Nagios XI Alert Cloud Cross-Site Scripting

A reflected cross-site scripting vulnerability has been reported in Nagios XI. The vulnerability is due to insufficient sanitization of HTTP GET requests sent to index.php. An attacker entices a user to click on a URL containing malicious script code in the parameters. The vulnerability is...

Fedora 18 : roundcubemail-0.8.5-1.fc18 (2013-2195)

A cross-site scripting XSS flaws were round in the way Round Cube Webmail, a browser-based multilingual IMAP client, performed sanitization of 'data' and 'vbscript' URLs. A remote attacker could provide a specially crafted URL that, when opened would lead to arbitrary JavaScript, VisualBasic scri...

Directory traversal

Directory traversal vulnerability in the GREE application before 1.3.3 for Android allows remote attackers to obtain sensitive information via a crafted URL, which is not properly handled during interaction with other applications...

CVE-2013-0256

darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting XSS attacks via a crafted URL...

CVE-2013-0256 rubygem-rdoc: Cross-site scripting in the documentation created by Darkfish Rdoc HTML generator / template

darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting XSS attacks via a crafted URL...

VMware View Multiple Vulnerabilities (VMSA-2012-0004)

The VMware View, formerly VMware Virtual Desktop Infrastructure components Agent or Server, on the remote host is 4.x prior to 4.6.1. It is, therefore, potentially affected by the following vulnerabilities : - A buffer overflow vulnerability exists in the XPDM and WDDM display drivers and a NULL...

CVE-2013-1108

Cisco WebEx Training Center allows remote authenticated users to remove hands-on lab-session reservations via a crafted URL, aka Bug ID CSCzu81064...

Design/Logic Flaw

Cisco WebEx Training Center allow remote authenticated users to bypass intended privilege restrictions and 1 enable or 2 disable training-center recordings via a crafted URL, aka Bug ID CSCzu81065...

CVE-2013-1110

Cisco WebEx Training Center allow remote authenticated users to bypass intended privilege restrictions and 1 enable or 2 disable training-center recordings via a crafted URL, aka Bug ID CSCzu81065...

CubeCart 3.0.20 Multiple Vulnerabilities

CubeCart versions 3.0.20 and below suffer from a remote shell upload, cross site scripting and remote SQL injection vulnerabilities. 1. OVERVIEW CubeCart 3.0.20 and lower versions are vulnerable to Arbitrary File Upload. 2. BACKGROUND CubeCart is an "out of the box" ecommerce shopping cart softwa...

Symantec Messaging Gateway 9.5.3-3 Arbitrary File Download

Symantec Messaging Gateway version 9.5.3-3 suffers from an authenticated arbitrary file download vulnerability. ======= Summary ======= Name: Symantec Messaging Gateway - Arbitrary file download is possible with a crafted URL authenticated Release Date: 30 November 2012 Reference: NGS00266...

Symantec Messaging Gateway 9.5.3-3 - Arbitrary File Download

Symantec Messaging Gateway 9.5.3-3 - Arbitrary File Download ======= Summary ======= Name: Symantec Messaging Gateway - Arbitrary file download is possible with a crafted URL authenticated Release Date: 30 November 2012 Reference: NGS00266 Discoverer: Ben Williams Vendor: Symantec Vendor Referenc...

NGS000266 Technical Advisory: Symantec Messaging Gateway Arbitrary file download is possible with a crafted URL

======= Summary ======= Name: Symantec Messaging Gateway - Arbitrary file download is possible with a crafted URL authenticated Release Date: 30 November 2012 Reference: NGS00266 Discoverer: Ben Williams [email protected] Vendor: Symantec Vendor Reference: Systems Affected: Symantec...

Symantec Messaging Gateway 9.5.3-3 Arbitrary File Download

======= Summary ======= Name: Symantec Messaging Gateway - Arbitrary file download is possible with a crafted URL authenticated Release Date: 30 November 2012 Reference: NGS00266 Discoverer: Ben Williams Vendor: Symantec Vendor Reference: Systems Affected: Symantec Messaging Gateway 9.5.3-3 Risk:...

CVE-2011-4612

icecast before 2.3.3 allows remote attackers to inject control characters such as newlines into the error loc error.log via a crafted URL...

AVerCaster Pro RS3400 Web Server Directory Traversal Vulnerability

Exploit for hardware platform in category web applications Exploit Title: AVerCaster Pro RS3400 web server directory traversal Date: 2012-10-06 Exploit Author: Patrick Saladino Vendor Homepage: http://www.avermedia.com/product/ProductDetail.aspx?Id=560 Version: v.3.1.20 Tested on: Not relevant CV...

AVerCaster Pro RS3400 Web Server - Directory Traversal

AVerCaster Pro RS3400 Web Server - Directory Traversal Exploit Title: AVerCaster Pro RS3400 web server directory traversal Date: 2012-10-06 Exploit Author: Patrick Saladino Vendor Homepage: http://www.avermedia.com/product/ProductDetail.aspx?Id=560 Version: v.3.1.20 Tested on: Not relevant CVE :...

AVerCaster Pro RS3400 Web Server - Directory Traversal

Exploit Title: AVerCaster Pro RS3400 web server directory traversal Date: 2012-10-06 Exploit Author: Patrick Saladino Vendor Homepage: http://www.avermedia.com/product/ProductDetail.aspx?Id=560 Version: v.3.1.20 Tested on: Not relevant CVE : none yet Hello, I just wanted to let you know that the...

Design/Logic Flaw

The sapiheaderop function in main/SAPI.c in PHP 5.4.0RC2 through 5.4.0 does not properly determine a pointer during checks for %0D sequences aka carriage return characters, which allows remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted URL, related to improp...

CVE-2012-4388

The sapiheaderop function in main/SAPI.c in PHP 5.4.0RC2 through 5.4.0 does not properly determine a pointer during checks for %0D sequences aka carriage return characters, which allows remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted URL, related to improp...