CVE-2012-1857

Cross-site scripting XSS vulnerability in the Enterprise Portal component in Microsoft Dynamics AX 2012 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Dynamics AX Enterprise Portal XSS Vulnerability."...

CVE-2012-1857

CVE-2012-1857 describes a cross-site scripting (XSS) vulnerability in the Enterprise Portal component of Microsoft Dynamics AX 2012. An attacker could craft a URL to cause arbitrary script/HTML execution in a victim’s browser. Affected product: Dynamics AX 2012 Enterprise Portal; vulnerability tr...

Microsoft Dynamic AX Enterprise Portal Cross Site Scripting Vulnerability

Description Microsoft Dynamic AX is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may...

MS12-040: Vulnerability in Dynamics AX Enterprise Portal could allow elevation of privilege: June 12, 2012

Resolves a vulnerability in the .NET Framework in Dynamics AX Enterprise Portal that could allow elevation of privilege.INTRODUCTIONMicrosoft has released security bulletin MS12-040 view the complete security bulletin, visit one of the following Microsoft websites: Home...

Microsoft Dynamic AX Enterprise Portal Cross-site Scripting (MS12-040; CVE-2012-1857)

A cross-site scripting vulnerability has been reported in Microsoft Dynamics AX Enterprise Portal...

Microsoft to Fix 28 Vulnerabilities in June Patch Tuesday

Microsoft has been busy of late, what with the scramble surrounding the Flame malware and the forged certificate that the attackers were able to use to spread the malware via a fake Windows Update service. Now, the company is planning to release seven bulletins next Tuesday covering 28...

Microsoft Releases June Security Bulletin

Microsoft has released updates to address vulnerabilities in Microsoft Windows, Internet Explorer, .NET Framework, Lync, and Dynamics AX as part of the Microsoft Security Bulletin Summary for June 2012. These vulnerabilities may allow an attacker to execute arbitrary code or operate with elevated...

RedHat Update for gnutls RHSA-2012:0428-01

Check for the Version of gnutls OpenVAS Vulnerability Test RedHat Update for gnutls RHSA-2012:0428-01 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the ter...

CentOS 6 : gnutls (CESA-2012:0429)

Updated gnutls packages that fix two security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

CentOS 6 : libtasn1 (CESA-2012:0427)

Updated libtasn1 packages that fix one security issue are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Important: Red Hat Security Advisory: gnutls security update

Updated gnutls packages that fix three security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

Important: Red Hat Security Advisory: libtasn1 security update

Updated libtasn1 packages that fix one security issue are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

libtasn1 -- ASN.1 length decoding vulnerability

Mu Dynamics, Inc. reports: Various functions using the ASN.1 length decoding logic in Libtasn1 were incorrectly assuming that the return value from asn1getlengthder is always less than the length of the enclosing ASN.1 structure, which is only true for valid structures and not for intentionally...

[pdf] PHP serialize, session and dynamics

Презентация с семинара ВМиК МГУ secsem.ru 2010 года. http://onsec.ru/php-unserialize.pdf Информация актуальная...

Data Dynamics ActiveBar ActiveX Controls Code Execution

One or more of the Data Dynamics ActiveBar ActiveX controls installed on the remote Windows host is affected by a code execution vulnerability due to unspecified issues in the 'Save', 'SaveLayoutChanges', 'SaveMenuUsageData', and 'SetLayoutData' methods. Note that Data Dynamics ActiveBar is bundl...

CVE-2011-1207

The ActiveBar1 ActiveX control in the Data Dynamics ActiveBar ActiveX controls, as distributed in ActBar.ocx 1.0.6.5 in IBM Rational System Architect 11.4.0.2, 11.4.0.1, and earlier, does not properly restrict the SetLayoutData method, which allows remote attackers to execute arbitrary code via a...

Information disclosure

The ActiveBar1 ActiveX control in the Data Dynamics ActiveBar ActiveX controls, as distributed in ActBar.ocx 1.0.6.5 in IBM Rational System Architect 11.4.0.2, 11.4.0.1, and earlier, does not properly restrict the SetLayoutData method, which allows remote attackers to execute arbitrary code via a...

CVE-2011-1207

The ActiveBar1 ActiveX control in the Data Dynamics ActiveBar ActiveX controls, as distributed in ActBar.ocx 1.0.6.5 in IBM Rational System Architect 11.4.0.2, 11.4.0.1, and earlier, does not properly restrict the SetLayoutData method, which allows remote attackers to execute arbitrary code via a...

CVE-2011-1660

Multiple cross-site scripting XSS vulnerabilities in the DataDynamics.Reports.Web class library in GrapeCity Data Dynamics Reports before 1.6.2084.14 allow remote attackers to inject arbitrary web script or HTML via 1 the reportName or 2 uniqueId parameter to CoreViewerInit.js, or the 3 uniqueId ...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the DataDynamics.Reports.Web class library in GrapeCity Data Dynamics Reports before 1.6.2084.14 allow remote attackers to inject arbitrary web script or HTML via 1 the reportName or 2 uniqueId parameter to CoreViewerInit.js, or the 3 uniqueId ...