1073 matches found
Sleipnir and Grani Bookmark Search vulnerable to arbitrary script execution
Overview Sleipnir and Grani, web browsers from Fenrir & Co., contain a vulnerability in the bookmark search function that allows an attacker to execute an arbitrary script. Sleipnir and Grani, web browsers from Fenrir & Co., have a bookmark search function. When a user runs the search function, t...
hpu-insecure.txt
&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&& Insecure Methods in HP Update Software. Remote: Yes Execute code remotely is possible using methods ExecuteAsync and Execute :- If a user visits the malicious page the attacker can execute code...
JVN#76788395 Sony mylo COM-2 does not verify server SSL certificate
Sony mylo COM-2, a mobile terminal equipped with a web browser and media palyer, contains a vulnerability where it does not verify the server certificate when connecting to a server via SSL/TLS. Impact Normally, when a client connects to a web server through a SSL/TLS connection, it would verify...
JVN#76669770 PerlMailer cross-site scripting vulnerability
PerlMailer is a mail form CGI provided by "Homepage Decorator". It is used to send mail from a form on a web page. A cross-site scripting vulnerabiltiy exists in PerlMailer. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update to the latest...
JVN#10606373 BFup ActiveX Control buffer overflow vulnerability
BFup ActiveX Control is developed by an individual that provides file upload and download functionality. BFup ActiveX Control contains a buffer overflow vulnerability. According to the developer of BFup ActiveX Control, this vulnerability only exists in BFup ActiveX Control developed by the...
JVN#42381549 Internet Scanner reporting engine vulnerable to cross-site scripting
IBM Internet Scanner has a function to generate a report as an HTML file. Internet Scanner's reporting engine does not properly sanitize data before generating this report. This vulnerability may allow an attacker to insert an arbitrary script, which is executed on the user's web browser when the...
JVN#09470767 Apache Tomcat fails to properly handle cookie value
Apache Tomcat from the Apache Software Foundation is a web container that implements both Java Servlets and JavaServer Pages. Apache Tomcat from the Apache Software Foundation contains a vulnerability that could allow a remote attacker to coerce a crafted cookie to a user's web browser. The...
JVN#75130343 Google Web Toolkit vulnerable to cross-site scripting
Google Web Toolkit GWT is an open source software development framework that allows web developers to create Ajax applications in Java. The benchmark reporting system in GWT is vulnerable to cross-site scripting. Impact An arbitrary script can be executed on the user's web browser. Solution Updat...
JVN#52846259 JP1/Cm2/Network Node Manager vulnerable to cross-site scripting
Hitachi JP1/Cm2/Network Node Manager NNM is software that helps a network administrator manage network configurations, faults, and other elements. Hitachi NNM is vulnerable to cross-site scripting. Impact An arbitrary script can be executed on the user's web browser. Solution Update the Software...
JVN#77414947 Cybozu Office denial of service (DoS) vulnerability
Cybozu Office, web-based groupware, is vulnerable to a denial of service DoS attack because it fails to properly handle specially crafted HTTP requests. Impact A remote attacker can cause a denial of service DoS against the server. Solution Update the Software For more information, refer to the...
JVN#63304072 MouseoverDictionary vulnerable to arbitrary script execution
MouseoverDictionary, an add-on mouseover English-Japanese dictionary for Mozilla Firefox, contains a vulnerability that allows an attacker to execute an arbitrary script on the user's web browser as it does not handle the sidebar HTML page properly. Impact An attacker could execute an arbitrary...
JVN#43615794 Yayoi Kaikei improper handling of credential information
Yayoi Kaikei Quick Navigator makes the user log into the vendor's server, and sends the user credentials unencrypted. Impact By monitoring the communication between Quick Navigator and the vendor's server, an attacker can obtain the customer number and the phone number to impersonate the user on...
DSA-1257-1 samba
Bulletin has no description...
WordPress <= 2.0.2 - Shell Injection
Because of this vulnerability in vars.php, the attackers can spoof their IP address via a PCREMOTEADDR HTTP header and include a remote file. Solution Update the WordPress to the latest available version at least 2.0.3...
HPSBPI2109 SSRT061141 rev.2 - HP Color LaserJet 2500 and 4600 Toolbox Running on Microsoft Windows Remote Unauthorized Disclosure of Information
Potential Security Impact Remote unauthorized disclosure of information VULNERABILITY SUMMARY A potential security vulnerability has been identified in the HP Color LaserJet 2500 and 4600 Toolbox, which may allow an unauthorized remote attacker to read arbitrary files. RESOLUTION HP has provided...
hostingCreate.txt
-= KeHieuHoc HCE GROUP =- Information ------------------------- Software Package : Hosting Controller Vendor Homepage : http://www.hostingcontroller.com Platforms : Windows based servers Vulnerability : Multiple Unauthenticated information disclose Risk : high Vulnerable Versions: All version...
[SA14204] Emdros MQL Parser Memory Leak Vulnerabilities
TITLE: Emdros MQL Parser Memory Leak Vulnerabilities SECUNIA ADVISORY ID: SA14204 VERIFY ADVISORY: http://secunia.com/advisories/14204/ CRITICAL: Less critical IMPACT: DoS WHERE: From local network SOFTWARE: Emdros 1.x http://secunia.com/product/3877/ DESCRIPTION: Some vulnerabilities have been...
[SA13241] phpMyAdmin Cross-Site Scripting Vulnerabilities
TITLE: phpMyAdmin Cross-Site Scripting Vulnerabilities SECUNIA ADVISORY ID: SA13241 VERIFY ADVISORY: http://secunia.com/advisories/13241/ CRITICAL: Less critical IMPACT: Cross Site Scripting WHERE: From remote SOFTWARE: phpMyAdmin 2.x http://secunia.com/product/1720/ DESCRIPTION: Cedric Cochin ha...
[SA12709] yappa-ng Unspecified "Show Random Image" Vulnerability
TITLE: yappa-ng Unspecified "Show Random Image" Vulnerability SECUNIA ADVISORY ID: SA12709 VERIFY ADVISORY: http://secunia.com/advisories/12709/ CRITICAL: Moderately critical IMPACT: Unknown WHERE: From remote SOFTWARE: yappa-ng 2.x http://secunia.com/product/3989/ DESCRIPTION: Georg Ragaz has...