CVE-2011-0333

Summary: CVE-2011-0333 is a heap-based buffer overflow in GroupWise Internet Agent (GWIA) related to parsing the TZNAME property in VCALENDAR data. The flaw resides in NgwiCalVTimeZoneBody::ParseSelf within gwwww1.dll on Novell GroupWise 8.0 before HP3, enabling remote code execution via a crafte...

BuzzyWall 1.3.2 File Disclosure

BuzzyWall 1.3.2 resolute.php Local File Disclosure Exploit Found by cr4wl3r @hackb0x d0rk: no d0rk f0r kiddi0ts Script: http://sourceforge.net/projects/buzzywall/files/buzzywall/ err0r c0de resolute.php ?PHP header "Content-type: image/jpeg"; $img = $GET'img'; header'Content-Disposition:...

CVE-2011-3714

CVE-2011-3714 affects ClanSphere 2010.0. The vulnerability allows remote attackers to obtain sensitive information through a direct request to a .php file (mods/board/attachment.php), causing an error message that reveals the installation path. The provided sources describe this path disclosure, ...

Inline attachment downloads vulnerable to XSS by setting tweaked HTML content type

Please see CONFDEV-9069 https://jira.atlassian.com/browse/CONFDEV-9069 for the current issue addressed at fixing attachment XSS vulnerabilities. --- TLDR: white-list mime-types which can be served "inline" and don't let the user set arbitrary mime-types. I have been having a good laugh sorry...

Threat Outbreak Alert: Malicious Personal Pictures Attachment Email Messages on August 22, 2013

Low Alert ID: 24023 First Published: 2011 August 29 15:30 GMT Last Updated: 2013 August 23 12:24 GMT Version: 107 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain personal pictures for the recipient. The text in the message body attempt...

Jcow Social Networking Script 4.2 <= 5.2 Arbitrary Code Execution

Exploit for php platform in category web applications Exploit Title: Jcow CMS 4.x:4.2 Software Link: http://sourceforge.net/projects/jcow/files/jcow4/jcow.4.2.1.zip/download Version: 4.x:4.2 5.6.7.8:34441 at Sat Jun 04 00:00:44 +0000 2011 require 'msf/core' class Metasploit3 'JCow CMS Remote...

Jcow Social Networking Script 4.2 5.2 - Arbitrary Code Execution (Metasploit)

Jcow Social Networking Script 4.2 5.2 - Arbitrary Code Execution Metasploit Exploit Title: Jcow CMS 4.x:4.2 Software Link: http://sourceforge.net/projects/jcow/files/jcow4/jcow.4.2.1.zip/download Version: 4.x:4.2 5.6.7.8:34441 at Sat Jun 04 00:00:44 +0000 2011 require 'msf/core' class Metasploit3...

Discuz! X2 forum_attachment.php sql注入漏洞

No description provided by source...

Fedora Update for clamav FEDORA-2011-10090

Check for the Version of clamav OpenVAS Vulnerability Test Fedora Update for clamav FEDORA-2011-10090 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the ter...

FreeBSD : bugzilla -- multiple vulnerabilities (dc8741b9-c5d5-11e0-8a8e-00151735203a)

A Bugzilla Security Advisory reports : The following security issues have been discovered in Bugzilla : - Internet Explorer 8 and older, and Safari before 5.0.6 do content sniffing when viewing a patch in 'Raw Unified' mode, which could trigger a cross-site scripting attack due to the execution o...

CVE-2011-2381

CRLF injection vulnerability in Bugzilla 2.17.1 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 allows remote attackers to inject arbitrary e-mail headers via an attachment description in a flagmail notificatio...

CVE-2011-2977

Bugzilla 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 on Windows does not delete the temporary files associated with uploaded attachments, which allows local users to obtain sensitive information by reading these files. NOTE: this issue exists because of a regression in 3...

CVE-2011-2977

Bugzilla 3.6.x (up to 3.6.5), 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 on Windows fail to delete temporary files created for uploaded attachments, allowing local users to read sensitive data. Root cause: regression in 3.6. Additionally, the vulnerability is limited to Windows builds as s...

CVE-2011-2381

Summary: CVE-2011-2381 is a CRLF injection vulnerability in Bugzilla that allows remote attackers to inject arbitrary email headers via an attachment description in a flagmail notification. The initial description lists affected versions: Bugzilla 2.17.1–2.22.7, 3.0.x–3.3.x, 3.4.x before 3.4.12, ...

PT-2011-3819

Name of the Vulnerable Software and Affected Versions Bugzilla versions 2.17.1 through 2.22.7 Bugzilla versions 3.0.x through 3.3.x Bugzilla versions 3.4.x before 3.4.12 Bugzilla versions 3.5.x Bugzilla versions 3.6.x before 3.6.6 Bugzilla versions 3.7.x Bugzilla versions 4.0.x before 4.0.2...

Mozilla Bugzilla越权访问漏洞(CVE-2011-2977)

BUGTRAQ ID: 49042 CVE ID: CVE-2011-2977 Bugzilla是很多软件项目都在使用的基于Web的BUG跟踪系统。 Bugzilla在实现上存在多个安全漏洞，远程攻击者可利用这些漏洞获取敏感信息，执行脚本插入和欺骗攻击。 用于上传附件的临时文件没有在Windows上删除。对服务器有本地访问权限的用户可在通常情况下不允许从Bugzilla中查看附件时查看附件。 Mozilla Bugzilla 4.x Mozilla Bugzilla 3.x Mozilla Bugzilla 2.x 厂商补丁： Mozilla -------...

Threat Outbreak Alert: Fake Electronic Payment Cancellation Email Messages on April 8, 2014

Medium Alert ID: 23517 First Published: 2011 June 29 14:00 GMT Last Updated: 2014 April 10 13:53 GMT Version: 80 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain an electronic payment cancellation for the recipient. The text in the e-ma...

Jira Atlassian File Attachment Download

======================================= Jira Atlassian File Attachment Download ======================================= Exploit Title: Jira Atlassian Date: 28/3/2010 Author: Ignacio Garrido Mail: Ign.sec gmail com Software Link: http://www.atlassian.com/software/jira/JIRADownloadCenter.jspa...

Atlassian JIRA 3.13.5 - File Download Security Bypass

source: https://www.securityfocus.com/bid/48484/info Atlassian JIRA is prone to a security bypass vulnerability. An attacker can exploit this issue to download arbitrary attachment files within the context of the affected application. = $argv3 echo "\n\nThe second number must be bigger than the...

CVE-2011-1218

Buffer overflow in kvarcve.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execute arbitrary code via a crafted .zip attachment, aka SPR PRAD8E3NSP. NOTE: some of these details are obtained from third party information...