PR10-17 Various XSS and information disclosure flaws within KeyFax response management system

PR10-17: Various XSS and information disclosure flaws within KeyFax response management system http://www.omfax.co.uk Vulnerability found: 25th August 2010 Vendor informed: Vulnerability fixed: Severity: Medium/High Description: KeyFax response management system provides professional management o...

OSI Security: Civica Spydus Library Management System (LMS) - Cross-Site Scripting Vulnerability

Civica Spydus Library Management System LMS - Cross-site Scripting Vulnerability http://www.osisecurity.com.au/advisories/civica-spydus-library-management-system-cross-site-scripting Release Date: 04-May-2011 Software: Civica - Spydus http://www.civicaplc.com/ "Libraries and information service...

[SECURITY] [DSA 2234-1] zodb security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2234-1 [email protected] http://www.debian.org/security/ Luciano Bello May 10, 2011 http://www.debian.org/security/faq -...

KeyFax Response Management System 3.2.2.6 XSS / Information Disclosure

PR10-17: Various XSS and information disclosure flaws within KeyFax response management system http://www.omfax.co.uk Vulnerability found: 25th August 2010 Vendor informed: Vulnerability fixed: Severity: Medium/High Description: KeyFax response management system provides professional management o...

openSUSE Security Update : libwebkit (openSUSE-SU-2011:0024-1)

Various bugs in webkit have been fixed. The CVE id's are : CVE-2009-0945, CVE-2009-1681, CVE-2009-1684, CVE-2009-1685, CVE-2009-1686, CVE-2009-1687, CVE-2009-1688, CVE-2009-1689, CVE-2009-1691, CVE-2009-1690, CVE-2009-1692, CVE-2009-1693, CVE-2009-1694, CVE-2009-1695, CVE-2009-1696, CVE-2009-1697...

OSI Security: LANSA aXes Web Terminal (TN5250) Cross-Site Scripting Vulnerability

LANSA aXes Web Terminal TN5250 Cross-Site Scripting Vulnerability http://www.osisecurity.com.au/advisories/lansa-axes-web-terminal-tn5250-cross-site-scripting Release Date: 30-Apr-2011 Software: LANSA - aXes http://www.lansa.com http://www.axeslive.com "Transform your 5250 applications into GUI...

CVE-2011-1839

IBM Rational Build Forge 7.1.0 uses the HTTP GET method during redirection from the authentication servlet to a PHP script, which makes it easier for context-dependent attackers to discover session IDs by reading 1 web-server access logs, 2 web-server Referer logs, or 3 the browser history...

Design/Logic Flaw

IBM Rational Build Forge 7.1.0 uses the HTTP GET method during redirection from the authentication servlet to a PHP script, which makes it easier for context-dependent attackers to discover session IDs by reading 1 web-server access logs, 2 web-server Referer logs, or 3 the browser history...

CVE-2011-1839

IBM Rational Build Forge 7.1.0 uses the HTTP GET method during redirection from the authentication servlet to a PHP script, which makes it easier for context-dependent attackers to discover session IDs by reading 1 web-server access logs, 2 web-server Referer logs, or 3 the browser history...

CVE-2011-1717

Skype for Android stores sensitive user data without encryption in sqlite3 databases that have weak permissions, which allows local applications to read user IDs, contacts, phone numbers, date of birth, instant message logs, and other private information...

Information disclosure

Skype for Android stores sensitive user data without encryption in sqlite3 databases that have weak permissions, which allows local applications to read user IDs, contacts, phone numbers, date of birth, instant message logs, and other private information...

CVE-2011-1717

Skype for Android stores sensitive user data without encryption in sqlite3 databases that have weak permissions, which allows local applications to read user IDs, contacts, phone numbers, date of birth, instant message logs, and other private information...

About the security content of Mac OS X v10.6.7 and Security Update 2011-001

About the security content of Mac OS X v10.6.7 and Security Update 2011-001 Last Modified: March 21, 2011 Article: HT4581 Email this article Print this page Summary This document describes the security content of Mac OS X v10.6.7 and Security Update 2011-001, which can be downloaded and installed...

Legacy Browser Exploit Whitespace Obfuscation

Although various security products provide coverage against many web vulnerabilities known exploits could potentially bypass security products by using JavaScript obfuscation techniques. An example of such a technique is the whitespace obfuscation. Such techniques obfuscate known exploits so they...

SmarterMail 8.0 - Multiple Cross-Site Scripting Vulnerabilities

Author: Hoyt LLC Research Target: SmarterMail Version 8.0.4086.25048 Tools: Burp Suite Pro 1.3.09, FuzzDB Description: XSS, Cross Site Scripting in SmarterMail 8.0.4086.25048, CWE-79, CAPEC-86 Keywords: Stored XSS, Reflected XSS, Cross Site Scripting, SmarterMail 8.0.4086.25048, xss.cx, hoyt llc...

About the security content of iTunes 10.2

About the security content of iTunes 10.2 Last Modified: March 02, 2011 Article: HT4554 Email this article Print this page Summary This document describes the security content of iTunes 10.2. For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a...

Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Manager

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Manager Advisory ID: cisco-sa-20110223-telepresence-ctsman Revision 1.0 For Public Release 2011 February 23 +----------------------------------------------------- Summary ======...

Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Recording Server

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Recording Server Advisory ID: cisco-sa-20110223-telepresence-ctrs Revision 1.0 For Public Release 2011 February 23 1600 UTC GMT...

Design/Logic Flaw

The administrative web interface on Cisco TelePresence Recording Server devices with software 1.6.x and Cisco TelePresence Multipoint Switch CTMS devices with software 1.0.x, 1.1.x, 1.5.x, and 1.6.x allows remote attackers to create or overwrite arbitrary files, and possibly execute arbitrary cod...

Authentication flaw

Cisco TelePresence Recording Server devices with software 1.6.x and Cisco TelePresence Multipoint Switch CTMS devices with software 1.0.x, 1.1.x, 1.5.x, and 1.6.x do not properly restrict remote access to the Java servlet RMI interface, which allows remote attackers to cause a denial of service...