[SECURITY] Fedora 20 Update: ReviewBoard-1.7.22-2.fc20

Review Board is a powerful web-based code review tool that offers developers an easy way to handle code reviews. It scales well from small projects to large companies and offers a variety of tools to take much of the stress and time out of the code review process...

[SECURITY] Fedora 19 Update: ReviewBoard-1.7.22-1.fc19

Review Board is a powerful web-based code review tool that offers developers an easy way to handle code reviews. It scales well from small projects to large companies and offers a variety of tools to take much of the stress and time out of the code review process...

[SECURITY] Fedora 19 Update: mantis-1.2.17-1.fc19

Mantis is a free popular web-based issue tracking system. It is written in the PHP scripting language and works with MySQL, MS SQL, and PostgreSQL databases and a web server. Almost any web browser should be able to function as a client. Documentation can be found in: /usr/share/doc/mantis-1.2.17...

Palo Alto Networks PAN-OS < 5.0.10 / 5.1.x < 5.1.5 XSS

The remote host is running a version of Palo Alto Networks PAN-OS prior to 5.0.10 / 5.1.x prior to 5.1.5. It is, therefore, affected by a cross-site scripting vulnerability due to a failure to sanitize user-supplied input to the web-based device management interface. C Tenable Network Security,...

synetics i-doit pro API跨站脚本漏洞

BUGTRAQ ID：65957 CVE ID：CVE-2014-2231 Synetics i-doit是德国Synetics公司的一个基于Web的开源IT文档和CMDB（配置管理数据库），它能够记录IT系统及其变化的信息，同时针对系统变化制定应急方案，最终确保IT网络稳定、高效的运作。 synetics i-doit 1.2.5之前版本的的API存在跨站脚本漏洞，允许远程攻击者通过产权注入任意的web脚本或HTML。 0 synetics GmbH i-doit 1.2.4 synetics GmbH i-doit 1.1.1 synetics GmbH i-doit 1.1.2...

IBM Rational Quality Manager Jazz Team Server未明远程代码执行漏洞

Bugtraq ID:65900 CVE ID:CVE-2014-0862 IBM Rational Quality Manager是一款为完整的软件开发生命周期提供集成的测试计划和测试资产的协作的，基于Web的质量管理软件。 IBM Rational Quality Manager所包含的Jazz Team服务器存在未明错误，允许远程攻击者利用漏洞执行任意代码。 0 IBM Rational Quality Manager 2.x IBM Rational Quality Manager 3.x IBM Rational Quality Manager 4.x 厂商补丁： IBM...

CVE-2013-7032

Multiple cross-site scripting XSS vulnerabilities in the web based operator client in LiveZilla before 5.1.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 name of an uploaded file or 2 customer name in a resource created from an uploaded file, a different vulnerability...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the web based operator client in LiveZilla before 5.1.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 name of an uploaded file or 2 customer name in a resource created from an uploaded file, a different vulnerability...

CVE-2013-7032: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the web based operator client in LiveZilla before 5.1.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 name of an uploaded file or 2 customer name in a resource created from an uploaded file, a different vulnerability...

Cisco WLC Web-Based Management Interface XSS Vulnerability (CSCuf77810)

A vulnerability in the web-based management interface of the Cisco Wireless LAN Controller WLC could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface of the affected system. The vulnerability is due to insufficient input...

Shadowbox Local File Inclusion

Author: TUNISIAN CYBER + Exploit Title: Shadowbox LFI Vulnerability + Date: 03-02-2014 + Category: WebApp + Google Dork: : + Tested on: KaliLinux + Vendor: http://shadowbox-js.com/ + Friendly Sites: na3il.com,th3-creative.com +Description: Shadowbox is a web-based media viewer application that...

Cross-site Scripting Vulnerability

A cross-site scripting vulnerability exists in the web-based device management interface whereby data provided by the user is echoed back to the user without sanitization. Ref 59010...

CVE-2014-0751: Improper Limitation of a Pathname to a Restricted Directory

The CIMPLICITY Web-based access component, CimWebServer, does not check the location of shell files being loaded into the system. By modifying the source location, an attacker could send shell code to the CimWebServer which would deploy the nefarious files as part of any SCADA project. This could...

Patched Microsoft Office 365 XSS Vulnerability Disclosed

A researcher in the UK disclosed the details of a serious cross-site scripting vulnerability in Office 365 that would allow an attacker with a mailbox on Office 365 to gain administrator rights over the Microsoft Web-based application in an organization. An exploit in an enterprise environment...

Google Blocks Malicious File Downloads Automatically in Chome

Google has fixed five vulnerabilities in its Chrome browser and also has activated a feature that will block malicious file downloads automatically. The change is a major security upgrade for Chrome and will help prevent users from unwittingly downloading harmful files, an attack vector that...

Novell Client NetIdentity Agent Remote Pointer Dereference Code Execution - Ver2 (CVE-2009-1350)

The Novell NetIdentity agent works with eDirectory authentication to provide background authentication to Windows Web-based applications that require eDirectory authentication, such as iPrint, Novell Portal Services, eGuide, Novell NetIdentity, ZENworks, NetStorage, and iManager. NetIdentity...

Movable Type Rich Text Editor脚本注入漏洞

Movable Type是一款基于WEB的网络博客系统。 由于通过网页键入的输入在富文本编辑器显示之前缺少过滤。在恶意数据被查看时，攻击者可以利用漏洞在受影响站点上下文的用户浏览器会话中执行任意HTML和脚本代码。 下列产品和版本存在漏洞： Movable Type Pro version 6.0 Movable Type Pro versions 5.2.x, 5.1x, and 5.0x Movable Type Open Source MTOS versions 5.2.x, 5.1x, and 5.0x Movable Type Advanced / Movable Type...

Novell Client NetIdentity Agent Remote Pointer Dereference Code Execution - Ver2 (CVE-2009-1350)

The Novell NetIdentity agent works with eDirectory authentication to provide background authentication to Windows Web-based applications that require eDirectory authentication, such as iPrint, Novell Portal Services, eGuide, Novell NetIdentity, ZENworks, NetStorage, and iManager. NetIdentity...

ProjectForge跨站请求伪造和跨站脚本漏洞

ProjectForge是一个基于Web的项目管理解决方案包括:工时表Timesheet、费用管理、项目甘特图,控制和管理工程分解结构。 1 某些未明输入在用于JSON自动完成响应前未能正确过滤，攻击者可以在用户访问恶意数据时，利用漏洞在用户浏览器会话上下文中注入任意HTML和脚本代码。 2程序允许用户不进行适当的有效性检查，通过HTTP请求执行某些操作。当登录的用户访问特制的网页时，攻击者可以执行某些未指定的操作。 0 ProjectForge 5.x ProjectForge 5.3版本以修复此漏洞，建议用户下载使用： http://www.projectforge.org/...

ZendTo 'emailAddr' 脚本插入漏洞

CVECAN ID: CVE-2013-6808 ZendTo是基于Web的文件转换器。 ZendTo 4.11-12版本没有正确过滤pickup.php的 "emailAddr" 参数值，可导致插入任意HTML和脚本代码，被查看后，在受影响站点的用户浏览器上下文中执行这些代码。 0 ZendTo ZendTo = 4.11-12 厂商补丁： ZendTo ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.zend.to/changelog.phpZendTo ZendTo = 4.11-12...