PrestaShop cross-site scripting vulnerability (CNVD-2020-02542)

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides a variety of payment methods, short message alerts and product image scaling and other features. A cross-site scripting vulnerability exists in PrestaShop version 1.7.6.2. The...

Open-Xchange OX App Suite Cross-Site Scripting Vulnerability (CNVD-2019-36981)

Open-Xchange OX App Suite is a set of Web-based cloud desktop environments from Open-Xchange USA. The environment allows users to manage email, tasks, files, etc. more intuitively. A cross-site scripting vulnerability exists in Open-Xchange OX App Suite versions 7.10.1 and 7.10.2. The vulnerabili...

CVE-2019-2390

An unprivileged user or program on Microsoft Windows which can create OpenSSL configuration files in a fixed location may cause utility programs shipped with MongoDB server to run attacker defined code as the user running the utility. This issue MongoDB Server v4.0 versions prior to 4.0.11; Mongo...

DEBIAN-CVE-2017-7526

libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method for computing the sliding-window expansion. The same attack is believed to work on RSA-2048 with moderately more computation. This...

Palo Alto Networks Panorama VM Appliance Arbitrary Code Execution Vulnerability

Palo Alto Networks Panorama VM Appliance is a solution from Palo Alto Networks, Inc. that supports the use of Panorama as a virtual appliance to manage distributed firewall networks through a central location. An arbitrary code execution vulnerability exists in the Palo Alto Networks Panorama VM...

Dotproject HTML Injection Vulnerability

Dotproject is a set of Web-based project management and tracking tools. The tool provides modules for company management, project management and task progress tracking. An HTML injection vulnerability exists in Dotproject, which stems from the program's failure to adequately filter user-submitted...

MiniWeb (Build 300) Arbitrary File Upload

This module exploits a vulnerability in MiniWeb HTTP server build 300. The software contains a file upload vulnerability that allows an unauthenticated remote attacker to write arbitrary files to the file system. Code execution can be achieved by first uploading the payload to the remote machine ...

cURL and libcurl MD5 Digest Buffer Overflow (CVE-2013-0249)

The vulnerability is due to an error in Curlsaslcreatedigestmd5message while negotiating SASL DIGEST-MD5 authentication. A remote attacker can exploit this vulnerability by enticing a user to connect to a malicious server. This can lead to code execution in the context of the affected application...

e107 0.7.5 - 'search.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/18508/info e107 is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code execute in the browser of an...

Cumulative Patch for Internet Information Services (Q327696)

Cumulative Patch for Microsoft IIS Q327696 Impact of vulnerability: Ten new vulnerabilities, the most serious of which could enable code of an attacker's choice to be run on a server. Recommendation: Users using any of the affected products should install the patch immediately. Maximum Severity...

Elite Forum 1.0 - HTML Injection

Elite Forum 1.0 - HTML Injection source: https://www.securityfocus.com/bid/15257/info Elite Forum is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script...

Microsoft Internet Explorer DHTML Method Buffer Overflow Vulnerability

Description Microsoft Internet Explorer is prone to a heap-based buffer-overflow vulnerability caused by a boundary condition error that is exposed when passing data to the 'createControlRange' DHTML method. As a result, heap-based memory can be corrupted with attacker-supplied data. An attacker...

Firebird 1.0 - Remote Database Name Buffer Overrun

Firebird 1.0 - Remote Database Name Buffer Overrun source: https://www.securityfocus.com/bid/10446/info Firebird is reported prone to a remote buffer-overrun vulnerability. The issue occurs because the application fails to perform sufficient boundary checks when the database server is handling...

[Full-Disclosure] [SECURITY] [DSA 494-1] New ident2 packages fix buffer overflow

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 494-1 [email protected] http://www.debian.org/security/ Matt Zimmerman April 21st, 2004 http://www.debian.org/security/faq -...

GNU Anubis 3.6.x3.9.x - Multiple Format String Vulnerabilities

GNU Anubis 3.6.x3.9.x - Multiple Format String Vulnerabilities source: https://www.securityfocus.com/bid/9772/info GNU Anubis has been reported prone to multiple buffer overflow and format string vulnerabilities. It has been conjectured that a remote attacker may potentially exploit these...

Softshoe - Parse-file Cross-Site Scripting

source: https://www.securityfocus.com/bid/8294/info Softshoe is allegedly prone to cross-site scripting attacks. An attacker can exploit this issue by creating a malicious link that contains hostile HTML or script code to a site that is hosting the vulnerable software. If such a link is visited,...

PBLang 4.04.56 Bulletin Board System - IMG Tag HTML Injection

PBLang 4.04.56 Bulletin Board System - IMG Tag HTML Injection source: https://www.securityfocus.com/bid/8286/info PBLang is prone to an HTML injection vulnerability. An attacker may exploit this issue by including hostile HTML and script code encapsulated in PBLang tags, when posting to the...

Gallery 1.2/1.3.x - Search Engine Cross-Site Scripting

source: https://www.securityfocus.com/bid/8288/info Gallery is prone to a cross-site scripting vulnerability. This issue is present in the search engine facility provided by the software. An attacker could exploit this issue by constructing a malicious link to the search engine that contains...

Tripbit Secure Code Analizer 1.0 - 'fgets()' Local Buffer Overrun

// source: https://www.securityfocus.com/bid/8028/info A buffer overrun has been discovered in Tripbit Secure Code Analizer when reading data from source files. The problem occurs due to an insecure use of the fgets function. This vulnerability could be triggered by a malicious source file...

Abuse-SDL 0.7 - Command Line Argument Buffer Overflow

Abuse-SDL 0.7 - Command Line Argument Buffer Overflow // source: https://www.securityfocus.com/bid/7982/info A buffer overflow vulnerability has been reported for Abuse-SDL that may result in the execution of attacker-supplied code. The vulnerability exists due to insufficient bounds checking...