persistent xss through flash swf file attachment download

It is possible to upload a flash swf file which when the attachment 'download' url is visited the flash swf file is executed in the browser and as such can use ExternalInterface.call method to inject javascript defined in the swf file into the browser...

persistent xss through flash swf file attachment download

It is possible to upload a flash swf file which when the attachment 'download' url is visited the flash swf file is executed in the browser and as such can use ExternalInterface.call method to inject javascript defined in the swf file into the browser...

persistent xss through flash swf file attachment download

It is possible to upload a flash swf file which when the attachment 'download' url is visited the flash swf file is executed in the browser and as such can use ExternalInterface.call method to inject javascript defined in the swf file into the browser...

Apple QuickTime MPEG Parsing Memory Corruption

Executive Summary Microsoft is providing notification of the discovery and remediation of a vulnerability affecting Apple QuickTime Player software version 7.7.1 and earlier verisons. Microsoft discovered and disclosed the vulnerability under coordinated vulnerability disclosure to the affected...

Threat Outbreak Alert: Fake Order Request Details Email Messages on May 16, 2012

Low Alert ID: 25938 First Published: 2012 May 16 14:32 GMT Version: 1 Summary Cisco Security has detected significant activity related to German-language spam e-mail messages that claim to contain order request details for the recipient. The text in the e-mail message attempts to convince the...

Threat Outbreak Alert: Fake Terra Greeting Card Notification Email Messages on May 11, 2012

Low Alert ID: 25908 First Published: 2012 May 14 14:50 GMT Version: 1 Summary Cisco Security has detected significant activity related to Spanish-language spam e-mail messages that claim to contain a Terra greeting card for the recipient. The text in the e-mail message attempts to convince the...

persistent xss through svg file attachment download

The fix for CONF-22132 was not sufficient because "svg" files are not "said" to be xml by the isXml method. This means that is possible for a malicious party to upload a svg file containing html/javascript which will be rendered in victim's web browser. This bug should have been raised a while ag...

Proman Xpress 5.0.1 SQL Injection / XSS

Title: ====== Proman Xpress v5.0.1 - Multiple Web Vulnerabilities Date: ===== 2012-05-09 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=513 VL-ID: ===== 512 Common Vulnerability Scoring System: ==================================== 7.5 Introduction: ============= Proman...

Proman Xpress v5.0.1 - Multiple Web Vulnerabilities

Exploit for php platform in category web applications Title: ====== Proman Xpress v5.0.1 - Multiple Web Vulnerabilities Introduction: ============= Proman Xpress v5.0.1 is a super project management script coded in PHP & MySQL. It s highly customizable and is used across industries. No Encryption...

Threat Outbreak Alert: Fake Product Order Quotation Email Messages on July 5, 2015.

Low Alert ID: 25838 First Published: 2012 May 7 17:05 GMT Last Updated: 2015 July 15 12:27 GMT Version: 91 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a product order quotation for the recipient. The text in the email message...

siteserver cms 3.4.5 tasteless vulnerabilities and fixes-vulnerability warning-the black bar safety net

This vulnerability with the original vulnerability approach is very similar to that! To meet the two conditions of the system open up iis6 Register account-the document attachment management-Upload File we create a new layer directory of course before is can be established. the asp directory in t...

CVE-2011-4014

The TAC Case Attachment tool in Cisco Wireless Control System WCS 7.0 allows remote authenticated users to read arbitrary files under webnms/Temp/ via unspecified vectors, aka Bug ID CSCtq86807...

Threat Outbreak Alert: Fake FedEx Parcel Delivery Failure Notification Email Messages on May 11, 2015

Medium Alert ID: 25717 First Published: 2012 April 20 16:52 GMT Last Updated: 2015 May 12 14:46 GMT Version: 70 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a parcel delivery failure notification for the recipient. The text in the...

Code injection

@Mail WebMail Client in AtMail Open-Source before 1.05 allows remote attackers to execute arbitrary code via an e-mail attachment with an executable extension, leading to the creation of an executable file under tmp/...

CVE-2012-1916

CVE-2012-1916 affects the @Mail WebMail Client in AtMail Open-Source prior to version 1.05. The issue allows remote attackers to execute arbitrary code by delivering an email with an attachment that has an executable extension, resulting in creation of an executable file under tmp/. This is descr...

CVE-2012-1916

@Mail WebMail Client in AtMail Open-Source before 1.05 allows remote attackers to execute arbitrary code via an e-mail attachment with an executable extension, leading to the creation of an executable file under tmp/...

JPEG 2000 Memory Overwrite Vulnerability in OpenJPEG Could Allow Arbitrary Code Execution

Executive Summary Microsoft is providing notification of the discovery and remediation of a vulnerability affecting OpenJPEG software version 1.4 and earlier versions. Microsoft discovered and disclosed the vulnerability under coordinated vulnerability disclosure to the affected vendor, OpenJPEG...

Debian Security Advisory DSA 2416-1 (notmuch)

The remote host is missing an update to notmuch announced via advisory DSA 2416-1. OpenVAS Vulnerability Test $Id: deb24161.nasl 6612 2017-07-07 12:08:03Z cfischer $ Description: Auto-generated from advisory DSA 2416-1 notmuch Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc...

Threat Outbreak Alert: Fake Xerox Scan Attachment Email Messages on May 6, 2015

Medium Alert ID: 25325 First Published: 2012 March 6 18:23 GMT Last Updated: 2015 May 6 12:23 GMT Version: 75 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a scanned document from a Xerox WorkCentre Pro device. The text in the email...

CVE-2012-0707

Cross-site scripting XSS vulnerability in IBM WebSphere Lombardi Edition 7.2 allows remote attackers to inject arbitrary web script or HTML via crafted text input to a coach that is configured with a document attachment control section...