CVE-2011-3391

CVE-2011-3391 affects IBM Rational Build Forge 7.1.2. The flaw arises from relying on client-side JavaScript to enforce the EditSecurity permission for the Export Key File function. This allows remote authenticated users to read a key file by removing the disabled attribute in the Security submen...

DSA-2260-1 rails - several

Bulletin has no description...

CVE-2011-1839

IBM Rational Build Forge 7.1.0 uses the HTTP GET method during redirection from the authentication servlet to a PHP script, which makes it easier for context-dependent attackers to discover session IDs by reading 1 web-server access logs, 2 web-server Referer logs, or 3 the browser history...

Design/Logic Flaw

IBM Rational Build Forge 7.1.0 uses the HTTP GET method during redirection from the authentication servlet to a PHP script, which makes it easier for context-dependent attackers to discover session IDs by reading 1 web-server access logs, 2 web-server Referer logs, or 3 the browser history...

CVE-2011-1839

IBM Rational Build Forge 7.1.0 is vulnerable because it uses HTTP GET during redirection from the authentication servlet to a PHP script, enabling context-dependent attackers to discover session IDs by reading web-server access logs, Referer logs, or browser history. Affected component: the authe...

CVE-2011-1839

IBM Rational Build Forge 7.1.0 uses the HTTP GET method during redirection from the authentication servlet to a PHP script, which makes it easier for context-dependent attackers to discover session IDs by reading 1 web-server access logs, 2 web-server Referer logs, or 3 the browser history...

CVE-2011-1034

Cross-site scripting XSS vulnerability in the UI in IBM Rational Build Forge 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the mod parameter to the fullcontrol program. NOTE: some of these details are obtained from third party information...

Cross site scripting

Cross-site scripting XSS vulnerability in the UI in IBM Rational Build Forge 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the mod parameter to the fullcontrol program. NOTE: some of these details are obtained from third party information...

CVE-2011-1034

The CVE-2011-1034 issue concerns IBM Rational Build Forge 7.0.2. The vulnerability is a Cross-site Scripting (XSS) in the UI, where an attacker can inject arbitrary script or HTML via the mod parameter to the fullcontrol program. The root cause is improper input handling in the UI component, enab...

CVE-2011-1034

Cross-site scripting XSS vulnerability in the UI in IBM Rational Build Forge 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the mod parameter to the fullcontrol program. NOTE: some of these details are obtained from third party information...

CVE-2010-1323

MIT Kerberos 5 aka krb5 1.3.x, 1.4.x, 1.5.x, 1.6.x, 1.7.x, and 1.8.x through 1.8.3 does not properly determine the acceptability of checksums, which might allow remote attackers to modify user-visible prompt text, modify a response to a Key Distribution Center KDC, or forge a KRB-SAFE message via...

CVE-2010-1323

MIT Kerberos 5 aka krb5 1.3.x, 1.4.x, 1.5.x, 1.6.x, 1.7.x, and 1.8.x through 1.8.3 does not properly determine the acceptability of checksums, which might allow remote attackers to modify user-visible prompt text, modify a response to a Key Distribution Center KDC, or forge a KRB-SAFE message via...

CVE-2010-4020

MIT Kerberos 5 aka krb5 1.8.x through 1.8.3 does not reject RC4 key-derivation checksums, which might allow remote authenticated users to forge a 1 AD-SIGNEDPATH or 2 AD-KDC-ISSUED signature, and possibly gain privileges, by leveraging the small key space that results from certain one-byte...

CVE-2010-4020

MIT Kerberos 5 aka krb5 1.8.x through 1.8.3 does not reject RC4 key-derivation checksums, which might allow remote authenticated users to forge a 1 AD-SIGNEDPATH or 2 AD-KDC-ISSUED signature, and possibly gain privileges, by leveraging the small key space that results from certain one-byte...

CVE-2010-1324

MIT Kerberos 5 aka krb5 1.7.x and 1.8.x through 1.8.3 does not properly determine the acceptability of checksums, which might allow remote attackers to forge GSS tokens, gain privileges, or have unspecified other impact via 1 an unkeyed checksum, 2 an unkeyed PAC checksum, or 3 a KrbFastArmoredRe...

Joomla Component com_ninjarsssyndicator SQL Injection Vulnerability

Exploit for php platform in category web applications =================================================================== Joomla Component comninjarsssyndicator SQL Injection Vulnerability =================================================================== Author : Expl0it Email & msn :...

OpenDocMan 1.2.5 - Cross-Site Scripting / SQL Injection

Security Advisory : Multiple vulnerabilities in OpenDocMan Discovered by == Amol Naik amolnaik4atgmail.com Overview -------------- OpenDocMan is a free document management system DMS designed to comply with ISO 17025 and OIE standard for document management. It features web based access, fine...

Mandrake Security Advisory MDVSA-2009:267 (xmlsec1)

The remote host is missing an update to xmlsec1 announced via advisory MDVSA-2009:267. OpenVAS Vulnerability Test $Id: mdksa2009267.nasl 6573 2017-07-06 13:10:50Z cfischer $ Description: Auto-generated from advisory MDVSA-2009:267 xmlsec1 Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft...

Joomla GroupJive 1.8 B4 Remote File Inclusion

No description provided by source. Joomla Component groupjive 1.8 B4 RFI Vulnerability Author : M3NW5 Homepage : http://www.indonesiancoder.com contach : [email protected] Location : INDONESIA Achievo 1.3.4 Information Vendor : http://www.groupjive.org/ Scripts :...

iodined 0.4.2-2 - forged DNS packet Denial of Service

!/usr/bin/perl iodined http://www.wekk.net 2009-04-26 This exploit shuts down the iodined daemon using a forged DNS packet. It works on the last debian stable version 0.4.2-2. It produces a segmentation fault on the daemon side. use IO::Socket; use strict; my $pktheader =...