CuteNews 1.3 Comment HTML Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/10750/info CutePHP is reported prone to an HTML injection vulnerability. The vulnerability exists due to insufficient sanitization of user-supplied input. Specifically, user-supplied input to comment posts are not...

BigACE 2.7.5 - 'LANGUAGE' Directory Traversal

source: https://www.securityfocus.com/bid/66350/info BIGACE Web CMS is prone to an SQL-injection vulnerability and a local file-include vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker can exploit these vulnerabilities to compromise the application, access o...

ICU: Layout Engine font layout and glyph table errors (JDK 2D, 8004994)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors relate...

CVE-2010-4727

Smarty before 3.0.0 beta 7 does not properly handle the tags, which has unspecified impact and remote attack vectors...

CVE-2010-4722

Unspecified vulnerability in the fetch plugin in Smarty before 3.0.2 has unknown impact and remote attack vectors...

Oracle Siebel 7.7/7.8 - '/loyalty_enu/start.swe' Cross-Site Scripting

source: https://www.securityfocus.com/bid/38456/info Oracle Siebel is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context...

rNote 0.9.7 - 'rnote.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/26140/info rNote is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input. Exploiting these vulnerabilities may allow an attacker to perform cross-site scripting attacks on...

PT-2007-4751 · Microsoft · Office Excel

Name of the Vulnerable Software and Affected Versions: Microsoft Excel version 2003 SP2 Description: The issue is related to an unspecified vulnerability in Microsoft Excel, potentially connected to the sheet name. It may allow remote attackers to have an unknown impact via unspecified vectors...

XSS in TheFaceBook round 2

Authors: Alex Lanstein, Ivo Parashkevov Date: November 15, 2004 Affected Software: TheFaceBook - All Versions Software URL: http://www.thefacebook.com TheFaceBook, a popular college networking social, not technological tool is vulnerable to many XSS holes in it's search and editing methods. In...

Yahoo! Messenger 4.05.0 - Remote Denial of Service

Yahoo! Messenger 4.05.0 - Remote Denial of Service source: https://www.securityfocus.com/bid/8523/info It has been reported that multiple PC2Phone products are prone to a remote denial of service condition. The problem is said to occur when processing excessive data passed to the programs via a U...

DeskSoft CheckMail 1.2 - Password Disclosure

DeskSoft CheckMail 1.2 - Password Disclosure source: https://www.securityfocus.com/bid/8449/info It has been reported that a password disclosure issue exists in CheckMail allowing a local user to access sensitive authentication information through the Windows Registry. The software stores user...

Oracle 9iAS creates temporary files when processing JSP requests that are world-readable

Overview Oracle Database Server version 9iAS makes JSP source code publicly available. The source code may be used by attackers to analyze proprietary business logic or uncover Oracle's network configuration, usernames, and/or passwords. Description When Oracle receives a request for JSP file, it...

CVE-2001-0911

PHP-Nuke 5.1 stores user and administrator passwords in a base-64 encoded cookie, which could allow remote attackers to gain privileges by stealing or sniffing the cookie and decoding it...

CVE-2001-0288

Cisco switches and routers running IOS 12.1 and earlier produce predictable TCP Initial Sequence Numbers ISNs, which allows remote attackers to spoof or hijack TCP connections...

Tomcat 3.0/3.1 Snoop Servlet - Information Disclosure

source: https://www.securityfocus.com/bid/1532/info A vulnerability exists in the snoop servlet portion of the Tomcat package, version 3.1, from the Apache Software Foundation. Upon hitting an nonexistent file with the .snp extension, too much information is presented by the server as part of the...