Debian DSA-2867-1 : otrs2 - several vulnerabilities

Several vulnerabilities were discovered in otrs2, the Open Ticket Request System. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2014-1694 Norihiro Tanaka reported missing challenge token checks. An attacker that managed to take over the session of a...

[SECURITY] [DSA 2867-1] otrs2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2867-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso February 23, 2014 http://www.debian.org/security/faq -...

FreeBSD : otrs -- CSRF issue in customer web interface (080c5370-886a-11e3-9533-60a44c524f57)

The OTRS Project reports : An attacker that managed to take over the session of a logged in customer could create tickets and/or send follow-ups to existing tickets due to missing challenge token checks. %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated patch has...

FreeBSD : otrs -- multiple vulnerabilities (c7b5d72b-886a-11e3-9533-60a44c524f57)

The OTRS Project reports : SQL injection issue An attacker that managed to take over the session of a logged in customer could create tickets and/or send follow-ups to existing tickets due to missing challenge token checks. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text...

IBM WebSphere Application Server 8.5 < Fix Pack 1 Multiple Vulnerabilities

IBM WebSphere Application Server 8.5 before Fix Pack 1 appears to be running on the remote host and is, therefore, potentially affected by the following vulnerabilities : - An input validation error exists related to the 'Eclipse Help System' that can allow arbitrary redirect responses to HTTP...

Lynx Message Server - Multiple Vulnerabilities

Lynx Message Server - Multiple Vulnerabilities 1. Summary The Micro Technology Services Inc. "Lynx Message Server 7.11.10.2" and/or "LynxTCPService version 1.1.62" web interface is vulnerable to SQL Injection, Cross-Site Scripting, and other security problems. 2. Description Lynx is a "Facility...

CVE-2012-0320

Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 allows remote attackers to take control of sessions via unspecified vectors related to the 1 commenting feature and 2 community script...

CVE-2012-0320

Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 allows remote attackers to take control of sessions via unspecified vectors related to the 1 commenting feature and 2 community script...

Debian Security Advisory DSA 2332-1 (python-django)

The remote host is missing an update to python-django announced via advisory DSA 2332-1. OpenVAS Vulnerability Test $Id: deb23321.nasl 6612 2017-07-07 12:08:03Z cfischer $ Description: Auto-generated from advisory DSA 2332-1 python-django Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft...

Debian DSA-2332-1 : python-django - several issues

Paul McMillan, Mozilla and the Django core team discovered several vulnerabilities in Django, a Python web framework : - CVE-2011-4136 When using memory-based sessions and caching, Django sessions are stored directly in the root namespace of the cache. When user data is stored in the same cache, ...

XT:Commerce < 3.04 SP2.1 - Cross-Site Scripting

---------------------------------------------------------------------------------- Cross-Site-Scripting XT:Commerce alertdocument.cookie and place an order. When the administrator opens the order in the backend of the shop, the javascript will be executed. By getting the cookie of the admin, the...

gnome-screensaver loses keyboard grab when running under compiz

GNOME screensaver 2.20 in Ubuntu 7.10, when used with Compiz, does not properly reserve input focus, which allows attackers with physical access to take control of the session after entering an Alt-Tab sequence, a related issue to CVE-2007-3069...

CVE-2007-3069

CVE-2007-3069 affects Sun Solaris 10 prior to patch 120095-36 (x86) / 120094-36 (sparc) where an active GNOME session with Assistive Technology support can be hijacked via an Alt-Tab sequence when a local attacker has physical access. The description from the primary source specifies the vulnerab...

horde -- Cross site scripting vulnerabilities in MIME viewers

Announce of Horde 3.0.7 final: This 3.0.7 is a security release that fixes cross site scripting vulnerabilities in two of Horde's MIME viewers. These holes could for example be exploited by an attacker sending specially crafted emails to Horde's webmail client IMP. The attack could be used to ste...

JVN#38138980 Hiki cross-site scripting vulnerability

Impact A remote attacker could create a content containing attacking code and take over a session by stealing the session ID of the user who logged into the system. If the user logged into the system as the administrator, the remote attacker could manipulate configurations. Solution Products...

[Full-Disclosure] Advisory: Cross Site Scripting Vulnerability in Openconf Conference Management Software

Advisory: Cross Site Scripting Vulnerability in Openconf Conference Management Software A group of students at our lab called RedTeam found a cross site scripting vulnerability in openconf which results in possible session takeover. Details ======= Product: openconf Affected Version: 1.04, probab...

[SECURITY] [DSA 660-1] New kdebase packages fix authentication bypass

-------------------------------------------------------------------------- Debian Security Advisory DSA 660-1 [email protected] http://www.debian.org/security/ Martin Schulze January 26th, 2005 http://www.debian.org/security/faq -...

Debian DSA-660-1 : kdebase - missing return value check

Raphael Enrici discovered that the KDE screensaver can crash under certain local circumstances. This can be exploited by an attacker with physical access to the workstation to take over the desktop session. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package chec...

Debian DSA-649-1 : xtrlock - buffer overflow

A buffer overflow has been discovered in xtrlock, a minimal X display lock program which can be exploited by a malicious local attacker to crash the lock program and take over the desktop session. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

[SECURITY] [DSA 649-1] New xtrlock packages fix authentication bypass

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 649-1 [email protected] http://www.debian.org/security/ Martin Schulze January 20th, 2005 http://www.debian.org/security/faq -...