MyBB 1.6.7之前版本多个安全漏洞

BUGTRAQ ID: 53417 MyBB是一款流行的Web论坛程序。 MyBB 1.6.7之前版本在实现上存在多个安全漏洞，成功利用后可允许攻击者执行任意脚本代码、窃取Cookie身份验证凭证、控制应用、访问或修改数据或利用底层数据库中的其他漏洞并访问敏感数据。 0 MyBB 1.6.x MyBB 1.4.x 厂商补丁： MyBB ---- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.mybboard.com/...

OrangeHRM 2.7 RC - index.php?URI Cross-Site Scripting

OrangeHRM 2.7 RC - index.php?URI Cross-Site Scripting source: https://www.securityfocus.com/bid/53433/info OrangeHRM is prone to an SQL-injection and multiple cross-site scripting vulnerabilities. Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication...

OrangeHRM 2.7 RC - '/plugins/ajaxCalls/haltResumeHsp.php?newHspStatus' Cross-Site Scripting

source: https://www.securityfocus.com/bid/53433/info OrangeHRM is prone to an SQL-injection and multiple cross-site scripting vulnerabilities. Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify...

Websense Triton - Multiple Vulnerabilities

Websense Triton - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/51086/info Websense Triton is prone to a remote command-execution vulnerability. An attacker can exploit this issue to execute arbitrary commands with SYSTEM-level privileges. Successfully exploiting this issue...

WordPress Zingiri Web Shop Plugin <= 2.4.2 - Persistent XSS

WordPress Zingiri Web Shop plugin is prone to persistent cross-site scripting vulnerabilities. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal...

MySQLDumper 1.24.4 - main.php Multiple Cross-Site Request Forgery Vulnerabilities

MySQLDumper 1.24.4 - main.php Multiple Cross-Site Request Forgery Vulnerabilities source: https://www.securityfocus.com/bid/53306/info MySQLDumper is prone to multiple security vulnerabilities, including: 1. Multiple cross-site scripting vulnerabilities. 2. A local file-include vulnerability. 3...

MySQLDumper 1.24.4 - 'install.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/53306/info MySQLDumper is prone to multiple security vulnerabilities, including: 1. Multiple cross-site scripting vulnerabilities. 2. A local file-include vulnerability. 3. Multiple cross-site request-forgery vulnerabilities. 4. Multiple...

MySQLDumper 1.24.4 - 'install.php?language' Traversal Arbitrary File Access

source: https://www.securityfocus.com/bid/53306/info MySQLDumper is prone to multiple security vulnerabilities, including: 1. Multiple cross-site scripting vulnerabilities. 2. A local file-include vulnerability. 3. Multiple cross-site request-forgery vulnerabilities. 4. Multiple...

MySQLDumper 1.24.4 - 'filemanagement.php?f' Traversal Arbitrary File Access

source: https://www.securityfocus.com/bid/53306/info MySQLDumper is prone to multiple security vulnerabilities, including: 1. Multiple cross-site scripting vulnerabilities. 2. A local file-include vulnerability. 3. Multiple cross-site request-forgery vulnerabilities. 4. Multiple...

gpEasy 2.3.3 - 'jsoncallback' Cross-Site Scripting

source: https://www.securityfocus.com/bid/53269/info gpEasy is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected...

ownCloud 3.0.0 - index.php?redirect_url Arbitrary Site Redirect

ownCloud 3.0.0 - index.php?redirecturl Arbitrary Site Redirect source: https://www.securityfocus.com/bid/53145/info ownCloud is prone to a URI open-redirection vulnerability, multiple cross-site scripting vulnerabilities and multiple HTML-injection vulnerabilities because it fails to properly...

XOOPS 2.5.4 - '/modules/pm/pmlite.php?to_userid' Cross-Site Scripting

source: https://www.securityfocus.com/bid/53143/info XOOPS is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the...

CVE-2012-0942

Buffer overflow in rn5auth.dll in RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x allows remote attackers to execute arbitrary code via crafted authentication credentials...

Buffer overflow

Buffer overflow in rn5auth.dll in RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x allows remote attackers to execute arbitrary code via crafted authentication credentials...

Acuity CMS 2.6.2 - Username Cross-Site Scripting

Acuity CMS 2.6.2 - Username Cross-Site Scripting source: https://www.securityfocus.com/bid/53048/info Acuity CMS is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser o...

TeamPass 2.1.5 - 'login' HTML Injection

source: https://www.securityfocus.com/bid/53038/info TeamPass is prone to an HTML-injection vulnerability because it fails to sanitize user-supplied input. Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal...

TeamPass 2.1.5 - login HTML Injection

TeamPass 2.1.5 - login HTML Injection source: https://www.securityfocus.com/bid/53038/info TeamPass is prone to an HTML-injection vulnerability because it fails to sanitize user-supplied input. Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially...

Joomla! Plugin Beatz 1.1 - Multiple Cross-Site Scripting Vulnerabilities

Joomla! Plugin Beatz 1.1 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/53030/info Joomla! Beatz Plugin is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker could leverage these...

WordPress All-in-One Event Calendar Plugin 1.4 - Multiple Parameter XSS

WordPress All-in-One Event Calendar plugin's /wp-content/plugins/all-in-one-event-calendar/app/view/agenda-widget.php multiple parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browse...

WordPress Plugin All-in-One Event Calendar 1.4 - agenda-widget-form.php?title Cross-Site Scripting

WordPress Plugin All-in-One Event Calendar 1.4 - agenda-widget-form.php?title Cross-Site Scripting source: https://www.securityfocus.com/bid/52986/info All-in-One Event Calendar plugin for WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize...