Some more widgets: Facebook, Hockey, FlickrInterestingNess (Re: [MacOS X] Insecure eval() in Twitgit and Twitterlex dashboard widgets)

This is a follow-up to 0 and 1. Last night, I wrote: It would probably be an interesting exercise to go through some more dashboard widgets and grep for eval. I'd bet quite a bit that there's much more out there. - The top-50 facebook widget 2 uses the AllowFullAccess configuration option, which...

Recently updated links for users with personal spaces link to profile if personal space is not accessible

Users without the global access right for personal space can still see links to personal spaces in the "Recently updated" list on their dashboard. This is a serious security problem for extranets, when one wants to prevent non anonymous external users to see who's using the wiki. Note: this probl...

CVE-2007-4332

SQL injection vulnerability in article.php in Article Dashboard, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter in a print action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in signup.php in Article Dashboard allow remote attackers to inject arbitrary web script or HTML via the 1 femailaddress, 2 freemailaddress, and other unspecified parameters. NOTE: the provenance of this information is unknown; the details are...

CVE-2007-4333

Multiple cross-site scripting XSS vulnerabilities in signup.php in Article Dashboard allow remote attackers to inject arbitrary web script or HTML via the 1 femailaddress, 2 freemailaddress, and other unspecified parameters. NOTE: the provenance of this information is unknown; the details are...

Sql injection

SQL injection vulnerability in article.php in Article Dashboard, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter in a print action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2007-4332

CVE-2007-4332 is a SQL injection vulnerability in Article Dashboard’s article.php. When magic_quotes_gpc is disabled, remote attackers can inject arbitrary SQL commands through the id parameter during a print action. The vulnerability is described across multiple sources (NVD/NVDB-derived and thi...

CVE-2007-4333

CVE-2007-4333 describes multiple cross-site scripting (XSS) vulnerabilities in signup.php of Article Dashboard. The issue allows remote attackers to inject arbitrary web script or HTML via the parameters f_emailaddress, f_reemailaddress, and other unspecified fields. Connected sources corroborate...

CVE-2007-4333

Multiple cross-site scripting XSS vulnerabilities in signup.php in Article Dashboard allow remote attackers to inject arbitrary web script or HTML via the 1 femailaddress, 2 freemailaddress, and other unspecified parameters. NOTE: the provenance of this information is unknown; the details are...

CVE-2007-4332

SQL injection vulnerability in article.php in Article Dashboard, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter in a print action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

[security bulletin] HPSBMA02245 SSRT061260 rev.1 - HP OpenView Dashboard Running Shared Trace Service, Remote Arbitrary Code Execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c01114156 Version: 1 HPSBMA02245 SSRT061260 rev.1 - HP OpenView Dashboard Running Shared Trace Service, Remote Arbitrary Code Execution NOTICE: The information in this Security Bulletin should be...

XSS vulnerability: space name and key not validated nor escaped

Email sent from Igor: quote The problem: The input for space name and key is not being validated properly. I created a JIRA for lacking length validation CONF-8894 and later on I noticed that any characters in the input for space name are allowed. Combine that with another batch of bugs - space...

CVE-2007-3603

SQL injection vulnerability in the dashboard include/utils/SearchUtils.php in vtiger CRM before 5.0.3 allows remote authenticated users to execute arbitrary SQL commands via the assigneduserid parameter in a Potentials ListView action to index.php...

CVE-2007-3604

vtiger CRM before 5.0.3 allows remote authenticated users with access to the Analytics DashBoard menu to bypass data restrictions and read the pipeline of the entire organization, possibly involving modules/Potentials/Potentials.php...

Sql injection

SQL injection vulnerability in the dashboard include/utils/SearchUtils.php in vtiger CRM before 5.0.3 allows remote authenticated users to execute arbitrary SQL commands via the assigneduserid parameter in a Potentials ListView action to index.php...

CVE-2007-3603

CVE-2007-3603 affects vtiger CRM prior to 5.0.3. A SQL injection vulnerability exists in the dashboard (include/utils/SearchUtils.php) allowing remote authenticated users to execute arbitrary SQL via the assigned_user_id parameter in a Potentials ListView action to index.php. This is supported by...

CVE-2007-3603

SQL injection vulnerability in the dashboard include/utils/SearchUtils.php in vtiger CRM before 5.0.3 allows remote authenticated users to execute arbitrary SQL commands via the assigneduserid parameter in a Potentials ListView action to index.php...

CVE-2007-3604

vtiger CRM before 5.0.3 allows remote authenticated users with access to the Analytics DashBoard menu to bypass data restrictions and read the pipeline of the entire organization, possibly involving modules/Potentials/Potentials.php...

[SA16047] Apple Mac OS X Two Vulnerabilities

---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secuniavacancies/...

Mac OS X 10.4.x < 10.4.2 Multiple Vulnerabilities

The remote host is running a version of Mac OS X 10.4.x that is prior to 10.4.2. Mac OS X 10.4.2 contains several security fixes for : - TCP/IP - Dashboard - Bluetooth File and Object Exchange C Tenable Network Security, Inc. if ! definedfunc"bnrandom" exit0; include"compat.inc"; ifdescription...