Apache Struts2 <= 2.3.1 Multiple Vulnerabilities

Exploit for multiple platform in category web applications SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple critical vulnerabilities in Apache Struts2 product: Apache Struts2 OpenSymphony XWork OpenSymphony OGN...

DSA-2380-1 foomatic-filters - shell command injection

Bulletin has no description...

Movable Type Plugin MailForm vulnerable to cross-site scripting

Overview MailForm contains a cross-site scripting vulnerability. MailForm is a plugin for Movable Type. MailForm contains a cross-site scripting vulnerability. Daiki Fukumori of Cyber Defense Institute, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

JVN#60887968: Movable Type Plugin MailForm vulnerable to cross-site scripting

MailForm is a plugin for Movable Type. MailForm contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update to the fixed version according to the information provided by the developer. Products Affected...

Google Chrome Mozilla Network Security Services Privilege Escalation Vulnerability - Mac OS X

Google Chrome is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Google Chrome < 14.0.835.163 - '.pdf' File Handling Memory Corruption

----------------Security Adisory---------------- Title: Google Chrome = 14.0.835.163 Discovered by: Mario Gomes ----------------Summary---------------- Google Chrome is a web browser developed by Google that uses the WebKit layout engine. It was first released as a beta version for Microsoft...

DSA-2292-1 isc-dhcp - denial of service

Bulletin has no description...

Debian Security Advisory DSA 2235-1 (icedove)

The remote host is missing an update to icedove announced via advisory DSA 2235-1. OpenVAS Vulnerability Test $Id: deb22351.nasl 6613 2017-07-07 12:08:40Z cfischer $ Description: Auto-generated from advisory DSA 2235-1 icedove Authors: Thomas Reinke Copyright: Copyright c 2011 E-Soft Inc...

SWAT Samba Web Administration Tool Cross-Site Request Forgery PoC

No description provided by source. !-- Secur-I Research Group - Proof-of-Concept ========================================================================== Title: Cross-Site Request Forgery in SWAT Samba Web Administration Tool Vulnerable versions: Samba 3.0.x - 3.5.9 inclusive Fixed version: Sam...

Debian DSA-2286-1 : phpmyadmin - several vulnerabilities

Several vulnerabilities were discovered in phpMyAdmin, a tool to administrate MySQL over the web. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2011-2505 Possible session manipulation in Swekey authentication. - CVE-2011-2506 Possible code injection in...

SWAT Samba Web Administration Tool Cross-Site Request Forgery PoC

Exploit for cgi platform in category web applications Thanks & Regards, Narendra. Confidentiality: This e-mail and any attachments may be confidential and may also be privileged. If you are not an intended named recipient, please notify the sender immediately and do not disclose the contents to...

SWAT Samba Web Administration Tool - Cross-Site Request Forgery

SWAT Samba Web Administration Tool - Cross-Site Request Forgery Thanks & Regards, Narendra. Confidentiality: This e-mail and any attachments may be confidential and may also be privileged. If you are not an intended named recipient, please notify the sender immediately and do not disclose the...

Debian DSA-2275-1 : openoffice.org - stack-based buffer overflow

Will Dormann and Jared Allar discovered that the Lotus Word Pro import filter of OpenOffice.org, a full-featured office productivity suite that provides a near drop-in replacement for Microsoft Office, is not properly handling object ids in the '.lwp' file format. An attacker can exploit this wit...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation. The processchpwrequest function in schpw.c in the password-changing functionality in kadmind in MIT Kerberos 5 aka krb5 1.7 through 1.9 frees an invalid pointer, which allows remote attackers to execute...

Libmodplug ReadS3M - Stack Overflow

Source: https://www.sec-consult.com/files/20110407-0libmodplugstackoverflow.txt SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Libmodplug ReadS3M Stack Overflow product: Libmodplug library vulnerable version: 0.8.8.1...

DSA-2194-1 libvirt - privilege escalation

Bulletin has no description...

PT-2011-2039 · Microsoft · Windows Media Player +2

Name of the Vulnerable Software and Affected Versions: Windows Media Player and Windows Media Center versions prior to the fixed version Description: A remote code execution issue exists in the way Windows Media Player and Windows Media Center handle Digital Video Recording .dvr-ms files. This...

Debian Security Advisory DSA 2137-1 (libxml2)

The remote host is missing an update to libxml2 announced via advisory DSA 2137-1. OpenVAS Vulnerability Test $Id: deb21371.nasl 6613 2017-07-07 12:08:40Z cfischer $ Description: Auto-generated from advisory DSA 2137-1 libxml2 Authors: Thomas Reinke Copyright: Copyright c 2011 E-Soft Inc...

Access Restriction Bypass

Overview Affected versions of this package are vulnerable to Access Restriction Bypass. The safe-level feature in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, and 1.8.8dev allows context-dependent attackers to modify strings via the Exceptiontos method, as demonstrated by changing an...

BlogEngine.NET Unauthorized Access / Directory Traversal

Product: BlogEngine.NET Vendor informed: 24 Sep 2010 Fixed Version Released: 01 Jan 2011 Affected Versions: 1.6.x and prior versions Severtiy: Critical Impact: Information Discloure and System Compromise Description: BlogEngine.NET is an open source .NET blogging project that was born out of desi...