1036 matches found
Syzygy CMS <= 0.3 (Auth Bypass) SQL Injection Vulnerability
No description provided by source. --+++=========================================================================+++-- --+++====== Syzygy CMS = 0.3 Auth Bypass SQL Injection Vulnerability ======+++-- --+++=========================================================================+++-- + Syzygy CMS ...
Helios Calendar 1.1/1.2 Admin/Index.PHP Cross Site Scripting Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/26312/info Helios Calendar is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue allows attackers to execute arbitrary HTML or script code in ...
CuteNews 1.4.6 editnews Module doeditnews Action Admin Moderation Bypass
No description provided by source. source: http://www.securityfocus.com/bid/36971/info CuteNews and UTF-8 CuteNews are prone to multiple vulnerabilities, including cross-site scripting, HTML-injection, information-disclosure, arbitrary-script-injection, and security-bypass issues. Note that...
openSUSE Security Update : gdm (openSUSE-SU-2011:0275-1)
Local users could trick gdm into changing ownership of arbitrary files by placing symlinks in the user session cache CVE-2011-0727. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update gdm-4250. Th...
D-Link DAP-1150 index.cgi多个参数存储型跨站脚本漏洞
D-link DAP-1150是一款路由器设备。 D-link DAP-1150不正确处理add函数中'resbuf'参数中的'Name', 'IP Addresses Source', 'Destination', 'Ports Source'和'Destination'字段数据，允许攻击者利用漏洞构建恶意URI，诱使用户解析，可获取敏感信息或劫持用户会话。 0 D-link DAP-1150 目前没有详细解决方案： http://www.dlink.com.au/products/?pid=735...
CVE-2013-7347
Luci in Red Hat Conga does not properly enforce the user session timeout, which might allow attackers to gain access to the session by reading the ac session cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2012-3359 for the base64-encoded storage of the user...
Design/Logic Flaw
Luci in Red Hat Conga does not properly enforce the user session timeout, which might allow attackers to gain access to the session by reading the ac session cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2012-3359 for the base64-encoded storage of the user...
SePortal 2.5 SQL Injection / Remote Code Execution Exploit
This Metasploit module exploits a vulnerability found in SePortal version 2.5. When logging in as any non-admin user, it's possible to retrieve the admin session from the database through SQL injection. The SQL injection vulnerability exists in the "staticpages.php" page. This hash can be used to...
ownCloud多个跨站脚本漏洞
ownCloud是一款开源的私有云服务器。 ownCloud存在多个跨站脚本漏洞，允许远程攻击者利用漏洞注入恶意脚本或HTML代码，当恶意数据被查看时，可获取敏感信息或劫持用户会话。 0 ownCloud 6.x ownCloud 6.0.2已经修复该漏洞，建议用户下载更新： http://owncloud.org...
Dell SonicWall EMail Security 7.4.5 - Multiple Vulnerabilities
Document Title: =============== Dell SonicWall EMail Security 7.4.5 - Multiple Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1191 Dell SonicWall Security Bulletin:...
Dell SonicWall EMail Security 7.4.5 - Multiple Vulnerabilities
Document Title: =============== Dell SonicWall EMail Security 7.4.5 - Multiple Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1191 Dell SonicWall Security Bulletin:...
php-font-lib 'name'参数跨站脚本漏洞
Bugtraq ID:66380 CVE ID:CVE-2014-2570 php-font-lib是一款读取，解析，导出不同字体类型文件的PHP库。 通过"name" GET参数传递给www/makesubset.php的输入在返回用户之前缺少过滤，允许远程攻击者利用漏洞构建恶意URI，诱使用户解析，可获取敏感信息或劫持用户会话。 0 php-font-lib 0.x php-font-lib 0.3.1已经修复该漏洞，建议用户下载更新： https://github.com/PhenX/php-font-lib...
ChatNess 2.5 Session Fixation
Exploit Title: ChatNess 2.5 Session Fixation Script Date: 2014 18 March Author: Dr.3v1l Vendor Homepage: http://www.chatness.us Version : 2.5 Tested on: Windows Category: webapps Google Dork: intext:"Powered by Chatness" + Exploit : http:///chatness/chatness/chat.php Discovered by: Scripting...
PyroCMS "email"跨站脚本漏洞
PyroCMS是一款内容管理系统。 由于传递到index.php/register中"email" POST参数的输入在返回用户前未能正确过滤，攻击者可以利用漏洞在受影响站点上下文的用户浏览器会话中执行任意HTML和脚本代码。 0 PyroCMS 2.2.3 目前厂商暂无提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： https://www.pyrocms.com/...
Drupal Project Issue File Review模块HTML注入漏洞
Bugtraq ID:65830 Drupal是一套开放源码的内容管理平台。 Drupal Project Issue File Review存在跨站脚本漏洞，允许远程攻击者利用漏洞注入恶意脚本或HTML代码，当恶意数据被查看时，可获取敏感信息或劫持用户会话。 0 Drupal Project Issue File Review 6.x-2.0 厂商补丁： Drupal ----- Drupal Project Issue File Review 6.x-2.17已经修复该漏洞，建议用户下载更新： http://drupal.org/project/projectissuefilerev...
Mozilla Firefox Cookie Verification Denial of Service Vulnerability - Mac OS X
Mozilla Firefox is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Mozilla Firefox Cookie Verification Denial of Service Vulnerability - Windows
Mozilla Firefox is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Motorola WiMAX CPEi25890 /cgi-bin/f1_fcgi_cgi.fcgi设备名字段跨站脚本漏洞
code/codeMotorola WiMAX CPEi25890是摩托罗拉发布的WiMax猫。 Motorola WiMAX CPEi25890 /cgi-bin/f1fcgicgi.fcgi脚本不正确过滤设备名字段输入，允许远程攻击者利用漏洞注入恶意脚本或HTML代码，当恶意数据被查看时可获取敏感信息或者劫持用户会话。 Motorola WiMAX CPEi25890是摩托罗拉发布的WiMax猫。 Motorola WiMAX CPEi25890...
Movable Type Rich Text Editor脚本注入漏洞
Movable Type是一款基于WEB的网络博客系统。 由于通过网页键入的输入在富文本编辑器显示之前缺少过滤。在恶意数据被查看时，攻击者可以利用漏洞在受影响站点上下文的用户浏览器会话中执行任意HTML和脚本代码。 下列产品和版本存在漏洞： Movable Type Pro version 6.0 Movable Type Pro versions 5.2.x, 5.1x, and 5.0x Movable Type Open Source MTOS versions 5.2.x, 5.1x, and 5.0x Movable Type Advanced / Movable Type...
Mandriva Linux Security Advisory : mediawiki (MDVSA-2013:290)
Updated mediawiki packages fix security vulnerabilities : Kevin Israel Wikipedia user PleaseStand identified and reported two vectors for injecting JavaScript in CSS that bypassed MediaWiki's blacklist CVE-2013-4567, CVE-2013-4568. Internal review while debugging a site issue discovered that...