postgresql: Absent permission checks on trigger function to be called when creating a trigger

CREATE TRIGGER in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 does not properly check the execute permission for trigger functions marked SECURITY DEFINER, which allows remote authenticated users to execute otherwise restricted triggers on...

Toenda CMS 1.6.2 Osaka Stable Local File Inclusion

============TOENDA CMS 1.6.2 OSAKA "STABLE" MULTIPLE VULNERABILITIES============ Vulnerable Software: toendaCMS1.6.2OsakaStable Developed by: http://www.toendacms.org/index.php/en/open/download.html toenda.com http://www.toendacms.org/index.php/en/open/download.html Downloaded from:...

HomeSeer HS2 2.5.0.20 - Web Interface Log Viewer Page URI Cross-Site Scripting

HomeSeer HS2 2.5.0.20 - Web Interface Log Viewer Page URI Cross-Site Scripting source: https://www.securityfocus.com/bid/50978/info HS2 web interface is prone to multiple security vulnerabilities: 1. An HTML-injection vulnerability. 2. A cross-site request-forgery vulnerability. 3. A...

Immunity Canvas: PDF_U3D

Name| pdfu3d ---|--- CVE| CVE-2011-2462 Exploit Pack| CANVAS Description| Adobe Acrobat Reader U3D bug Notes| CVE Name: CVE-2011-2462 VersionsAffected: 9.4 Repeatability: Infinite References: http://www.symantec.com/connect/blogs/new-zero-day-pdf-exploit-used-targeted-attack Date public: 6 Decemb...

acroread: multiple code execution flaws (APSB11-16)

Buffer overflow in Adobe Reader and Acrobat 8.x before 8.3, 9.x before 9.4.5, and 10.x before 10.1 on Windows and Mac OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2011-2094 and CVE-2011-2095...

CVE-2011-2732: Spring Security header injection vulnerability

CVE-2011-2732: Spring Security header injection vulnerability Severity: Important Versions Affected: 2.0.0 to 2.0.6 3.0.0 to 3.0.5 Earlier versions may also be affected Description: Spring Security allows the use of a parameter named "spring-security-redirect" by default to determine the location...

Security advisory: SQL Injection in LedgerSMB 1.2.24 and lower

Hi all; The LedgerSMB development team has found an SQL injection issue in LedgerSMB 1.2.24. Because this issue stems from our common SQL-Ledger heritage, it affects all versions of LedgerSMB and has been confirmed in SQL-Ledger 2.8.33. We contacted Dieter when we initially discovered this and no...

Elgg 1.8 beta2 SQL Injection

Exploit for php platform in category web applications Elgg 1.8 beta2 and prior to 1.7.11 'containerguid' and 'ownerguid' SQL Injection Vendor URL: http://www.elgg.org/ Advisore: http://lostmon.blogspot.com/2011/08/elgg-18-beta2-and-prior-to-1711.html Vendor notify: YES exploit available: YES...

Mozilla Miscellaneous memory safety hazards (MFSA 2011-19)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, and Thunderbird before 3.1.11, allow remote attackers to cause a denial of service memory corruption and application crash or possibly execute arbitrary code via unknown vectors...

vBSEO 3.2.23.5.2 - Persistent Cross-Site Scripting via LinkBacks

vBSEO 3.2.23.5.2 - Persistent Cross-Site Scripting via LinkBacks vBSEO - Persistent XSS via LinkBacks http://www.exploit-db.com/vbseo-from-xss-to-reverse-php-shell/ Versions Affected: 3.5.2 & 3.2.2 Most likely all versions Info: A proven success record, vBSEO powers the most optimized forums on t...

SimpGB 1.49.2 - 'Guestbook.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/46033/info SimpGB is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the...

BlogCFC 5.9.6.001 - Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/45395/info BlogCFC is prone to multiple cross-site-scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the...

Mozilla use-after-free error in nsBarProp

Use-after-free vulnerability in the nsBarProp function in Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 allows remote attackers to execute arbitrary code by accessing the locationbar property of a closed window...

CVE-2010-3700: Spring Security bypass of security constraints

CVE-2010-3700 - Spring Security - Bypassing of security constraints Severity: Important Vendor: SpringSource, a division of VMware Versions affected: Spring Security 3.0.0 to 3.0.3 Spring Security 2.0.0 t0 2.0.5 Acegi Security 1.0.0 to 1.0.7 Description: Spring Security does not consider URL path...

Allinta CMS 22.07.2010 - Multiple SQL Injections / Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/42320/info Allinta CMS is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these vulnerabilities could allow an attacker to steal...

CVE-2010-2568

Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted 1 .LNK or 2 .PIF shortcut file, which is not properly handled during icon display in Windows Explorer...

iScripts ReserveLogic 1.0 SQL Injection

iScripts ReserveLogic 1.0 SQL Injection Vulnerability Name iScripts ReserveLogic Vendor http://www.iscripts.com Versions Affected 1.0 Author Salvatore Fresta aka Drosophila Website http://www.salvatorefresta.net Contact salvatorefresta at gmail dot com Date 2010-01-07 X. INDEX I. ABOUT THE...

CVE-2010-1622: Spring Framework execution of arbitrary code

CVE-2010-1622: Spring Framework execution of arbitrary code Severity: Critical Vendor: SpringSource, a division of VMware Versions Affected: 3.0.0 to 3.0.2 2.5.0 to 2.5.6.SEC01 community releases 2.5.0 to 2.5.7 subscription customers Earlier versions may also be affected Description: The Spring...

OpenJDK Subclasses of InetAddress may incorrectly interpret network addresses (6893954)

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.225 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2010-0093...

M.J.M. Quick Player 1.2 - Local Stack Buffer Overflow

Vulnerability : M.J.M. Quick Player v1.2 Stack BOF Discovered by : mrme seeleymagicathotmaildotcom Sploit written by : corelanc0d3r corelanc0d3ratgmaildotcom Sploit released : dec 28th, 2009 Type : local and remote code execution OS : Windows Product : M.J.M. Quick Player Versions affected : 1.2...