ClamAV memory corruptions

Memory corruptions on JS and PE files parsing...

Local Path Disclosure when using Asset Pipeline - ownCloud

ownCloud 7 introduced the so-called "Asset Pipeline". It is disabled by default, but can be enabled by setting asset-pipeline.enabled to true in config.php When the setting is enabled ownCloud concatenates all CSS and JS files into a single large blob file. Thus the amount of initial required...

CVE-2014-6300

Cross-site scripting XSS vulnerability in the micro history implementation in phpMyAdmin 4.0.x before 4.0.10.3, 4.1.x before 4.1.14.4, and 4.2.x before 4.2.8.1 allows remote attackers to inject arbitrary web script or HTML, and consequently conduct a cross-site request forgery CSRF attack to crea...

CVE-2014-6300

Cross-site scripting XSS vulnerability in the micro history implementation in phpMyAdmin 4.0.x before 4.0.10.3, 4.1.x before 4.1.14.4, and 4.2.x before 4.2.8.1 allows remote attackers to inject arbitrary web script or HTML, and consequently conduct a cross-site request forgery CSRF attack to crea...

CVE-2014-6300

Cross-site scripting XSS vulnerability in the micro history implementation in phpMyAdmin 4.0.x before 4.0.10.3, 4.1.x before 4.1.14.4, and 4.2.x before 4.2.8.1 allows remote attackers to inject arbitrary web script or HTML, and consequently conduct a cross-site request forgery CSRF attack to crea...

CVE-2014-6300: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the micro history implementation in phpMyAdmin 4.0.x before 4.0.10.3, 4.1.x before 4.1.14.4, and 4.2.x before 4.2.8.1 allows remote attackers to inject arbitrary web script or HTML, and consequently conduct a cross-site request forgery CSRF attack to crea...

CVE-2014-8326

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.5, 4.1.x before 4.1.14.6, and 4.2.x before 4.2.10.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted 1 database name or 2 table name, related to the...

CVE-2014-8326: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.5, 4.1.x before 4.1.14.6, and 4.2.x before 4.2.10.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted 1 database name or 2 table name, related to the...

CVE-2014-1575: Undefined Security Weakness

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 33.0 allow remote attackers to cause a denial of service memory corruption and application crash or possibly execute arbitrary code via vectors related to improper interaction between threading and garbage...

Fedora 20 : mediawiki-1.23.5-1.fc20 (2014-12263)

CVE-2014-7295 bug 70672 SECURITY: OutputPage: Remove separation of css and js module allowance. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as...

Fedora 19 : mediawiki-1.23.5-1.fc19 (2014-12262)

CVE-2014-7295 bug 70672 SECURITY: OutputPage: Remove separation of css and js module allowance. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as...

Ubuntu 14.04 LTS : Exuberant Ctags vulnerability (USN-2371-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2371-1 advisory. It was discovered that Exuberant Ctags incorrectly handled certain minified js files. An attacker could use this issue to possibly cause Exuberant Ctags to consum...

CVE-2014-7205

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for the hapi server framework for Node.js allows remote attackers to execute arbitrary Javascript code via unspecified vectors...

USN-2371-1: Exuberant Ctags vulnerability

It was discovered that Exuberant Ctags incorrectly handled certain minified js files. An attacker could use this issue to possibly cause Exuberant Ctags to consume resources, resulting in a denial of service...

mediawiki: Cross-site Scripting (XSS) and UI redressing

It was discovered that MediaWiki, a wiki engine, was separating the allowance of css and js modules resulting in Cross-site Scripting XSS and UI redressing issues...

PT-2014-4228

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 33.0 Description The issue is related to multiple unspecified vulnerabilities in the browser engine, allowing remote attackers to cause a denial of service, such as memory corruption and application crash, or...

PT-2014-8471

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 4.0.x through 4.0.10.4 phpMyAdmin versions 4.1.x through 4.1.14.5 phpMyAdmin versions 4.2.x through 4.2.10.0 Description The issue allows remote authenticated users to inject arbitrary web script or HTML via a crafted...

FineCMS 最新版存储型xss跨后台getshell和多处xss合集

简要描述： FineCMS 最新版xss跨后台getshell和多处xss合集，我知道这个厂商习惯性忽略，但是这只是一个开始，一个开始，开始........................... 详细说明： 首先我们演示一下第一个xss,通过这个xss，反弹后台getshell: 第一步，我们注册一个用户，如果管理员审核通过，也就是说这个用户是个普通的正常用户 我们去图片发表处： 下来我们看看本页也能弹出来: 下来我们去后台看看 是否能够弹出来： ok 到这里我们已经看到了这个xss，肯定会引起管理员的审核： 下来我们更换xss的payload： 我们用iframe标签： 加载远端js...

Discuz!x xss反弹后台无防御sql注入getshell(附带exploit)

简要描述： Discuz!x xss反弹后台无防御sql注入getshell，这里的xss只是做一个药引子，因为xss来自日志功能，然而这个日志功能却又默认关闭的，为了测试我们开启它。这个漏洞应该是所有dz通杀的，我下载了最新版本的所以测试通过...... 详细说明： 首先我们开启日志功能，然后存储一个xss看看： 测试一个xss页面： 我们调到文章页面看看，是否被执行了： 下来我们看看怎样把这个发给管理员呢，底下有一个举报页面： 我们以管理员的身份看看这个后台的举报请求： 这个过程我们分析完毕了，下来我们看看后台一处，无防御的sql注入：...

vBulletin 5.1.x - Persistent Cross-Site Scripting

Title: vBulletin 5.1.X - Cross Site Scripting Date: 05.09.14 Version: = 5.1.2 Latest ATM Vendor: vbulletin.com Contact: smash at devilteam.pl 1 Agenda Latest vBulletin forum software suffers on persistent cross site scripting vulnerability, which most likely can be used against every user, such a...