1435 matches found
ManageEngine OpManager Login.do Multiple Parameter XSS
The remote host is running ManageEngine OpManager, a web-based network management application. The version of ManageEngine OpManager installed on the remote host fails to sanitize user input to the 'requestid' parameter of the 'jsp/Login.do' script before using it to generate dynamic content. An...
Design/Logic Flaw
The Evaluate LotusScript method in IBM Lotus Domino before 7.0.3 uses an incorrect security context for @ formula commands in some circumstances, which might allow remote authenticated users to gain privileges and obtain sensitive information...
CVE-2007-5700
The Evaluate LotusScript method in IBM Lotus Domino before 7.0.3 uses an incorrect security context for @ formula commands in some circumstances, which might allow remote authenticated users to gain privileges and obtain sensitive information...
CVE-2007-5700
The Evaluate LotusScript method in IBM Lotus Domino before 7.0.3 uses an incorrect security context for @ formula commands in some circumstances, which might allow remote authenticated users to gain privileges and obtain sensitive information...
CVE-2007-5700
The vulnerability (CVE-2007-5700) affects IBM Lotus Domino prior to 7.0.3. The Evaluate LotusScript method uses an incorrect security context for @ formula commands in some circumstances, which might allow remote authenticated users to gain privileges and obtain sensitive information. Affected co...
DSA-1390-1 t1lib - arbitrary code execution
Bulletin has no description...
[SECURITY] [DSA 1379-2] New openssl packages fix arbitrary code execution
------------------------------------------------------------------------ Debian Security Advisory DSA-1379-2 [email protected] http://www.debian.org/security/ Noah Meyerhans October 10, 2007 - ------------------------------------------------------------------------ Package : openssl097,...
IceWarp Merak Mail Server < 9.0.0 BODY Element XSS
The remote host is running IceWarp Merak Mail Server - a webmail server for Windows and Linux. According to its banner, the version of IceWarp installed on the remote host fails to properly sanitize email messages before displaying them. If a user reads a specially crafted message, a remote...
Cisco Unified MeetingPlace Template Cross-Site Scripting Vulnerability
Cisco Unified MeetingPlace versions prior to 5.3.235.0 contain a vulnerability that could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks. This vulnerability exists due to insufficient filtering of parameters by Cisco Unified MeetingPlace. An unauthenticated,...
Moderate: ipsec-tools security update
0.6.5-8 - Upstream fix for Racoon DOS, informational delete must be encrypted - Resolves: rhbz235388 - CVE-2007-1841 ipsec-tools racoon DoS 0.6.5-7 - Resolves: 218386 labeled ipsec does not work over loopback 0.6.5-6.6 - Related: 232508 add auditing to racoon 0.6.5-6.5 - Resolves: 235680 racoon...
Apache Tomcat snoop.jsp URI XSS
The remote Apache Tomcat web server includes an example JSP application, 'snoop.jsp', that fails to sanitize user-supplied input before using it to generate dynamic content. An unauthenticated, remote attacker can exploit this issue to inject arbitrary HTML or script code into a user's browser to...
WmsCMS < = 2.0 Multiple XSS Vulnerabilities
Application: WmsCMS Vendors Url: http://www.web-master.biz Bug Type: Multiple URL Handling Remote Cross-Site Scripting Vulnerabilities Exploitation: Remote Severity: Less Critical Solution Status: Unpatched Introduction: WmsCMS is a web-based CMS system Google Dork: "Powered by WMS-CMS" Affected...
webstudio-xss.txt
Application: WebStudio CMS Vendors Url: http://www.bdigital.biz Bug Type: Multiple URL Handling Remote Cross-Site Scripting Vulnerabilities Exploitation: Remote Severity: Less Critical Solution Status: Unpatched Introduction: WebStudio CMS is a web-based CMS system Google Dork: "Powered by...
WebStudio Multiple XSS Vulnerabilities
Application: WebStudio CMS Vendors Url: http://www.bdigital.biz Bug Type: Multiple URL Handling Remote Cross-Site Scripting Vulnerabilities Exploitation: Remote Severity: Less Critical Solution Status: Unpatched Introduction: WebStudio CMS is a web-based CMS system Google Dork: "Powered by...
SOL6669 - Apache HTTP Expect header handling
The vulnerability exists in the Apache web server, which is used by FirePass. Apache will not sanitize the contents of the HTTP Expect header when receiving an HTTP request. Instead, the contents of the Expect header will be returned in a successful HTTP response. This permits executable code suc...
Debian DSA-1287-1 : ldap-account-manager - multiple vulnerabilities
Two vulnerabilities have been identified in the version of ldap-account-manager shipped with Debian 3.1 sarge. - CVE-2006-7191 An untrusted PATH vulnerability could allow a local attacker to execute arbitrary code with elevated privileges by providing a malicious rm executable and specifying a PA...
High Risk Vulnerability in OpenOffice
John Heasman of NGSSoftware has discovered a high risk vulnerability in the handling of StarCalc documents within OpenOffice. The vulnerability affects all versions of OpenOffice prior to 2.2. If an attacker can coax a user into opening a specially crafted StarCalc document then the attacker can...
Apple Quicktime HREFTrack Cross-Zone Scripting vulnerability
Overview Web browsers running the Apple QuickTime plugin may allow remote web sites to reference content on the local filesystem. This may allow an attacker to execute script within the security context of the local machine. Description Web browser plugins that allow remote web sites to reference...
kronolith -- arbitrary local file inclusion vulnerability
iDefense Labs reports: Remote exploitation of a design error in Horde's Kronolith could allow an authenticated web mail user to execute arbitrary PHP code under the security context of the running web server. The vulnerability specifically exists due to a design error in the way it includes certa...
CVE-2006-4227
MySQL before 5.0.25 and 5.1 before 5.1.12 evaluates arguments of suid routines in the security context of the routine's definer instead of the routine's caller, which allows remote authenticated users to gain privileges through a routine that has been made available using GRANT EXECUTE...