Scout Portal Toolkit 1.3.1 - SPT-UserLogin.php Multiple Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/15818/info Scout Portal Toolkit is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. A successful exploit could allow an attacker to compromise the...

Campus Bulletin Board 3.4 - post3/book.asp review Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/29375/info Campus Bulletin Board is prone to multiple input-validation vulnerabilities, including multiple SQL-injection issues and a cross-site scripting issue, because it fails to sufficiently sanitize user-supplied dat...

AnnonceScriptHP 2.0 Templates/admin.dwt.php email Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/21514/info AnnonceScriptHP is prone to multiple input-validation vulnerabilities, including SQL-injection and cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data. Exploiting these...

Session fixation

debian/guest-account in Light Display Manager lightdm 1.0.x before 1.0.6 and 1.1.x before 1.1.7, as used in Ubuntu Linux 11.10, allows local users to delete arbitrary files via a space in the name of a file in /tmp. NOTE: this identifier was SPLIT per ADT1/ADT2 due to different codebases and...

Cooper Power Systems Cybectec DNP3 Master OPC Server Improper Input Validation

OVERVIEW Adam Crain of Automatak and independent researcher Chris Sistrunk have identified an improper input validation vulnerability in Cooper Power Systems Cybectec DNP3 Master OPC Server software. Cooper Power Systems has discontinued the OPC server and recommends that customers use the SMP...

Catapult Software DNP3 Driver Improper Input Validation

OVERVIEW This advisory was originally posted to the US-CERT secure Portal library on October 24, 2013, and is now being released to the NCCIC/ICS-CERT Web site. Adam Crain of Automatak and independent researcher Chris Sistrunk have identified an improper input validation in Catapult Software’s DN...

Microsoft Sharepoint (Cloud) Persistent Script Insertion

Title: ====== Microsoft SharePoint Cloud - Persistent Exception-Handling Web Vulnerability Date: ===== 2013-06-14 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=812 Microsoft Security Response Center MSRC ID: 14096 Microsoft Security Response Center MSRC MANAGER: JT MS...

DHTMLX Suite 3.0 SQL Injection / Cross Site Scripting

Title: ====== DHTMLX Suite v.3.0 - Multiple Web Vulnerabilities Date: ===== 2012-04-11 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=507 VL-ID: ===== 507 Introduction: ============= To demonstrate the rich possibilities of DHTMLX controls and to show how they work...

VMSA-2012-0005 : VMware vCenter Server, Orchestrator, Update Manager, vShield, vSphere Client, Workstation, Player, ESXi, and ESX address several security issues

a. VMware Tools Display Driver Privilege Escalation The VMware XPDM and WDDM display drivers contain buffer overflow vulnerabilities and the XPDM display driver does not properly check for NULL pointers. Exploitation of these issues may lead to local privilege escalation on Windows-based Guest...

VMware ESXi/ESX patches address several security issues (VMSA-2012-0005)

The remote ESXi is missing one or more security related Updates from VMSA-2012-0005. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Oracle Solution Website - Cross Site Scripting Vulnerabilities

Document Title: =============== Oracle Solution Website - Cross Site Scripting Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=370 Release Date: ============= 2012-01-27 Vulnerability Laboratory ID VL-ID:...

Astaro Gateway v8.1 - Input Validation Vulnerability

Document Title: =============== Astaro Gateway v8.1 - Input Validation Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=193 Release Date: ============= 2011-12-26 Vulnerability Laboratory ID VL-ID: ==================================== 193...

CVE-2011-2118

The FLV ASSET Xtra component in Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code via unspecified vectors, related to an "input validation vulnerability."...

CVE-2011-2118

Adobe Shockwave Player is affected by CVE-2011-2118 due to an input-validation vulnerability in the FLV Asset Xtra component, prior to version 11.6.0.626. This vulnerability enables arbitrary code execution. Multiple connected advisories confirm the issue and reference the targeted Shockwave comp...

HOMEPIMA Design - filedown.php Local File Disclosure

HOMEPIMA Design - filedown.php Local File Disclosure source: https://www.securityfocus.com/bid/47770/info HOMEPIMA Design is prone to a local file-disclosure vulnerability because it fails to adequately validate user-supplied input. Exploiting this vulnerability would allow an attacker to obtain...

GZip 'huft_build()' in 'inflate.c' Input Validation Vulnerability (Windows)

This host is installed with GZip and is prone to Input Validation Vulnerability OpenVAS Vulnerability Test $Id: gbgzipinflatedosvulnwin.nasl 5306 2017-02-16 09:00:16Z teissa $ GZip 'huftbuild' in 'inflate.c' Input Validation Vulnerability Windows Authors: Antu Sanadi Copyright: Copyright c 2010...

Barracuda Web Firewall 660 Firmware v7.3.1.007 Vulnerability

Exploit for unknown platform in category web applications ============================================================ Barracuda Web Firewall 660 Firmware v7.3.1.007 Vulnerability ============================================================ Pentest Information: ==================== GESEC Team...

Barracuda Web Firewall 660 Firmware v7.3.1.007 Vulnerability

No description provided by source. Pentest Information: ==================== GESEC Team remove discover a input validation vulnerability on Barracuda - Web Application Firewall 660 Appliance. A remote attacker is able to get sensitive customer sessions hijackor can implement script routines &...

Barracuda IM Firewall smtp_test.cgi脚本跨站脚本执行漏洞

BUGTRAQ ID: 37248 Barracuda IM Firewall是一种针对即时通信流量的进行检测防护工具。 Barracuda IM Firewall的实现上存在多个跨站脚本执行漏洞，攻击者可能利用此漏洞在用户的浏览器中执行任意脚本代码，导致信息泄露或其他攻击。 0 Barracuda Networks IM Firewall 4.0.01.003 厂商补丁： Barracuda Networks ------------------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

HTTP Server Parameter Pollution

HTTP Parameter Pollution HPP is a hacking technique. HPP attacks allow the attacker to override or add HTTP GET/POST parameters by injecting query string delimiters. This is an input validation vulnerability. Input validation flaws are caused by unsanitized data flows between the front-end and th...