SOL8508 - Cross-site scripting vulnerability in installControl.php3 page

A cross-site scripting XSS vulnerability exists in the FirePass installControl.php3 page, which is accessible prior to authentication. The installControl.php3 page fails to fully sanitize URL input before the web page content is sent to the browser. It is possible for an attacker to create web...

Untrusted applet and application XSLT processing privilege escalation

Unspecified vulnerability in Sun Java Runtime Environment JRE and JDK 6 Update 4 and earlier, 5.0 Update 14 and earlier, and SDK/JRE 1.4.216 and earlier allows remote attackers to cause a denial of service JRE crash and possibly execute arbitrary code via unknown vectors related to XSLT transform...

Untrusted applet and application privilege escalation (CVE-2008-1186)

Unspecified vulnerability in the Virtual Machine for Sun Java Runtime Environment JRE and JDK 6 Update 4 and earlier, 5.0 Update 14 and earlier, and SDK/JRE 1.4.216 and earlier allows remote attackers to gain privileges via an untrusted application or applet, a different issue than CVE-2008-1186,...

Android软件开发工具包BMP文件处理整数溢出漏洞

BUGTRAQ ID: 28006 CVECAN ID: CVE-2008-0986 Android是Google通过Open Handset Alliance发起的项目，用于为移动设备提供完整的软件集，包括操作系统、中间件等。 Android SDK的libsgl.so库中的BMP::readFromStreamStream , ImageDecoder::Mode方式在解析BMP图形文件头时存在整数溢出漏洞，远程攻击者可能利用此漏洞控制用户设备。 如果BMP文件头的offset字段值为负数且Bitmap Information部分（DIB头）指定了8...

Buffer overflow security vulnerabilities in Java Web Start (CVE-2008-1189, CVE-2008-1190)

Unspecified vulnerability in Java Web Start in Sun JDK and JRE 6 Update 4 and earlier, 5.0 Update 14 and earlier, and SDK/JRE 1.4.216 and earlier allows remote attackers to gain privileges via an untrusted application, a different issue than CVE-2008-1191, aka the "fourth" issue...

pds-sql.txt

Provided By Development Solutions SQL Injection Exploitpanel Real Estate SQL Injection Exploitpanel AUTHOR : S@BUN HOME : http://www.hackturkiye.com/ DorKs 1 : "Provided By Development Solutions" dork 2 : allinurl: "agentlist.asp?Letter" EXPLOIT : Username: anything' OR 'x'='x Password: anything'...

[SECURITY] Fedora 8 Update: tomcat5-5.5.26-1jpp.2.fc8

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participator...

Provided By Development Solutions SQL Injection Exploit(panel)

Provided By Development Solutions SQL Injection Exploitpanel Real Estate SQL Injection Exploitpanel AUTHOR : S@BUN HOME : http://www.hackturkiye.com/ DorKs 1 : "Provided By Development Solutions" dork 2 : allinurl: "agentlist.asp?Letter" EXPLOIT : Username: anything' OR 'x'='x Password: anything'...

Design/Logic Flaw

The Everything Development Engine in The Everything Development System Pre-1.0 and earlier stores passwords in cleartext in a database, which makes it easier for context-dependent attackers to obtain access to user accounts...

CVE-2008-0724

The Everything Development Engine in The Everything Development System Pre-1.0 and earlier stores passwords in cleartext in a database, which makes it easier for context-dependent attackers to obtain access to user accounts...

CVE-2008-0675

SQL injection vulnerability in cms/index.pl in The Everything Development Engine in The Everything Development System Pre-1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the nodeid parameter...

Sql injection

SQL injection vulnerability in cms/index.pl in The Everything Development Engine in The Everything Development System Pre-1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the nodeid parameter...

CVE-2008-0724

The Everything Development Engine in The Everything Development System Pre-1.0 and earlier stores passwords in cleartext in a database, which makes it easier for context-dependent attackers to obtain access to user accounts...

CVE-2008-0724

The Everything Development Engine in The Everything Development System Pre-1.0 and earlier stores passwords in cleartext in a database, which enables context-dependent attackers to obtain access to user accounts. Affected component: password storage in the engine; root cause: cleartext password s...

CVE-2008-0675

SQL injection vulnerability in cms/index.pl in The Everything Development Engine in The Everything Development System Pre-1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the nodeid parameter...

CVE-2008-0675

The CVE-2008-0675 entry describes an SQL injection in cms/index.pl of The Everything Development Engine within The Everything Development System (Pre-1.0 and earlier). The vulnerability allows remote attackers to manipulate the database via the node_id parameter. Impact details in the provided so...

CVE-2008-0675: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in cms/index.pl in The Everything Development Engine in The Everything Development System Pre-1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the nodeid parameter...

CVE-2008-0724: Undefined Security Weakness

The Everything Development Engine in The Everything Development System Pre-1.0 and earlier stores passwords in cleartext in a database, which makes it easier for context-dependent attackers to obtain access to user accounts...

ikiwiki -- javascript insertion via uris

The ikiwiki development team reports: The htmlscrubber did not block javascript in uris. This was fixed by adding a whitelist of valid uri types, which does not include javascript. Some urls specifyable by the meta plugin could also theoretically have been used to inject javascript; this was also...

The Everything Development System - SQL Injection

Application: The Everything Development System Versions: = Pre-1.0 current version at time of release Author: sub [email protected] Released: 2/1/2008 There exists a vulnerability in The Everything Development Engine that allows a user to inject their own SQL to modify a SELECT query, leading to...