Cross site scripting

Cross-site scripting XSS vulnerability in IBM WebSphere Lombardi Edition 7.2 allows remote attackers to inject arbitrary web script or HTML via crafted text input to a coach that is configured with a document attachment control section...

CVE-2012-0707

Cross-site scripting XSS vulnerability in IBM WebSphere Lombardi Edition 7.2 allows remote attackers to inject arbitrary web script or HTML via crafted text input to a coach that is configured with a document attachment control section...

Threat Outbreak Alert: Fake UPS Payment Document Attachment Email Messages on January 21, 2014

Low Alert ID: 25171 First Published: 2012 February 13 15:22 GMT Last Updated: 2014 January 22 15:06 GMT Version: 53 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a payment document from the United Parcel Service UPS for the recipient...

CVE-2011-5077

Unrestricted file upload vulnerability in attachement.php in HDWiki 5.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in image directory...

Nova CMS - Directory Traversal

Nova CMS - Directory Traversal Title : Nova CMS Directory Travel Author : Red Security TEAM Date : 21/01/2012 Download : http://www.nova-cms.com/uploads/files/novacms.zip Tested On : CentOS Dork : Copyright ©2005-2011 by Nova CMS. Contact : Info 4t RedSecurity d0t COM Home : http://RedSecurity.CO...

CVE-2011-2271

Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2 allows remote authenticated users to affect integrity via unknown vectors related to Attachments / File Upload...

Vulnerabilities in XnViewer Could Allow Remote Code Execution

Executive Summary Microsoft is providing notification of the discovery and remediation of two integer overflow vulnerabilities affecting XnViewer version 1.98.2 and earlier versions. Microsoft discovered and disclosed the vulnerabilities under coordinated vulnerability disclosure to the affected...

CVE-2011-3669

Cross-site request forgery CSRF vulnerability in attachment.cgi in Bugzilla 2.x, 3.x, and 4.x before 4.2rc1 allows remote attackers to hijack the authentication of arbitrary users for requests that upload attachments...

CVE-2011-3669

Cross-site request forgery CSRF vulnerability in attachment.cgi in Bugzilla 2.x, 3.x, and 4.x before 4.2rc1 allows remote attackers to hijack the authentication of arbitrary users for requests that upload attachments...

CVE-2011-3669

Cross-site request forgery CSRF vulnerability in attachment.cgi in Bugzilla 2.x, 3.x, and 4.x before 4.2rc1 allows remote attackers to hijack the authentication of arbitrary users for requests that upload attachments...

Vulnerability in Hex-Rays IDA Pro, IDAPython Plugin Could Allow Arbitrary Script Execution

Executive Summary Microsoft is providing notification of the discovery and remediation of a vulnerability affecting IDA Pro running the IDAPython plugin. By default, the IDAPython plugin is installed with all versions of IDA Pro. Microsoft discovered and disclosed the vulnerability under...

Microsoft Publisher Malformed File Parsing Memory Corruption (MS11-091; CVE-2011-3412)

A remote code execution vulnerability has been reported in Microsoft Publisher. The vulnerability is due to an error in the way Microsoft Publisher handles memory while parsing specially crafted Publisher files. A remote attacker may exploit this vulnerability by convincing a user to open a...

Microsoft PowerPoint OfficeArt Shape Remote Code Execution (MS11-094; CVE-2011-3413)

A remote code execution vulnerability has been reported in Microsoft PowerPoint. The vulnerability is due to memory corruption in PowerPoint while reading an invalid record in a specially crafted PowerPoint file. A remote attacker may exploit this vulnerability by convincing a target user to open...

Microsoft Publisher Invalid Pointer Code Execution (MS11-091; CVE-2011-3411)

A remote code execution vulnerability has been reported in Microsoft Publisher. The vulnerability is caused when Microsoft Publisher does not properly handle values in memory while parsing specially crafted Publisher files. A remote attacker may exploit this vulnerability by convincing a user to...

Docebo Lms 4.0.4 - Messages Remote Code Execution

Docebo Lms 4.0.4 - Messages Remote Code Execution if$GLOBALS'modname' != '' $modulecfg =& createModule...

Apple Mac OS X Mail MIME附件拒绝服务漏洞

Mac OS是一套运行于苹果的Macintosh系列电脑上的操作系统。 Apple Mac OS X在Mail应用的实现上存在安全漏洞，可被恶意用户利用造成拒绝服务。 此漏洞源于在处理某些电子邮件时Mail应用程序中的错误，可被利用通过包含大量MIME附件的电子邮件使应用程序崩溃。可使用另一个电子邮件客户端删除恶意电子邮件。 Apple Macintosh OS X 厂商补丁： Apple ----- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://support.apple.com/...

[SECURITY] Fedora 14 Update: clamav-0.97.3-1400.fc14

Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs ar...

Facebook EXE attachment Vulnerability can Compromise with Users Security

Facebook EXE attachment Vulnerability can Compromise with Users Security Nathan Power from SecurityPentest has discovered new Facebook Vulnerability, that can easily attach EXE files in messages,cause possible User Credentials to be Compromised . When using the Facebook 'Messages' tab, there is a...

CVE-2011-2303

Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.2, and 12.1.3 allows remote authenticated users to affect integrity via unknown vectors related to Attachments / File Upload...

Novell Groupwise Client DOCX Loader Relationship Id Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell Groupwise Client. User interaction is required to exploit this vulnerability in that the target must open a malicious e-mail message. The specific flaw exists within the component responsibl...