1273 matches found
Light Weight Calendar index.php date Parameter PHP Code Execution - Ver2 (CVE-2006-0206)
A code execution vulnerability has been reported in Light Weight Calendar. The vulnerability is due to the application does not validating the 'date' variable upon submission to the 'index.php' script. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrar...
Google Chrome Eavesdropping Exploit Published
The developer of the annyang speech recognition JavaScript library has published exploit code for a bug in Google’s Chrome browser that could allow a malicious website to eavesdrop using a computer’s microphone long after a visitor has left a website. The code disclosure is in response, said...
IBM Domino 8.5.x < 8.5.3 FP6 iNotes Multiple XSS (uncredentialed check)
According to its banner, the version of IBM Domino formerly IBM Lotus Domino on the remote host is 8.5.x prior to 8.5.3 FP6. It is, therefore, affected by the following iNotes-related cross-site scripting vulnerabilities : - An input validation error exists related to handling content in email...
IBM Domino 8.5.x < 8.5.3 FP6 iNotes Multiple XSS (credentialed check)
The remote host has a version of IBM Domino formerly Lotus Domino 8.5.x prior to 8.5.3 Fix Pack 6 installed. It is, therefore, reportedly affected by the following iNotes-related cross-site scripting vulnerabilities : - An input validation error exists related to handling content in email message...
IBM Domino 9.x < 9.0.1 Multiple Vulnerabilities (uncredentialed check)
According to its banner, the version of IBM Domino formerly IBM Lotus Domino on the remote host is 9.x earlier than 9.0.1. It is, therefore, affected by the following vulnerabilities : - The included version of the IBM Java SDK contains a version of IBM JRE that contains numerous security issues...
CVE-2013-2629
Leed Light Feed, possibly before 1.5 Stable, allows remote attackers to bypass authorization via vectors related to the 1 importForm, 2 importFeed, 3 addFavorite, or 4 removeFavorite actions in action.php...
Authorization
Leed Light Feed, possibly before 1.5 Stable, allows remote attackers to bypass authorization via vectors related to the 1 importForm, 2 importFeed, 3 addFavorite, or 4 removeFavorite actions in action.php...
CVE-2013-2629
Leed (Light Feed) before 1.5 Stable is affected by CVE-2013-2629 through an authentication bypass in action.php, enabling remote attackers to access functions such as importForm, importFeed, addFavorite, and removeFavorite without proper user verification. The issue is part of a set of vulnerabil...
CVE-2013-2629
Leed Light Feed, possibly before 1.5 Stable, allows remote attackers to bypass authorization via vectors related to the 1 importForm, 2 importFeed, 3 addFavorite, or 4 removeFavorite actions in action.php...
CVE-2013-4065
Cross-site scripting XSS vulnerability in iNotes in IBM Domino 8.5.x before 8.5.3 FP6 and 9.0.x before 9.0.1, when ultra-light mode is enabled, allows remote attackers to inject arbitrary web script or HTML via active content in an e-mail message, aka SPR TCLE98ZKRP...
Cross site scripting
Cross-site scripting XSS vulnerability in iNotes in IBM Domino 8.5.x before 8.5.3 FP6 and 9.0.x before 9.0.1, when ultra-light mode is enabled, allows remote attackers to inject arbitrary web script or HTML via active content in an e-mail message, aka SPR TCLE98ZKRP...
CVE-2013-4065
Cross-site scripting XSS vulnerability in iNotes in IBM Domino 8.5.x before 8.5.3 FP6 and 9.0.x before 9.0.1, when ultra-light mode is enabled, allows remote attackers to inject arbitrary web script or HTML via active content in an e-mail message, aka SPR TCLE98ZKRP...
CVE-2013-2628
Multiple cross-site request forgery CSRF vulnerabilities in action.php in Leed Light Feed, possibly before 1.5 Stable, allow remote attackers to hijack the authentication of administrators for unspecified requests, related to the lack of an anti-CSRF token...
Sql injection
SQL injection vulnerability in action.php in Leed Light Feed, possibly before 1.5 Stable, allows remote attackers to execute arbitrary SQL commands via the id parameter in a removeFolder action...
CVE-2013-2627
CVE-2013-2627 describes a SQL injection in Leed (Light Feed) through action.php?action=removeFolder&id=... where user input is not properly escaped. The CSNC advisory confirms multiple vulnerabilities in Leed, including this SQL injection, and notes the vendor-provided fix was to upgrade to the l...
CVE-2013-2628
Multiple cross-site request forgery CSRF vulnerabilities in action.php in Leed Light Feed, possibly before 1.5 Stable, allow remote attackers to hijack the authentication of administrators for unspecified requests, related to the lack of an anti-CSRF token...
Your MacBook Camera could Spy on You without lighting up the warning light
If you own Apple's MacBook, you should cover up it's webcam, because there's a possibility someone could be watching you. Like most webcams, the MacBook also has a tiny green light lets you know that the webcam is active, but it's possible for malware to disable this important privacy feature on...
Session fixation
The ISL Desktop plugin for Windows before 1.4.7 for ISL Light 3.5.4 and earlier allows remote authenticated users to obtain sensitive information by pasting the clipboard contents that have been copied by another user in the session...