 1.6.450, in CA Host-Based Intrusion Prevention System HIPS 8.1, as used in CA Internet Security Suite ISS 2010, allows remote attacker...

CA Internet Security Suite HIPS XML Security Database Parser Class Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of CA Internet Security Suite 2010. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The flaw exists within the...

snmp-ios-config NSE Script

Attempts to downloads Cisco router IOS configuration files using SNMP RW v1 and display or save them. Script Arguments snmp-ios-config.tftproot If set, specifies to what directory the downloaded config should be saved snmp.version See the documentation for the snmp library. creds.service,...

CVE-2010-4506

CVE-2010-4506 concerns Passlogix v-GO Self-Service Password Reset (SSPR) and OEM prior to version 7.0A. The flaw enables physically proximate attackers to run arbitrary programs without authentication by abusing an invalid SSL certificate and using Internet Explorer to navigate the filesystem via...