CVE-2012-0061: Improper Input Validation

The headerLoad function in lib/header.c in RPM before 4.9.1.3 does not properly validate region tags, which allows user-assisted remote attackers to cause a denial of service crash and possibly execute arbitrary code via a large region size in a package header...

CVE-2012-1053

The changeuser method in the SUIDManager lib/puppet/util/suidmanager.rb in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise PE Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3 does not properly manage group privileges, which allows local users to gain privileges via vectors...

CVE-2012-1053: Undefined Security Weakness

The changeuser method in the SUIDManager lib/puppet/util/suidmanager.rb in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise PE Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3 does not properly manage group privileges, which allows local users to gain privileges via vectors...

cmseasy <=4.8_lib-defalut-user_act.php 跨站脚本漏洞

No description provided by source...

PT-2012-1126

Name of the Vulnerable Software and Affected Versions RPM versions prior to 4.9.1.3 Description The issue concerns multiple vulnerabilities in the RPM package of Gentoo Linux. These vulnerabilities can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and...

PT-2012-1127

Name of the Vulnerable Software and Affected Versions RPM versions prior to 4.9.1.3 Description The issue allows remote attackers to cause a denial of service and possibly execute arbitrary code via a negative value in a region offset of a package header, which is not properly handled in a numeri...

CVE-2012-2139 rubygem-mail: directory traversal

Directory traversal vulnerability in lib/mail/network/deliverymethods/filedelivery.rb in the Mail gem before 2.4.4 for Ruby allows remote attackers to read arbitrary files via a .. dot dot in the to parameter...

CVE-2011-5080

CVE-2011-5080 affects the TYPO3 extension jftcaforms (Additional TCA Forms) prior to version 0.2.1. The vulnerability exists in lib/class.tx_jftcaforms_tceFunc.php and allows remote attackers to inject arbitrary web script or HTML via unspecified vectors (XSS). Practical impact is to execute scri...

CVE-2011-5080: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in lib/class.txjftcaformstceFunc.php in the Additional TCA Forms jftcaforms extension before 0.2.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-0834

Cross-site scripting XSS vulnerability in lib/QueryRender.php in phpLDAPadmin 1.2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the base parameter in a queryengine action to cmd.php...

CVE-2011-5042: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in inc/lib/lib.base.php in SASHA 0.2.0 allows remote attackers to inject arbitrary web script or HTML via the instructors parameter. NOTE: the original disclosure also mentions the sectiontitle parameter, but this was disputed by the vendor and retracted by...

CVE-2011-2772: Improper Input Validation

The getdatarootimagepath function in lib/file.php in Mahara before 1.4.1 does not properly validate uploaded image files, which allows remote attackers to cause a denial of service memory consumption via a 1 large or 2 invalid image...

PT-2011-4079

Name of the Vulnerable Software and Affected Versions Mahara versions prior to 1.4.1 Description The issue concerns the get dataroot image path function in lib/file.php, which does not properly validate uploaded image files. This allows remote attackers to cause a denial of service, specifically...

CVE-2011-4075: Improper Control of Generation of Code

The masort function in lib/functions.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to execute arbitrary PHP code via the orderby parameter aka sortby variable in a queryengine action to cmd.php, as exploited in the wild in October 2011...

php forge local file inclusion vulnerability-vulnerability warning-the black bar safety net

Code: ? php $page=$GETpage; include$page.'php'; ?& gt; You can use http://www.xxx.com/index.php?page=../etc/passwd http://www.xxx.com/index.php?page=../../../etc/passwd http://www.xxx.com/index.php?page=..../../etc/passwd Get more data: etc/profile etc/services the /etc/passwd /etc/shadow the...

CVE-2011-4215: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in lib/oozaccess.php in OneOrZero Action & Information Management System AIMS 2.7.0 allows remote attackers to execute arbitrary SQL commands via the cookieName variable...

PT-2011-4888

Name of the Vulnerable Software and Affected Versions OneOrZero Action & Information Management System AIMS version 2.7.0 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the cookieName variable in the lib/ooz access.php file. Recommendations F...

CVE-2011-3807

Textpattern 4.2.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by lib/txplibdb.php and certain other files...

CVE-2011-3807: Exposure of Sensitive Information to an Unauthorized Actor

Textpattern 4.2.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by lib/txplibdb.php and certain other files...

PT-2011-4697

Name of the Vulnerable Software and Affected Versions Textpattern version 4.2.0 Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is achieved by revealing the installation path in an error message, as demonstrated by files such...