dotDefender 3.8-5 - Remote Code Execution (via Cross-Site Scripting)

dotDefender 3.8-5 - Remote Code Execution via Cross-Site Scripting / DotDefender = 3.8-5 No Authentication Remote Code Execution Through XSS Tested on DotDefender 3.8-5 On Ubuntu Server 9.10 64-bit with Firefox 3.6.3 Paul Hand aka rAWjAW AT offsec.com Original Post-Authentication Remote Command...

Crlf injection

The Cisco Content Services Switch CSS 11500 with software before 8.20.4.02 and the Application Control Engine ACE 4710 with software before A23.0 do not properly handle use of LF, CR, and LFCR as alternatives to the standard CRLF sequence between HTTP headers, which allows remote attackers to...

Mozilla Products Firefox/Seamonkey Multiple Vulnerabilities june-10 (Windows)

The host is installed with Mozilla Firefox/Seamonkey and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: secpodmozillaprdtsmultvulnwin01jun10.nasl 6444 2017-06-27 11:24:02Z santu $ Mozilla Firefox/Seamonkey Multiple Vulnerabilities june-10 Windows Authors: Antu Sanadi...

Crlf injection

CRLF injection vulnerability in +webvpn+/index.html in WebVPN on Cisco Adaptive Security Appliances ASA 5580 series devices with software before 8.12 allows remote attackers to inject arbitrary HTTP headers as demonstrated by a redirect attack involving a %0d%0aLocation%3a sequence in a URI, or...

Applicure dotDefender 4.01-3 - Persistent Cross-Site Scripting

An advisory by EnableSecurity. ID: ES-20100601 Advisory URL: http://resources.enablesecurity.com/advisories/ES-20100601-dotdefender4.txt Affected Versions: version 4.0 Fixed versions: 4.01-3 and later Description: Applicure dotDefender is a Web Application Firewall that can be installed on Window...

Applicure dotDefender 4.01-3 - Persistent Cross-Site Scripting

Applicure dotDefender 4.01-3 - Persistent Cross-Site Scripting An advisory by EnableSecurity. ID: ES-20100601 Advisory URL: http://resources.enablesecurity.com/advisories/ES-20100601-dotdefender4.txt Affected Versions: version 4.0 Fixed versions: 4.01-3 and later Description: Applicure dotDefende...

Cross site scripting

Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, does not properly handle situations in which both "Content-Disposition: attachment" and "Content-Type: multipart" are present in HTTP headers, which allows remote attackers to conduct cross-site scripting XSS...

CVE-2010-1197

CVE-2010-1197 affects Mozilla Firefox 3.5.x before 3.5.10, Firefox 3.6.x before 3.6.4, and SeaMonkey before 2.0.5. Root cause: Firefox/SeaMonkey fail to handle cases where both Content-Disposition: attachment and Content-Type: multipart are present in HTTP headers, enabling remote XSS via an uplo...

Email Image Upload Shell Upload

============================================= =================================== ============================================= ====== Email image upload Remote file Upload Vulnerability ============================================= ===================================...

Weborf 'Range' Header Denial of Service Vulnerability

This host is running Weborf webserver and is prone to denial of service vulnerability. OpenVAS Vulnerability Test $Id: gbweborfrangedosvuln.nasl 5388 2017-02-21 15:13:30Z teissa $ Weborf 'Range' Header Denial of Service Vulnerability Authors: Sooraj KS Copyright: Copyright c 2010 Greenbone Networ...

Image Store Remote file Upload Vulnerability

Exploit for php platform in category web applications ============================================ Image Store Remote file Upload Vulnerability ============================================ Name: Image Store V 1.0 Date: 09-06-2010 vendor: http://www.scriptidea.net/imagestore/ Price: $199.00...

Image Store - Arbitrary File Upload

============================================= =================================== ============================================= ====== Image Store Remote file Upload Vulnerability ============================================= ===================================...

Applicure dotDefender 4.0 administrative interface cross site scripting

Applicure dotDefender 4.0 administrative interface cross site scripting An advisory by EnableSecurity. ID: ES-20100601 Advisory URL: http://resources.enablesecurity.com/advisories/ES-20100601-dotdefender4.txt Affected Versions: version 4.0 Fixed versions: 4.01-3 and later Description: Applicure...

Squid strListGetItem Denial of Service (CVE-2009-2855)

A denial of service vulnerability exists in the way Squid handles HTTP headers. The vulnerability is due to an infinite loop error when processing HTTP headers containing a specific delimiter character. Remote unauthenticated attackers can exploit this vulnerability by sending specially crafted...

CGI Generic XSS (HTTP Headers)

The remote web server hosts CGI scripts that fail to adequately sanitize HTTP headers of malicious JavaScript. By leveraging this issue, an attacker may be able to cause arbitrary HTML and script code to be executed in a user's browser within the security context of the affected site. Note that...

Google Chrome Multiple Vulnerabilities (win)

This host is installed with Google Chrome Web Browser and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: gbgooglechromemultvulnapr10.nasl 5306 2017-02-16 09:00:16Z teissa $ Google Chrome Multiple Vulnerabilities win Authors: Antu Sanadi Copyright: Copyright c 2010 Greenbone...

CVE-2010-1231

Google Chrome before 4.1.249.1036 processes HTTP headers before invoking the SafeBrowsing feature, which allows remote attackers to have an unspecified impact via crafted headers...

Security feature bypass

Google Chrome before 4.1.249.1036 processes HTTP headers before invoking the SafeBrowsing feature, which allows remote attackers to have an unspecified impact via crafted headers...

CVE-2010-1231

Google Chrome before 4.1.249.1036 processes HTTP headers before invoking the SafeBrowsing feature, which allows remote attackers to have an unspecified impact via crafted headers...

CVE-2010-1231

Affected software: Google Chrome prior to 4.1.249.1036 (Windows). Root cause: Chrome processes HTTP headers before invoking SafeBrowsing, enabling remote attackers to induce an unspecified impact via crafted headers. Exploitation status: not provided in the documents; in-the-wild details are not ...