SA-CONTRIB-2009-084 - LDAP Integration - Multiple Vulnerabilities

The LDAP Integration module enables users to authenticate against LDAP servers. The module does not properly implement confirmation pages for the LDAP server activation/deactivation which could lead to a Cross Site Request Forgery CSRF attack. The user defined server name is not properly escaped ...

HP LoadRunner XUpload ActiveX control MakeHttpRequest file download

Added: 10/21/2009 CVE: CVE-2009-3693 BID: 36550 Background HP LoadRunner is a software performance testing solution. HP LoadRunner includes the XUpload.ocx ActiveX control for performing file exchanges. Problem The MakeHttpRequest method in the XUpload.ocx ActiveX control can be used to download...

SuSE 10 Security Update : KDE PIM packages (ZYPP Patch Number 6160)

This updates of KMail does not executes links in mail without confirmation anymore. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid41531; scriptversion"1.10";...

CVE-2009-4626

creationtimestamp| type| source ---|---|--- 2009-09-09 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/9611...

openSUSE Security Update : kdepim3 (kdepim3-770)

This updates of KMail does not executes links in mail without confirmation anymore. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update kdepim3-770. The text description of this plugin is C SUSE...

openSUSE Security Update : kdepim3 (kdepim3-770)

This updates of KMail does not executes links in mail without confirmation anymore. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update kdepim3-770. The text description of this plugin is C SUSE...

CVE-2009-4876

creationtimestamp| type| source ---|---|--- 2009-07-20 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/9203...

CVE-2009-2080

creationtimestamp| type| source ---|---|--- 2009-06-09 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/8917...

openSUSE 10 Security Update : kdepim3 (kdepim3-6162)

This updates of KMail does not executes links in mail without confirmation anymore. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update kdepim3-6162. The text description of this plugin is C SUSE...

CVE-2009-1444

creationtimestamp| type| source ---|---|--- 2009-04-22 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/8516...

Mandriva Update for mdkonline MDVA-2008:163 (mdkonline)

Check for the Version of mdkonline OpenVAS Vulnerability Test Mandriva Update for mdkonline MDVA-2008:163 mdkonline Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

CVE-2009-0836

Foxit Reader 2.3 before Build 3902 and 3.0 before Build 1506, including 1120 and 1301, does not require user confirmation before performing dangerous actions defined in a PDF file, which allows remote attackers to execute arbitrary programs and have unspecified other impact via a crafted file, as...

CVE-2009-0654

CVE-2009-0654 affects Tor 0.2.0.28 and likely earlier 0.2.0.34, where remote attackers who control both an entry and exit router can verify that a sender and receiver are communicating by replaying, modifying, inserting, or deleting a single cell and observing cell recognition errors at the exit....

CVE-2009-0654

Tor 0.2.0.28, and probably 0.2.0.34 and earlier, allows remote attackers, with control of an entry router and an exit router, to confirm that a sender and receiver are communicating via vectors involving 1 replaying, 2 modifying, 3 inserting, or 4 deleting a single cell, and then observing cell...

CVE-2009-0104

creationtimestamp| type| source ---|---|--- 2009-01-06 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/7680...

CVE-2008-5972

creationtimestamp| type| source ---|---|--- 2008-11-30 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/7302...

CVE-2008-5938

creationtimestamp| type| source ---|---|--- 2008-11-23 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/7204...

Opera 9.52 - Window Object Suppressing Remote Denial of Service

Opera Window Object Suppressing Remote Denial of Service. Version Affected: Opera 9.52 Severity: High Description: The opera browser is vulnerable to window object based denial of service attack. The opera fails to sanitize a check when window.close function is called in number of dynamically...

CVE-2008-4708

creationtimestamp| type| source ---|---|--- 2008-09-28 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/6621...

Parallels Plesk Shortnames功能邮件中继漏洞

BUGTRAQ ID: 30956 Plesk是用于管理站点的综合控制面板解决方案。 在Plesk中如果为邮件登录启用了SHORTNAMES=1功能的话，QMAIL就会在AUTH LOGIN认证期间接受任何以有效shortname开始的base64编码用户名。这允许攻击者登录到plesk认证模块所保护的邮件或其他服务，通过获得的smtp认证权限中继垃圾邮件。 必须要从smtpspsa删除SHORTNAMES=1才可以修复这个问题，仅仅将其设置为0无法解决。 Parallels Plesk 8.6 Parallels ---------...