CVE-2011-2694: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the chgpasswd function in web/swat.c in the Samba Web Administration Tool SWAT in Samba 3.x before 3.5.10 allows remote authenticated administrators to inject arbitrary web script or HTML via the username parameter to the passwd program aka the user field...

Samba 3.x < 3.3.16 / 3.4.14 / 3.5.10 Multiple Vulnerabilities

According to its banner, the version of Samba 3.x running on the remote host is earlier than 3.3.16 / 3.4.14 / 3.5.10. As such, it is potentially affected by several vulnerabilities in the Samba Web Administration Tool SWAT : - A cross-site scripting vulnerability exists because of a failure to...

CVE-2011-2694

Cross-site scripting XSS vulnerability in the chgpasswd function in web/swat.c in the Samba Web Administration Tool SWAT in Samba 3.x before 3.5.10 allows remote authenticated administrators to inject arbitrary web script or HTML via the username parameter to the passwd program aka the user field...

SWAT Samba Web Administration Tool - Cross-Site Request Forgery

SWAT Samba Web Administration Tool - Cross-Site Request Forgery Thanks & Regards, Narendra. Confidentiality: This e-mail and any attachments may be confidential and may also be privileged. If you are not an intended named recipient, please notify the sender immediately and do not disclose the...

SWAT Samba Web Administration Tool Cross-Site Request Forgery PoC

Exploit for cgi platform in category web applications Thanks & Regards, Narendra. Confidentiality: This e-mail and any attachments may be confidential and may also be privileged. If you are not an intended named recipient, please notify the sender immediately and do not disclose the contents to...

Oracle Secure Backup Administration Server login.php XSS

The version of Oracle Secure Backup Administration server running on the remote host has a cross-site scripting vulnerability. Input to the 'mode' parameter of login.php is not properly sanitized. A remote attacker could exploit this by tricking a user into requesting a maliciously crafted URL,...

Samba -- cross site scripting and request forgery vulnerabilities

Samba security advisory reports: All current released versions of Samba are vulnerable to a cross-site request forgery in the Samba Web Administration Tool SWAT. By tricking a user who is authenticated with SWAT into clicking a manipulated URL on a different web page, it is possible to manipulate...

Oracle Secure Backup Administration Server login.php uname Parameter Arbitrary Command Injection

The version of Oracle Secure Backup Administration Server running on the remote host fails to adequately sanitize user-supplied input to the 'uname' parameter of 'login.php'. The system performs some sanitization which limits exploitation of this issue, but code execution is still possible. A...

IBM WebSphere Application Server 6.1 < 6.1.0.39 Multiple Vulnerabilities

IBM WebSphere Application Server 6.1 before Fix Pack 39 appears to be running on the remote host. As such, it is potentially affected by the following vulnerabilities : - Use of an insecure XML encryption algorithm could allow for decryption of JAX-RPC or JAX-WS Web Services requests. PM34841 - A...

CVE-2011-2260

Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Sun Products Suite 2.1.1 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Administration...

CVE-2011-2260

Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Sun Products Suite 2.1.1 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Administration...

CVE-2011-0852

Unspecified vulnerability in the Security Management component in Oracle Database Server 10.1.0.5, 10.2.0.3, and 10.2.0.4; and Oracle Enterprise Manager Grid Control 10.1.0.6; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Audit...

CVE-2011-1511

Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Sun Products Suite 2.1.1 and 3.0.1 allows remote attackers to execute arbitrary code via unknown vectors related to Administration...

Design/Logic Flaw

Unspecified vulnerability in the Security Management component in Oracle Database Server 10.1.0.5, 10.2.0.3, and 10.2.0.4; and Oracle Enterprise Manager Grid Control 10.1.0.6; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Audit...

Buffer overflow

Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Sun Products Suite 2.1.1 and 3.0.1 allows remote attackers to execute arbitrary code via unknown vectors related to Administration...

PT-2011-3721

Name of the Vulnerable Software and Affected Versions Oracle GlassFish Server version 2.1.1 Description The issue affects confidentiality and integrity, allowing remote attackers to exploit it via unknown vectors related to Administration. Recommendations For Oracle GlassFish Server version 2.1.1...

PT-2011-2700

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 10.1.0.5, 10.2.0.3, 10.2.0.4 Oracle Enterprise Manager Grid Control version 10.1.0.6 Description The issue affects the Security Management component, allowing remote attackers to impact confidentiality, integrit...

PT-2011-3178

Name of the Vulnerable Software and Affected Versions Oracle GlassFish Server versions 2.1.1 and 3.0.1 Description The issue allows remote attackers to execute arbitrary code via unknown vectors related to Administration in the Oracle GlassFish Server component. Recommendations For Oracle GlassFi...

CVE-2011-1511: Undefined Security Weakness

Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Sun Products Suite 2.1.1 and 3.0.1 allows remote attackers to execute arbitrary code via unknown vectors related to Administration...

CVE-2011-0852: Undefined Security Weakness

Unspecified vulnerability in the Security Management component in Oracle Database Server 10.1.0.5, 10.2.0.3, and 10.2.0.4; and Oracle Enterprise Manager Grid Control 10.1.0.6; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Audit...