7779 matches found
ModSecurity < 2.7.0 Multipart Request Parsing Filter Bypass
According to its banner, the version of ModSecurity installed on the remote host is earlier than 2.7.0. It is, therefore, potentially affected by a security bypass vulnerability. An error exists related to HTTP POST requests and 'Content-Disposition' headers containing extra lines that could allo...
Vulnerability in Microsoft Security Essentials <v4.2
Hi @ll, versions of Microsoft Security Essentials before the current v4.2 see https://support.microsoft.com/kb/2805304 have a vulnerability that could lead to execution of arbitrary code in the security context of the LocalSystem account almost like https://support.microsoft.com/kb/2781197 alias...
Microsoft Security Essentials Code Execution
Hi @ll, versions of Microsoft Security Essentials before the current v4.2 see have a vulnerability that could lead to execution of arbitrary code in the security context of the LocalSystem account almost like alias . The "UninstallString" written to...
DSA-2652-1 libxml2 - external entity expansion
Bulletin has no description...
PT-2013-2058 · Microsoft · Xml Core Services +2
Name of the Vulnerable Software and Affected Versions: Microsoft XML Core Services versions 4.0 through 6.0 Description: A remote code execution issue exists due to improper parsing of XML content, allowing attackers to execute arbitrary code via a crafted web page. This may corrupt memory,...
PT-2012-5585 · Microsoft · Windows
Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions prior to the fixed version Description: A remote code execution issue exists due to the way Microsoft Windows parses filenames, potentially allowing attackers to execute arbitrary code in the context of the current...
SysAid Helpdesk 8.5 Pro SQL Injection Vulnerability
SysAid Helpdesk version 8.5 Pro suffers from multiple remote blind SQL injection vulnerabilities. ======= Summary ======= Name: SysAid Helpdesk Pro - Blind SQL Injection Release Date: 30 November 2012 Reference: NGS00241 Discoverer: Daniel Compton Vendor: SysAid Vendor Reference: Systems Affected...
php -- potential overflow in _php_stream_scandir
The PHP Development Team reports: The release of PHP 5.4.15 and 5.4.5 fix a potential overflow in phpstreamscandir...
Zend Framework XXE Injection
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Local file disclosure via XXE injection product: Zend Framework vulnerable version: 1.11.11 1.12.0 RC1 2.0.0 beta4 and earlier versions / branches fixed version: 1.11.12...
ManageEngine Support Center Plus 7903 XSS / SQL Injection
| |.--.--.| || | .-----.| | |. | || || | ||. | | | || | |. | ||.| \ ||. | |||||||| |: 1 | |: 1 ||: 1 | |::.. . | |::.. . ||::.. . | -------' -------'-------' +--------------------------------------------------------------------------------------------------------------------------------+ | Exploi...
PyPAM Python bindings for PAM - Double-Free Corruption
PyPAM Python bindings for PAM - Double-Free Corruption === LSE Leading Security Experts - Security Advisory 2012-03-01 === PyPAM -- Python bindings for PAM - Double Free Corruption --------------------------------------------------------- Affected Versions ================= PyPAM = 0.4.2 Red Hat...
Debian: Security Advisory (DSA-2386-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Debian: Security Advisory (DSA-2326-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Apache Struts2 <= 2.3.1 Multiple Vulnerabilities
Exploit for multiple platform in category web applications SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple critical vulnerabilities in Apache Struts2 product: Apache Struts2 OpenSymphony XWork OpenSymphony OGN...
DSA-2380-1 foomatic-filters - shell command injection
Bulletin has no description...
Movable Type Plugin MailForm vulnerable to cross-site scripting
Overview MailForm contains a cross-site scripting vulnerability. MailForm is a plugin for Movable Type. MailForm contains a cross-site scripting vulnerability. Daiki Fukumori of Cyber Defense Institute, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...
JVN#60887968: Movable Type Plugin MailForm vulnerable to cross-site scripting
MailForm is a plugin for Movable Type. MailForm contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update to the fixed version according to the information provided by the developer. Products Affected...
Google Chrome Mozilla Network Security Services Privilege Escalation Vulnerability - Mac OS X
Google Chrome is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Google Chrome < 14.0.835.163 - '.pdf' File Handling Memory Corruption
----------------Security Adisory---------------- Title: Google Chrome = 14.0.835.163 Discovered by: Mario Gomes ----------------Summary---------------- Google Chrome is a web browser developed by Google that uses the WebKit layout engine. It was first released as a beta version for Microsoft...