Remote Code Execution

There's a Remote Code Execution vulnerability in the highlight function of Pygmentize...

Phabricator: HTML in Diffusion not escaped in certain circumstances

HTML in Diffusion source code listing is not escaped Steps to reproduce: have the syntax hilight turned on the file is bigger than 256kB, thus syntax hilight is claimed in header to be turned off automatically, however, plaintext file doesn't display like with regular manual syntax highlight off,...

MediaWiki SyntaxHighlight_GeSHi and MediaWiki GeSHi Denial of Service Vulnerabilities

MediaWiki is the United States Wikimedia Wikimedia Foundation and MediaWiki volunteers to develop and maintain a set of free and free Web-based Wiki engine , it can be used to deploy internal knowledge management and content management system . SyntaxHighlightGeSHi is one of the extensions to...

Asterisk Password Spy v3.1 - Windows Asterisk Password Recovery Tool

Asterisk Password Spy is the FREE tool to instantly reveal the hidden password behind asterisks . It's user friendly interface can help you to easily find the passwords from any Windows based application.You can simply drag the 'search icon' to any password box to find the real password hidden by...

Wordpress Highlight Premium Theme - CSRF File Upload Vulnerability

No description provided by source. Title : Wordpress Highlight Premium Themes CSRF File Upload Vulnerability Author : DevilScreaM Date : 11/10/2013 - 10 November 2013 Category : Web Applications Type : PHP Vendor : http://themeforest.net Download :...

phpBB viewtopic.php URL Decoding Code Execution - ver 2 (CVE-2004-1315)

A code injection and execution vulnerability has been reported in phpBB. The vulnerability is due to lack of input validation on the highlight parameter supplied to viewtopic.php. A remote attacker can exploit this issue by injecting malicious SQL code to the target server. Successful exploitatio...

WordPress Theme Highlight Premium - Cross-Site Request Forgery Arbitrary File Upload

WordPress Theme Highlight Premium - Cross-Site Request Forgery Arbitrary File Upload Title : Wordpress Highlight Premium Themes CSRF File Upload Vulnerability Author : DevilScreaM Date : 11/10/2013 - 10 November 2013 Category : Web Applications Type : PHP Vendor : http://themeforest.net Download ...

WordPress Highlight Premium Theme CSRF / Shell Upload

Title : Wordpress Highlight Premium Themes CSRF File Upload Vulnerability Author : DevilScreaM Date : 11/10/2013 - 10 November 2013 Category : Web Applications Type : PHP Vendor : http://themeforest.net Download : http://themeforest.net/item/highlight-powerful-premium-wordpress-theme/168424 Greet...

WordPress Highlight Premium Theme - CSRF

WordPress Highlight Premium theme is prone to a cross-site request forgery vulnerability. It allows an attacker to gain unauthorized access to the affected application by performing certain actions in the context of an authorized user's session. Solution Upgrade the theme...

WordPress Theme Highlight Premium - Cross-Site Request Forgery / Arbitrary File Upload

Title : Wordpress Highlight Premium Themes CSRF File Upload Vulnerability Author : DevilScreaM Date : 11/10/2013 - 10 November 2013 Category : Web Applications Type : PHP Vendor : http://themeforest.net Download : http://themeforest.net/item/highlight-powerful-premium-wordpress-theme/168424 Greet...

Joomla! 3.0.2 PHP Object Injection

------------------------------------------------------------------- Joomla! request-get'highlight', null, 'base64'; 58. $terms = $terms ? unserializebase64decode$terms : null; User input passed through the "highlight" parameter is not properly sanitized before being used in an unserialize call at...

Fedora 17 : cgit-0.9.1-2.fc17 (2012-18464)

Fix syntax highlight to use the correct version of highlight. Update to new upsteam version with 2 security fixes, enhancements and misc other bug fixes. See http://git.zx2c4.com/cgit/commit/?id=a6a932e198e8b6b564d7a4bb43e78078d 8296026 for details. Note that Tenable Network Security has extracte...

Fedora 16 : cgit-0.9.1-2.fc16 (2012-18462)

Fix syntax highlight to use the correct version of highlight. Update to new upsteam version with 2 security fixes, enhancements and misc other bug fixes. See http://git.zx2c4.com/cgit/commit/?id=a6a932e198e8b6b564d7a4bb43e78078d 8296026 for details. Note that Tenable Network Security has extracte...

Fedora 18 : cgit-0.9.1-2.fc18 (2012-18432)

Fix syntax highlight script to use correct version of highlight. Update to new upsteam version with 2 security fixes, enhancements and misc other bug fixes. See http://git.zx2c4.com/cgit/commit/?id=a6a932e198e8b6b564d7a4bb43e78078d 8296026 for details. Note that Tenable Network Security has...

LogAnalyzer index.php 'highlight' Parameter XSS

The LogAnalyzer install hosted on the remote web server is affected by a cross-site scripting vulnerability due to a failure to properly sanitize user input to the 'highlight' parameter of the 'index.php' script. An attacker can exploit this issue to inject arbitrary HTML and script code into a...

CVE-2012-3790

Cross-site scripting XSS vulnerability in index.php in Adiscon LogAnalyzer before 3.4.4 and 3.5.x before 3.5.5 allows remote attackers to inject arbitrary web script or HTML via the highlight parameter in a Search action...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in Adiscon LogAnalyzer before 3.4.4 and 3.5.x before 3.5.5 allows remote attackers to inject arbitrary web script or HTML via the highlight parameter in a Search action...

UBUNTU-CVE-2012-3790

Cross-site scripting XSS vulnerability in index.php in Adiscon LogAnalyzer before 3.4.4 and 3.5.x before 3.5.5 allows remote attackers to inject arbitrary web script or HTML via the highlight parameter in a Search action...

Fedora 17 : python-mwlib-0.13.5-1.fc17 (2012-3138)

Update to version 0.13.5, which solves the following issues : It was reported that mwlib suffered from a flaw that could allow a remote attacker to perform a denial of service attack on a mwlib installation by forcing it to parse a specially crafted iferror magic function. This issue has been...

CVE-2012-1209

Cross-site scripting XSS vulnerability in backend/core/engine/base.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allows remote attackers to inject arbitrary web script or HTML via the highlight parameter...