Multiple XSS in Sun Communications Express

Advisory ID Internal CORE-2009-0109 1. Advisory Information Title: Multiple XSS in Sun Communications Express Advisory ID: CORE-2009-0109 Advisory URL:https://www.coresecurity.com/core-labs/advisories/sun-communications-express Date published: 2009-05-20 Date of last update: 2009-05-20 Vendors...

Sun Java System Communications Express 6.3 - search.xml Cross-Site Scripting

Sun Java System Communications Express 6.3 - search.xml Cross-Site Scripting source: https://www.securityfocus.com/bid/34154/info Sun Java System Communications Express is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may...

Sun Java System Communications Express 6.3 - UWCMain Cross-Site Scripting

Sun Java System Communications Express 6.3 - UWCMain Cross-Site Scripting source: https://www.securityfocus.com/bid/34155/info Sun Java System Communications Express is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. This issue is tracke...

Sun Java System Communications Express 6.3 - 'search.xml' Cross-Site Scripting

source: https://www.securityfocus.com/bid/34154/info Sun Java System Communications Express is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an...

Sun Java System Communications Express 6.3 - 'UWCMain' Cross-Site Scripting

source: https://www.securityfocus.com/bid/34155/info Sun Java System Communications Express is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. This issue is tracked by Sun Alert ID 258068. An attacker may leverage this issue to execute...

HP Data Protector Express Crafted Traffic Remote Memory Disclosure

HP Data Protector Express is installed on the remote host. The installed version of the software is affected by an unspecified local privilege escalation vulnerability. A local attacker could exploit this vulnerability to trigger a denial of service condition or execute arbitrary code with system...

CVE-2009-0714

HP Data Protector Express and HP Data Protector Express SSE (3.x and SSE 4.x) are affected by CVE-2009-0714 through the dpwinsup.dll module in the dpwingad process. The vulnerability allows remote attackers to cause a memory read or memory leak and can crash the dpwingad.exe process by sending cr...

CVE-2009-0714: Undefined Security Weakness

Unspecified vulnerability in the dpwinsup module dpwinsup.dll for dpwingad dpwingad.exe in HP Data Protector Express and Express SSE 3.x before build 47065, and Express and Express SSE 4.x before build 46537, allows remote attackers to cause a denial of service application crash or read portions ...

IBM DB2 Information Disclosure Vulnerability (Windows)

This host is installed with IBM DB2 and is prone to Information Disclosure Vulnerability. OpenVAS Vulnerability Test $Id: gbibmdb2infodiscvulnwin.nasl 4869 2016-12-29 11:01:45Z teissa $ IBM DB2 Information Disclosure Vulnerability Windows Authors: Sujit Ghosal Copyright: Copyright c 2009 Greenbon...

IBM DB2 Information Disclosure Vulnerability (Linux)

This host is installed with IBM DB2 and is prone to Information Disclosure Vulnerability. OpenVAS Vulnerability Test $Id: gbibmdb2infodiscvulnlin.nasl 4869 2016-12-29 11:01:45Z teissa $ IBM DB2 Information Disclosure Vulnerability Linux Authors: Sujit Ghosal Copyright: Copyright c 2009 Greenbone...

CVE-2009-1521: Undefined Security Weakness

Unspecified vulnerability in the Java GUI in the IBM Tivoli Storage Manager TSM client 5.2.0.0 through 5.2.5.3, 5.3.0.0 through 5.3.6.5, 5.4.0.0 through 5.4.2.6, and 5.5.0.0 through 5.5.1.17, and the TSM Express client 5.3.3.0 through 5.3.6.5, allows attackers to read or modify arbitrary files vi...

Oracle存在多个安全漏洞

CNCAN ID：CNCAN-2009041604 多个Oracle产品存在漏洞，可导致SQL注入，泄漏敏感信息或使攻击者破坏系统： -Oracle Process Manager和Notification opmn守护程序存在格式串错误，提交特殊构建的POST请求给port 6000/TCP可导致任意代码执行。 -传递给"DBMSAQIN"的输入在使用前缺少过滤，可导致注入任意SQL代码。 -Oracle数据库包含的Application Express组件存在错误，非特权用户可以获得"LOWS030000.WWVFLOWUSER"中的APEX密码HASH。 目前还存在多个未知漏洞。...

Design/Logic Flaw

Unspecified vulnerability in the Application Express component in Oracle Database 11.1.0.7 allows remote authenticated users to affect confidentiality, related to APEX. NOTE: the previous information was obtained from the April 2009 CPU. Oracle has not commented on reliable researcher claims that...

CVE-2009-0981: Undefined Security Weakness

Unspecified vulnerability in the Application Express component in Oracle Database 11.1.0.7 allows remote authenticated users to affect confidentiality, related to APEX. NOTE: the previous information was obtained from the April 2009 CPU. Oracle has not commented on reliable researcher claims that...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Sun Calendar Express Web Server in Sun ONE Calendar Server 6.0 and Sun Java System Calendar Server 6 2004Q2 through 6.3-7.01 allow remote attackers to inject arbitrary web script or HTML via 1 the fmt-out parameter to login.wcap or 2 the date...

Default credentials

Sun Calendar Express Web Server in Sun ONE Calendar Server 6.0 and Sun Java System Calendar Server 6 2004Q2 through 6.3-7.01 allows remote attackers to cause a denial of service daemon crash via multiple requests to the default URI with alphabetic characters in the tzid parameter...

CVE-2009-1218

Multiple cross-site scripting XSS vulnerabilities in Sun Calendar Express Web Server in Sun ONE Calendar Server 6.0 and Sun Java System Calendar Server 6 2004Q2 through 6.3-7.01 allow remote attackers to inject arbitrary web script or HTML via 1 the fmt-out parameter to login.wcap or 2 the date...

CVE-2009-1219

Sun Calendar Express Web Server in Sun ONE Calendar Server 6.0 and Sun Java System Calendar Server 6 2004Q2 through 6.3-7.01 allows remote attackers to cause a denial of service daemon crash via multiple requests to the default URI with alphabetic characters in the tzid parameter...

CVE-2009-1218

CVE-2009-1218 describes multiple XSS vulnerabilities in Sun Calendar Server components (login.wcap fmt-out and command.shtml date) affecting Sun Calendar Express Web Server, Sun ONE Calendar Server 6.0 and Sun Java System Calendar Server 6.0–6.3-7.01. The issue arises from improper input sanitiza...

CVE-2009-1219

Summary (CVE-2009-1219) Sun Calendar Express Web Server (Sun ONE Calendar Server 6.0 and Sun Java System Calendar Server 6, 2004Q2–6.3-7.01) is affected. A remote attacker can cause a denial of service (daemon crash) by sending two consecutive crafted HTTP requests with alphabetic characters in t...