1329 matches found
FileZilla 2.2.15 - FTP Client Hard-Coded Cipher Key
// source: https://www.securityfocus.com/bid/14730/info FileZilla FTP client may allow local attackers to obtain user passwords and access remote servers. The application uses a hard-coded cipher key to decrypt the password, which is stored in an XML file or the Windows Registry. This can allow t...
CVE-2004-2415: Undefined Security Weakness
Davenport before 0.9.10 allows attackers to cause a denial of service resource consumption via 1 a very large XML file or 2 entity expansion attacks...
Read parts of any XML-file via customize parameter in Oracle Reports
Name Read parts of any XML-file via customize parameter in Oracle Reports Systems Affected All version of Oracle Reports Severity Medium Risk Category Information disclosure Vendor URL http://www.oracle.com Author Alexander Kornbrust ak at red-database-security.com Date 19 July 2005 V 1.00 Adviso...
Oracle Reports Server 6.0.8/9.0.x - XML File Disclosure
source: https://www.securityfocus.com/bid/14311/info Oracle Reports Server may allow remote attackers to disclose parts of arbitrary XML files. Reportedly, the server fails to restrict users from accessing parts of arbitrary XML files when handling specially crafted HTTP GET requests. All version...
CVE-2005-1921
Eval injection vulnerability in PEAR XMLRPC 1.3.0 and earlier aka XML-RPC or xmlrpc and PHPXMLRPC aka XML-RPC For PHP or php-xmlrpc 1.1 and earlier, as used in products such as 1 WordPress, 2 Serendipity, 3 Drupal, 4 egroupware, 5 MailWatch, 6 TikiWiki, 7 phpWebSite, 8 Ampache, and others, allows...
CVE-2005-2108
SQL injection vulnerability in XMLRPC server in WordPress 1.5.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via input that is not filtered in the HTTPRAWPOSTDATA variable, which stores the data in an XML file...
CVE-2005-2108
SQL injection vulnerability in XMLRPC server in WordPress 1.5.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via input that is not filtered in the HTTPRAWPOSTDATA variable, which stores the data in an XML file...
WordPress <= 1.5.1.2 - SQL injection
Because of this vulnerability in XMLRPC server, attackers can execute arbitrary SQL commands via input that is not filtered in the HTTPRAWPOSTDATA variable, which stores the data in an XML file. Solution Update the WordPress to the latest available version at least 1.5.1.3...
WordPress <= 1.3.0 - Eval Injection
Because of this vulnerability in PEAR XMLRPC, attackers can execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement. Solution Update the WordPress to the latest available version at least 1.4...
CVE-2004-2415
Davenport before 0.9.10 allows attackers to cause a denial of service resource consumption via 1 a very large XML file or 2 entity expansion attacks...
Fedora Core 1 2004-087: libxml2
The remote host is missing the patch for the advisory FEDORA-2004-087 libxml2. This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or...
CVE-2003-0446
Cross-site scripting XSS in Internet Explorer 5.5 and 6.0, possibly in a component that is also used by other Microsoft products, allows remote attackers to insert arbitrary web script via an XML file that contains a parse error, which inserts the script in the resulting error message...
Witango & Tango 2000 Application Server Remote System Buffer Overrun
NGSSoftware Insight Security Research Advisory Name: WiTango Application Server & Tango 2000 Systems Affected: Windows Severity: Critical Risk Category: Remote System Buffer Overrun Vendor URL: http://www.witango.com Author: Mark Litchfield [email protected] Date: 18th July 2003 Advisory numbe...
ZH2003-9SA (security advisory): .netCart information disclusure
ZH2003-9SA security advisory: .netCart information disclusure Published: 16/07/2003 Released: 16/07/2003 Name: .netCart Affected Systems: All versions ? Issue: Remote attackers can obtain admin information including passwords Author: [email protected] Description Zone-h Security Team has...
.netCART Settings.XML - Information Disclosure
.netCART Settings.XML - Information Disclosure source: https://www.securityfocus.com/bid/8210/info .netCART is a web based e-commerce and shopping cart site designed for ASP.NET. It has been alleged that .netCART fails to adequately protect the contents of a directory in a default install. It is...
.netCART Settings.XML - Information Disclosure
source: https://www.securityfocus.com/bid/8210/info .netCART is a web based e-commerce and shopping cart site designed for ASP.NET. It has been alleged that .netCART fails to adequately protect the contents of a directory in a default install. It is therefore reportedly possible for remote users ...
CVE-2003-0446
Cross-site scripting XSS in Internet Explorer 5.5 and 6.0, possibly in a component that is also used by other Microsoft products, allows remote attackers to insert arbitrary web script via an XML file that contains a parse error, which inserts the script in the resulting error message...
CVE-2003-0446
The CVE-2003-0446 entry concerns Cross-site Scripting (XSS) in Internet Explorer 5.5 and 6.0, potentially in a shared component used by other Microsoft products. The vulnerability arises when processing an XML file that contains a parse error, which allows remote attackers to inject arbitrary web...
CVE-2003-0446: Undefined Security Weakness
Cross-site scripting XSS in Internet Explorer 5.5 and 6.0, possibly in a component that is also used by other Microsoft products, allows remote attackers to insert arbitrary web script via an XML file that contains a parse error, which inserts the script in the resulting error message...
CVE-2002-0648
The legacy data-island capability for XML in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to read arbitrary XML files, and portions of other files, via a URL whose "src" attribute redirects to a local file...