libXp: Integer overflow leading to heap-based buffer overflow

Multiple integer overflows in X.org libXp 1.0.1 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the 1 XpGetAttributes, 2 XpGetOneAttribute, 3 XpGetPrinterList, and 4 XpQueryScreens functions...

CVE-2014-7205

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for the hapi server framework for Node.js allows remote attackers to execute arbitrary Javascript code via unspecified vectors...

CVE-2014-7205

The Bassmaster Node.js plugin for the Hapi server contains CVE-2014-7205: an eval-based injection in the internals.batch function (lib/batch.js) before version 1.5.2, enabling remote arbitrary JavaScript execution. Documents show affected version range is bassmaster

CVE-2014-5261

The graph settings script graphsettings.php in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a font size, related to the rrdtool commandline in lib/rrd.php...

Code injection

The graph settings script graphsettings.php in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a font size, related to the rrdtool commandline in lib/rrd.php...

openSUSE Security Update : - Update to version neutron-2013.2.4.dev84.gbe0c1d1 (openSUSE-SU-2014:1051-1)

Update to version neutron-2013.2.4.dev84.gbe0c1d1 : - Fix getvifportbyid to only return relevant ports - Update to version neutron-2013.2.4.dev82.gd1a9a9d : - LBaaS add missing rootwrap filter for route - NVP plugin:fix delete sec group when backend is out of sync - Kill 'Skipping unknown group...

CVE-2014-3904

SQL injection vulnerability in lib/admin.php in tenfourzero Shutter 0.1.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Sql injection

SQL injection vulnerability in lib/admin.php in tenfourzero Shutter 0.1.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2014-3904

CVE-2014-3904 affects Shutter 0.1.4 (tenfourzero). The vulnerability is a SQL injection in lib/admin.php that enables remote attackers to execute arbitrary SQL commands via unspecified vectors. Impact is described as possible arbitrary SQL execution with administrative context, potentially affect...

CVE-2014-5189

Lead Octopus Power is a WordPress plugin affected by an SQL injection in lib/optin/optin_page.php via the id parameter. The vulnerability allows remote attackers to execute arbitrary SQL commands, potentially compromising data. Public sources (NVD, WPVulnDB, PatchStack) corroborate the SQLi vecto...

Cool Video Gallery 1.8 - lib/core.php Multiple Actions CSRF

The Cool Video Gallery WordPress plugin was affected by a lib/core.php Multiple Actions CSRF security vulnerability...

Design/Logic Flaw

The 1 shellexec function in lib/util/MiqSshUtilV1.rb and 2 tempcmdfile function in lib/util/MiqSshUtilV2.rb in Red Hat CloudForms 3.0 Management Engine CFME before 5.2.4.2 allow local users to execute arbitrary commands via a symlink attack on a temporary file with a predictable name...

xine-lib <= 1.1.12 NSF demuxer Stack Overflow Vulnerability PoC

No description provided by source. xine-lib = 1.1.12 is prone to a stack-based buffer overflow in the NES Sound Format demuxerdemuxnsf.c. - Code opennsffile: 109: this-title = strdup&header0x0E; demuxnsfsendchunk: 122: char title100; 162: sprintftitle, %s, song %d/%d, this-title, this-currentsong...

xine-lib <= 1.1 (media player library) Remote Format String Exploit

No description provided by source. !/usr/bin/perl -- When playing an Audio CD, using xine-lib based media application, the library contacts a CDDB server to retrieve metadata like the title and artist's name. During processing of this data, a response from the server, which is located in memory o...

Simple Text-File Login script 1.0.6 - (DD/RFI) Multiple Vulnerabilities

No description provided by source. START 0x01 Informations: Script : Simple Text-File Login script 1.0.6 Download : http://www.hotscripts.com/jump.php?listingid=36777&jumptype=1 Vulnerability : Remote File Inclusion / Sensitive Data Disclosure Author : Osirys Contact : osirysatlivedotit Notes :...

Common Desktop Environment <= 2.1 20,Solaris <= 7.0 dtspcd Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/636/info This explanation is quoted from the initial post on this problem by Job De Hass. This message is available in its entirety in the 'Credit' section of this vulnerability entry. The CDE subprocess daemon...

rgboard <= 3.0.12 (rfi/xss) Multiple Vulnerabilities

No description provided by source. Rgboard 3.0.x Multiple Vulnerabilities RFI/XSS // Author:: e.wiZz! // Site:: www.balcanwarez.com // Contact:: N/A :D =========================================================== // Script :: Rgboard // Vulnerable version :: 3.0.0/3.0.12 // Not vulnerable :: 4.0 /...

PHPDocumentor 1.2/1.3 Forum Lib Variable Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/16101/info phpDocumentor is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary...

SunOS <= 4.1.3 LD_LIBRARY_PATH and LD_OPTIONS Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/43/info There exists a vulnerability involving environment variables and setuid/setgid programs under SunOS 4.0 and higher. A dynamically-linked program that is invoked by a setuid/setgid program has access to the caller'...

Geeklog <= 1.5.2 SEC_authenticate() SQL Injection Exploit

No description provided by source. ?php / Geeklog =1.5.2 SECauthenticate/PHPAUTHUSER sql injection exploit by Nine:Situations:Group::bookoo our site: http://retrogod.altervista.org/ software site: http://www.geeklog.net/ credit goes to rgod, bug found more than a year ago working against PHP = 5....