98 matches found
VMware Horizon View Multiple Vulnerabilities (VMSA-2015-0003) (VMSA-2015-0008) (POODLE)
The VMware Horizon View installed on the remote Windows host is version 5.x prior to 5.3.4 or version 6.x prior to 6.1. It is, therefore, affected by the following vulnerabilities : - A man-in-the-middle MitM information disclosure vulnerability, known as POODLE, exists due to the way SSL 3.0...
Apache Tomcat Version 5.x Detection
Binary data 8926.prm...
PHP 4.x/5.x Html_Entity_Decode() Information Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/17296/info PHP 'htmlentitydecode' function is prone to an information-disclosure vulnerability. This issue arises when a script using the function accepts data from a remote untrusted source and returns the function's...
Adobe Reader Plugin Signature Bypass Vulnerability - Linux
Adobe Reader is prone to plugin signature bypass vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
ESA-2014-021: RSA Archer® GRC Multiple Cross-Site Scripting Vulnerabilities
ESA-2014-021.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-021: RSA Archer® GRC Multiple Cross-Site Scripting Vulnerabilities EMC Identifier: ESA-2014-021 CVE Identifier: CVE-2014-0639 Severity Rating: CVSS v2 Base Score: 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P Affected Products: RSA Archer...
Oracle Java SE 5.x, 6.x, 7.x, 8.x Multiple Vulnerabilities (cpuapr2014) - Windows
Oracle Java SE is prone to multiple vulnerabilities. Copyright C 2014 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
CubeCart会话固定漏洞
CubeCart是一个购物车程序。 CubeCart处理会话存在错误，允许攻击者构建恶意URI，诱使用户解析，可劫持其他用户会话，登录应用系统。 0 CubeCart 5.x CubeCart 5.2.9版本已修复该漏洞，建议用户下载使用： http://www.cubecart.com...
WHMCS多个未明安全漏洞
Bugtraq ID:66498 WHMCS是一套专为主机业务及其他在线交易开发的客户管理，财务，支持软件。 WHMCS存在未明安全漏洞，目前没有详细漏洞细节提供。 0 WHMCS 5.x WHMCS 5.2.17或5.3.6已经修复该漏洞，建议用户下载更新： http://www.whmcs.com...
PHP 'open_basedir' Security Bypass Vulnerability
PHP is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:php:php"; ifdescription...
ESA-2013-079: RSA Archer® GRC Multiple Cross-Site Scripting Vulnerabilities
ESA-2013-079.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-079: RSA Archer® GRC Multiple Cross-Site Scripting Vulnerabilities EMC Identifier: ESA-2013-079 CVE Identifier: CVE-2013-6178 Severity Rating: CVSS v2 Base Score: 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P Affected Products: RSA Archer...
WebTester 5.x Command Execution
This module exploits a command execution vulnerability in WebTester version 5.x. The 'install2.php' file allows unauthenticated users to execute arbitrary commands in the 'cpusername', 'cppassword' and 'cpdomain' parameters. Module Options msf use exploit/unix/webapp/webtester/exec msf...
Cross site scripting
Cross-site scripting XSS vulnerability in Arbor Networks Peakflow SP 5.1.1 before patch 6, 5.5 before patch 4, and 5.6.0 before patch 1 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to index...
Jcow Social Networking Script 4.2 <= 5.2 Arbitrary Code Execution
Exploit for php platform in category web applications Exploit Title: Jcow CMS 4.x:4.2 Software Link: http://sourceforge.net/projects/jcow/files/jcow4/jcow.4.2.1.zip/download Version: 4.x:4.2 5.6.7.8:34441 at Sat Jun 04 00:00:44 +0000 2011 require 'msf/core' class Metasploit3 'JCow CMS Remote...
PHP 5.x<5.3.6 Zip扩展stream_get_contents拒绝服务漏洞
No description provided by source...
CVE-2011-1158
Cross-site scripting XSS vulnerability in feedparser.py in Universal Feed Parser aka feedparser or python-feedparser 5.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via an unexpected URI scheme, as demonstrated by a javascript: URI...
SA-CONTRIB-2010-086 - Prepopulate - Access Bypass
The Prepopulate module provides the ability for form fields to be pre-populated via the request sent for the form. The module is vulnerable to access bypass which would allow a malicious user to change the value of fields they would not otherwise have access to alter. Versions affected Prepopulat...
SA-CONTRIB-2010-023 - Workflow - Cross Site Scripting
When used in combination with the Token module, the Workflow module does not escape the text entered into the Comment field of the workflow fieldset on the node form. This allows a user with the permission to change the workflow state of a node to perform a Cross Site Scripting XSS attack if a...
XSS Vulnerability in Drupal's Node Blocks contributed module (6.x-1.3 and 5.x-1.1)
XSS Vulnerability in Drupal's Node Blocks contributed module 6.x-1.3 and 5.x-1.1 Discovered by Martin Barbella [email protected] Description of Vulnerability: ----------------------------- Drupal is a free software package that allows an individual or a community of users to easily publish,...
SA-CONTRIB-2009-011 Tasklist - SQL injection and Cross site scripting
Tasklist does not properly use the Drupal database API and inserts values from the URL directly into queries. This can be exploited to perform SQL Injection attacks. These attacks may lead to a malicious user gaining full administrator access. In addition, Tasklist allows users to add CSS to page...
SA-2008-070 - Comment Mail - Cross site request forgery
The Comment Mail module allows an email to be sent to the site administrators when new comments are posted. Links in the email allow for quick approval, editing, deletion of the comment and/or banning of the poster's IP address. Unfortunately some links are vulnerable to cross site request...