IBM Fixes Code Execution, Cookie-Stealing Vulnerabilities in Switches

IBM recently patched a handful of vulnerabilities in some of its KVM switches that, if exploited, could have given an attacker free reign over any system attached to it. The problem specifically affects builds of IBM’s Global Console Managers; keyboard, video and mouse KVM switches that let end...

PG MatchMaking search.php show Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/35808/info PG Matchmaking is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code in t...

NPDS 5.10 Multiple Input Validation Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/18383/info NPDS is prone to multiple input-validation issues, including information-disclosure and cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize...

XMB Forum 1.8/1.9 u2u.php username Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/16604/info XMB Forum is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues, because the application fails to properly sanitize user-supplied input. Successful...

Splatt Forum 3.0 Image Tag HTML Injection Vulneraility

No description provided by source. source: http://www.securityfocus.com/bid/4953/info Splatt Forum does not filter HTML from image tags. This may allow an attacker to inject arbitrary script code in forum messages. Injected script code will be executed in the browser of an arbitrary web user who...

Chipmunk Directory Index.PHP Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/18119/info Chipmunk Directory is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have...

Geeklog <= 1.6.0sr2 - Remote File Upload

No description provided by source. ============================================================================== Geeklog = v1.6.0sr2 - Remote File Upload Discovered: JaL0h Software Site: http://www.geeklog.net Dork: By Geeklog Created this page in +seconds +powered...

osCommerce 2.2 admin/tax_rates.php page Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/20343/info osCommerce is prone to multiple cross-site scripting vulnerabilities. An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the...

HiveMail 1.2.2/1.3 index.php $_SERVER['PHP_SELF'] XSS

No description provided by source. source: http://www.securityfocus.com/bid/16591/info HiveMail is prone to multiple vulnerabilities. These vulnerabilities may allow the execution of arbitrary PHP code, cross-site scripting attacks, and SQL injection. The PHP code-execution issues are the result ...

ReddAPI: Session Fixation Found

Hello reddapi, iam saikiran a security researecher found a bug in your website... Authot- Sai Kiran bug-session fixation Severity: Medium Summary: The application does not set a new Session ID in the cookie after what appears to be an authentication attempt by the user. If this was a successful...

SilverStripe CMS - Multiple HTML Injection Vulnerabilities

SilverStripe CMS - Multiple HTML Injection Vulnerabilities source: https://www.securityfocus.com/bid/62782/info SilverStripe is prone to multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input. Attacker-supplied HTML or JavaScript code could run in th...

Atlassian Confluence 5.3 Cross Site Scripting

Atlassian Confluence, the Enterprise Wiki Reflected XSS Details ============================================================================== Product: Atlassian Confluence 3.5.6 till 5.3latest version, the Enterprise Wiki Security-Risk: Critical Remote-Exploit: yes Vendor-URL:...

Jahia xCM - '/engines/manager.jsp?site' Cross-Site Scripting

source: https://www.securityfocus.com/bid/61571/info Jahia xCM is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data. An attacker could exploit these vulnerabilities to execute arbitrary script code in the context of th...

WordPress Theme flashnews - Multiple Input Validation Vulnerabilities

source: https://www.securityfocus.com/bid/57676/info The flashnews Theme for WordPress is prone to multiple input-validation vulnerabilities. An attacker may leverage these issues to cause denial-of-service conditions, disclose sensitive information, upload arbitrary files to the affected compute...

Microsoft Internet Explorer 89 - Steal Any Cookie

Microsoft Internet Explorer 89 - Steal Any Cookie Exploit Title: Internet Explorer 8 & Internet Explorer 9 steal any Cookie Date: 27.01.2013 Exploit Author: Christian Haider; Email: christian.haider.poc @ gmail dot com; linkedin: http://www.linkedin.com/in/chrishaider Category: remote Vendor...

WordPress ABC Test Plugin 0.1 Cross Site Script XSS

ABC Test lets to present quizzes with three options for each question. At the end of the quiz the user has a response based on the prevalence of answers A, B or C. 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1...

Zenphoto 1.4.3.2 Cross Site Scripting

------------------------- Affected products: ------------------------- Product : Zenphoto 1.4.3.2 and maybe older fixed in 1.4.3.3 Affected function: printPublishIconLink ---------- Details: ---------- The file admin-news-articles.php calls the function printPublishIconLink which generates HTML...

Google Chrome for Android - com.android.browser.application_id Intent Extra Data Cross-Site Scripting

source: https://www.securityfocus.com/bid/55523/info Google Chrome for Android is prone to multiple vulnerabilities. Attackers may exploit these issues to execute arbitrary code in the context of the browser, obtain potentially sensitive information, bypass the same-origin policy, and steal...

SiliSoftware PHPThumb() 1.7.11-201108081537 - demoPHPThumb.demo.showpic.php?title Cross-Site Scripting

SiliSoftware PHPThumb 1.7.11-201108081537 - demoPHPThumb.demo.showpic.php?title Cross-Site Scripting source: https://www.securityfocus.com/bid/53572/info phpThumb is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may...

Research: Botnets, the Most Prevalent Threat in the Enterprise

Botnets are the most significant source of malicious Web traffic for enterprises on the Internet, according to new research from ZScaler’s ThreatLabz. Over the past 30 days, botnets have accounted for nearly 80 percent of the security blocks within ZScaler’s network. In a distant second place amo...