SysAid Helpdesk 8.5 Pro SQL Injection Vulnerability

SysAid Helpdesk version 8.5 Pro suffers from multiple remote blind SQL injection vulnerabilities. ======= Summary ======= Name: SysAid Helpdesk Pro - Blind SQL Injection Release Date: 30 November 2012 Reference: NGS00241 Discoverer: Daniel Compton Vendor: SysAid Vendor Reference: Systems Affected...

php -- potential overflow in _php_stream_scandir

The PHP Development Team reports: The release of PHP 5.4.15 and 5.4.5 fix a potential overflow in phpstreamscandir...

Zend Framework XXE Injection

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Local file disclosure via XXE injection product: Zend Framework vulnerable version: 1.11.11 1.12.0 RC1 2.0.0 beta4 and earlier versions / branches fixed version: 1.11.12...

ManageEngine Support Center Plus 7903 XSS / SQL Injection

| |.--.--.| || | .-----.| | |. | || || | ||. | | | || | |. | ||.| \ ||. | |||||||| |: 1 | |: 1 ||: 1 | |::.. . | |::.. . ||::.. . | -------' -------'-------' +--------------------------------------------------------------------------------------------------------------------------------+ | Exploi...

PyPAM Python bindings for PAM - Double-Free Corruption

PyPAM Python bindings for PAM - Double-Free Corruption === LSE Leading Security Experts - Security Advisory 2012-03-01 === PyPAM -- Python bindings for PAM - Double Free Corruption --------------------------------------------------------- Affected Versions ================= PyPAM = 0.4.2 Red Hat...

Debian: Security Advisory (DSA-2386-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-2326-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Apache Struts2 <= 2.3.1 Multiple Vulnerabilities

Exploit for multiple platform in category web applications SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple critical vulnerabilities in Apache Struts2 product: Apache Struts2 OpenSymphony XWork OpenSymphony OGN...

DSA-2380-1 foomatic-filters - shell command injection

Bulletin has no description...

Movable Type Plugin MailForm vulnerable to cross-site scripting

Overview MailForm contains a cross-site scripting vulnerability. MailForm is a plugin for Movable Type. MailForm contains a cross-site scripting vulnerability. Daiki Fukumori of Cyber Defense Institute, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

JVN#60887968: Movable Type Plugin MailForm vulnerable to cross-site scripting

MailForm is a plugin for Movable Type. MailForm contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update to the fixed version according to the information provided by the developer. Products Affected...

Google Chrome Mozilla Network Security Services Privilege Escalation Vulnerability - Mac OS X

Google Chrome is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Google Chrome < 14.0.835.163 - '.pdf' File Handling Memory Corruption

----------------Security Adisory---------------- Title: Google Chrome = 14.0.835.163 Discovered by: Mario Gomes ----------------Summary---------------- Google Chrome is a web browser developed by Google that uses the WebKit layout engine. It was first released as a beta version for Microsoft...

DSA-2292-1 isc-dhcp - denial of service

Bulletin has no description...

Debian Security Advisory DSA 2235-1 (icedove)

The remote host is missing an update to icedove announced via advisory DSA 2235-1. OpenVAS Vulnerability Test $Id: deb22351.nasl 6613 2017-07-07 12:08:40Z cfischer $ Description: Auto-generated from advisory DSA 2235-1 icedove Authors: Thomas Reinke Copyright: Copyright c 2011 E-Soft Inc...

SWAT Samba Web Administration Tool Cross-Site Request Forgery PoC

No description provided by source. !-- Secur-I Research Group - Proof-of-Concept ========================================================================== Title: Cross-Site Request Forgery in SWAT Samba Web Administration Tool Vulnerable versions: Samba 3.0.x - 3.5.9 inclusive Fixed version: Sam...

Debian DSA-2286-1 : phpmyadmin - several vulnerabilities

Several vulnerabilities were discovered in phpMyAdmin, a tool to administrate MySQL over the web. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2011-2505 Possible session manipulation in Swekey authentication. - CVE-2011-2506 Possible code injection in...

SWAT Samba Web Administration Tool Cross-Site Request Forgery PoC

Exploit for cgi platform in category web applications Thanks & Regards, Narendra. Confidentiality: This e-mail and any attachments may be confidential and may also be privileged. If you are not an intended named recipient, please notify the sender immediately and do not disclose the contents to...

SWAT Samba Web Administration Tool - Cross-Site Request Forgery

SWAT Samba Web Administration Tool - Cross-Site Request Forgery Thanks & Regards, Narendra. Confidentiality: This e-mail and any attachments may be confidential and may also be privileged. If you are not an intended named recipient, please notify the sender immediately and do not disclose the...

Debian DSA-2275-1 : openoffice.org - stack-based buffer overflow

Will Dormann and Jared Allar discovered that the Lotus Word Pro import filter of OpenOffice.org, a full-featured office productivity suite that provides a near drop-in replacement for Microsoft Office, is not properly handling object ids in the '.lwp' file format. An attacker can exploit this wit...