7818 matches found
timetrex-xss.txt
HSC TimeTrex Time and Attendance Cookie Theft TimeTrex allows companies to track and monitor employee attendance accurately in real-time from anywhere in the world. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the...
CVE-2008-3553
Multiple unspecified vulnerabilities in Nokia Series 40 3rd edition devices allow remote attackers to execute arbitrary code via unknown vectors, probably related to MIDP privilege escalation and persistent MIDlets, aka "ISSUES 3-10." NOTE: as of 20080807, the only disclosure is a vague...
Trac Wiki引擎跨站脚本执行漏洞
BUGTRAQ ID: 30400 CVECAN ID: CVE-2008-3328 Trac是用Python编写的基于Web的事件跟踪系统。 Trac的Wiki引擎没有正确地验证某些参数便返回给了用户，远程攻击者可以通过向服务器提交恶意请求执行脚本注入或跨站脚本攻击。 Edgewall Software Trac 0.10.5 Edgewall Software ----------------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://ftp.edgewall.com/pub/trac/trac-0.10.5.tar.gz...
CVE-2008-3315
Multiple cross-site scripting XSS vulnerabilities in Claroline 1.8.10 allow remote attackers to inject arbitrary web script or HTML via the 1 query string to a announcements/messages.php; b lostPassword.php and c profile.php in auth/; d calendar/myagenda.php; e group/group.php; f learningPath.php...
CVE-2008-3315
CVE-2008-3315 refers to multiple cross-site scripting (XSS) vulnerabilities in Claroline 1.8.10, exploitable via the query string on numerous files (e.g., announcements/messages.php, lostPassword.php, profile.php in auth/; calendar/myagenda.php; group/group.php; learningPath.; tracking/ ; user/*;...
CVE-2008-3315
Multiple cross-site scripting XSS vulnerabilities in Claroline 1.8.10 allow remote attackers to inject arbitrary web script or HTML via the 1 query string to a announcements/messages.php; b lostPassword.php and c profile.php in auth/; d calendar/myagenda.php; e group/group.php; f learningPath.php...
Design/Logic Flaw
CFNetwork in Safari in Apple Mac OS X before 10.5.3 automatically sends an SSL client certificate in response to a web server's certificate request, which allows remote web sites to obtain sensitive information Subject data from personally identifiable certificates, and use arbitrary certificates...
[SECURITY] Fedora 9 Update: bugzilla-3.0.4-1.fc9
Bugzilla is a popular bug tracking system used by multiple open source projects. It requires a database engine installed - either MySQL or PostgreSQL. Without one of these database engines, Bugzilla will not work...
Claroline 1.7.5 - Multiple Remote File Inclusions
source: https://www.securityfocus.com/bid/29162/info Claroline is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues may allow a remote attacker to compromise the application and the underlying system; other...
Debian Security Advisory DSA 1554-2 (roundup)
The remote host is missing an update to roundup announced via advisory DSA 1554-2. OpenVAS Vulnerability Test $Id: deb15542.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1554-2 roundup Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...
[SECURITY] Fedora 7 Update: bugzilla-3.0.4-1.fc7
Bugzilla is a popular bug tracking system used by multiple open source projects. It requires a database engine installed - either MySQL or PostgreSQL. Without one of these database engines, Bugzilla will not work...
[SECURITY] Fedora 8 Update: bugzilla-3.0.4-1.fc8
Bugzilla is a popular bug tracking system used by multiple open source projects. It requires a database engine installed - either MySQL or PostgreSQL. Without one of these database engines, Bugzilla will not work...
Security Advisory for Bugzilla 3.0.3, 3.1.3, 2.22.3, and 2.20.5
Summary ======= Bugzilla is a Web-based bug-tracking system, used by a large number of software projects. This advisory covers three security issues that have recently been fixed in the Bugzilla code: Users without the "canconfirm" privilege could enter a bug as NEW or ASSIGNED by using the XML-R...
Manage Watchers shows users with no permission
We have just upgraded to Jira 3.12.2 and like the new functionality when adding watchers to an issue. There is one problem with this though. It is showing all users, including users with no permissions. This means that all employees that stopped working here will show in the drop down. We do not...
CVE-2008-2010
Unspecified vulnerability in Apple QuickTime Player on Windows XP SP2 and Vista SP1 allows remote attackers to execute arbitrary code via a crafted QuickTime media file. NOTE: as of 20080429, the only disclosure is a vague pre-advisory with no actionable information. However, because it is from a...
Debian Security Advisory DSA 1554-1 (roundup)
The remote host is missing an update to roundup announced via advisory DSA 1554-1. OpenVAS Vulnerability Test $Id: deb15541.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1554-1 roundup Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...
DSA-1554-1 roundup - cross-site scripting vulnerability
Bulletin has no description...
CVE-2008-1731
Technical details about CVE-2008-1731 are not publicly provided in the supplied documents. Monitor for updates from related advisories, vendors, or CVE records.
SA-2008-025 - Simple access - Access bypass
The Simple Access module is a node access module that allows administrators to make some nodes private and/or editable by certain user roles. The module contains a flaw that results in the privacy information for a node being lost under certain conditions. These conditions are usually triggered v...