openSUSE Security Update : pidgin (openSUSE-SU-2012:0905-1)

Changes in pidgin : - Fixing bnc752275, CVE-2012-1178: Pidgin fails to verify the text's utf-8 encoding %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2012-432. The text description ...

openSUSE Security Update : pidgin (openSUSE-2012-29)

pidgin was updated to version 2.10.1 + AIM and ICQ : - Fix remotely-triggerable crashes by validating strings in a few messages related to buddy list management bnc736147, CVE-2011-4601. + Bonjour : - IPv6 fixes + Gadu-Gadu : - Fix problems linking against GnuTLS. + IRC : - Fix a memory leak when...

74cms 最新版 注入8-9

简要描述： 骑士PHP人才系统：74cms V3.4.20140530 详细说明： GBK 2字节一汉字 UTF8 三字节 一汉字。 74cms 在读取数据库的时候 charactersetclient=binary 这样没办法来直接宽字节来注入了。 得找一些转换编码的地方。 錦 从UTF8 转成 GBK之后成了 %e5%5c 74cms对GET POST COOKIE …… 都做了addslashes 所以' 转义后为' -%5C %e5%5c%5c' 两个\ 则单引号出来 再看看74cms的全局过滤 function removexss$string $string =...

Wireshark v1.11.3 - The world’s foremost network protocol analyzer

Wireshark is the world’s foremost network protocol analyzer. It lets you capture and interactively browse the traffic running on a computer network. It is the de facto and often de jure standard across many industries and educational institutions. Wireshark development thrives thanks to the...

程氏舞曲CMS最新php版本多处sql注入漏洞

简要描述： 操蛋捏。 详细说明： 昨天刚下载的，2.16号更新的版本。 第一处在管理后台：https://images.seebug.org/upload/app/controllers/admin/news.php第66行 public function so $key = $this-input-get'key';//使用get方式获取相关参数，没做处理 $user = $this-input-get'user'; $cid = $this-input-get'cid'; $page = $this-input-get'page'; ifempty$page $page=1;...

Design/Logic Flaw

JBoss Web, as used in Red Hat JBoss Communications Platform before 5.1.3, Enterprise Web Platform before 5.1.2, Enterprise Application Platform before 5.1.2, and other products, allows remote attackers to cause a denial of service infinite loop via vectors related to a crafted UTF-8 and a...

CVE-2011-4610

JBoss Web, as used in Red Hat JBoss Communications Platform before 5.1.3, Enterprise Web Platform before 5.1.2, Enterprise Application Platform before 5.1.2, and other products, allows remote attackers to cause a denial of service infinite loop via vectors related to a crafted UTF-8 and a...

CVE-2012-6152

CVE-2012-6152 affects Pidgin’s Yahoo! protocol plugin (libpurple) before 2.10.8. The vulnerability arises from improper validation of UTF-8 data, enabling a remote attacker to crash the application (DoS) via crafted byte sequences. Affected: Pidgin/libpurple up to version 2.10.7.x; remediator: up...

CVE-2012-6152

The Yahoo! protocol plugin in libpurple in Pidgin before 2.10.8 does not properly validate UTF-8 data, which allows remote attackers to cause a denial of service application crash via crafted byte sequences...

CVE-2012-6152

The Yahoo! protocol plugin in libpurple in Pidgin before 2.10.8 does not properly validate UTF-8 data, which allows remote attackers to cause a denial of service application crash via crafted byte sequences...

CVE-2013-2031

MediaWiki before 1.19.6 and 1.20.x before 1.20.5 allows remote attackers to conduct cross-site scripting XSS attacks, as demonstrated by a CDATA section containing valid UTF-7 encoded sequences in a SVG file, which is then incorrectly interpreted as UTF-8 by Chrome and Firefox...

Cross site scripting

MediaWiki before 1.19.6 and 1.20.x before 1.20.5 allows remote attackers to conduct cross-site scripting XSS attacks, as demonstrated by a CDATA section containing valid UTF-7 encoded sequences in a SVG file, which is then incorrectly interpreted as UTF-8 by Chrome and Firefox...

CVE-2013-2031

MediaWiki before 1.19.6 and 1.20.x before 1.20.5 allows remote attackers to conduct cross-site scripting XSS attacks, as demonstrated by a CDATA section containing valid UTF-7 encoded sequences in a SVG file, which is then incorrectly interpreted as UTF-8 by Chrome and Firefox...

ESXi 5.0 < Build 515841 Multiple Vulnerabilities (remote check)

The remote VMware ESXi 5.0 host is affected by the following security vulnerabilities : - A security bypass vulnerability exists in the e1000 driver in the Linux kernel due to improper handling of Ethernet frames that exceed the MTU. An unauthenticated, remote attacker can exploit this, via...

Opera Cross-Site Scripting (XSS) Vulnerability - Windows

Opera is prone to XSS attack. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:opera:operabrowser"; ifdescription...

Opera < 15 UTF-8 Encoding XSS

The version of Opera installed on the remote host is a version prior to version 15. It is, therefore, vulnerable to cross-site scripting attacks due to improper validation of UTF-8 page encoding settings. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid70217;...

CVE-2013-4705

Cross-site scripting XSS vulnerability in Opera before 15.00 allows remote attackers to inject arbitrary web script or HTML by leveraging UTF-8 encoding...

Cross site scripting

Cross-site scripting XSS vulnerability in Opera before 15.00 allows remote attackers to inject arbitrary web script or HTML by leveraging UTF-8 encoding...

CVE-2013-4705

Cross-site scripting XSS vulnerability in Opera before 15.00 allows remote attackers to inject arbitrary web script or HTML by leveraging UTF-8 encoding...

CVE-2013-4705

Consolidated details for CVE-2013-4705 show an XSS vulnerability in Opera before version 15.00, exploitable via improper handling of UTF-8 encoding. Affected software: Opera browser (pre-15.00). Root cause (as stated): cross-site scripting due to UTF-8 encoding/validation issues. Impact is descri...