SA-CONTRIB-2012-117 - Location - Access Bypass

The Location module allows real-world geographic locations to be associated with Drupal nodes, including people, places, and other content. The Location Search sub-module adds a search page for searching for locations. The Location Search module fails to enforce content and user access permission...

RHEL 5 / 6 : firefox (RHSA-2012:1088)

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1088 advisory. Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. A web page containing...

Spoofing issue with location — Mozilla

Security researcher Mariusz Mlynski reported an issue with spoofing of the location property. In this issue, calls to history.forward and history.back are used to navigate to a site while displaying the previous site in the addressbar but changing the baseURI to the newer site. This can be used f...

WellinTech KingView Multiple Vulnerabilities

WellinTech KingView is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Adobe ColdFusion HTTP Response Splitting (APSB12-15)

The version of Adobe ColdFusion running on the remote host is affected by an HTTP response splitting vulnerability. The coldfusion.filter.ComponentFilter class does not properly sanitize input used in the Location header of an HTTP response. A remote attacker can exploit this by tricking a user...

CVE-2012-0028

The robust futex implementation in the Linux kernel before 2.6.28 does not properly handle processes that make exec system calls, which allows local users to cause a denial of service or possibly gain privileges by writing to a memory location in a child process...

CVE-2012-0028

The robust futex implementation in the Linux kernel before 2.6.28 does not properly handle processes that make exec system calls, which allows local users to cause a denial of service or possibly gain privileges by writing to a memory location in a child process...

Boonex Dolphin v7.0.9 CMS & Mobile App - Multiple Web Vulnerabilities

Title: ====== Boonex Dolphin v7.0.9 CMS - Multiple Web Vulnerabilities Date: ===== 2012-05-18 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=565 http://www.vulnerability-lab.com/getcontent.php?id=566 ID: Changeset 16256 VL-ID: ===== 565 Common Vulnerability Scoring...

How to Change Veeam Report Viewer Default VMR Storage Location

Purpose This article documents how to change the default path that Veeam Report Viewer uses to store VMR files. Solution The per-user configuration settings for Veeam Report Viewer are contained within the user.config file for the process. The path to the user.config varies between deployments an...

Squirrelcart Cart Shop v3.3.4 - Multiple Web Vulnerabilities

Title: ====== Squirrelcart Cart Shop v3.3.4 - Multiple Web Vulnerabilities Date: ===== 2012-06-04 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=592 VL-ID: ===== 592 Common Vulnerability Scoring System: ==================================== 3.5 Introduction: ===========...

Remote code execution

Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by attempting to access an undefined memory location, aka "insertAdjacentText Remote Code Execution Vulnerability."...

Artiphp CMS 5.5.0 database backup disclosure Exploit-vulnerability warning-the black bar safety net

? php / Artiphp CMS 5.5.0 Database Backup Disclosure Exploit Author: Artiphp www.2cto.com http://www.artiphp.com Affected version: 5.5.0 Neo r422 Summary: Artiphp is a content management system CMS open and free to create and manage your website. Description: Artiphp stores database backups using...

WordPress Dynamic Widgets 1.5.1 Cross Site Scripting

Hi We have used our tool, THAPS, to identify vulnerabilities in this WordPress plugin. We have confirmed at least one of the reported vulnerabilities and created a working exploit located below. Attached is one or more log files containing the output of our tool, identifying the location of the...

WordPress Download Manager 2.2.2 Cross Site Scripting

Hi We have used our tool, THAPS, to identify vulnerabilities in this WordPress plugin. We have confirmed at least one of the reported vulnerabilities and created a working exploit located below. Attached is one or more log files containing the output of our tool, identifying the location of the...

WordPress GRAND Flash Album Gallery 1.71 Cross Site Scripting

Hi We have used our tool, THAPS, to identify vulnerabilities in this WordPress plugin. We have confirmed at least one of the reported vulnerabilities and created a working exploit located below. Attached is one or more log files containing the output of our tool, identifying the location of the...

WordPress SABRE 1.2.0 Cross Site Scripting

Hi We have used our tool, THAPS, to identify vulnerabilities in this WordPress plugin. We have confirmed at least one of the reported vulnerabilities and created a working exploit located below. Attached is one or more log files containing the output of our tool, identifying the location of the...

WordPress WP Survey And Quiz Tool 2.9.2 Cross Site Scripting

Hi We have used our tool, THAPS, to identify vulnerabilities in this WordPress plugin. We have confirmed at least one of the reported vulnerabilities and created a working exploit located below. Attached is one or more log files containing the output of our tool, identifying the location of the...

Senator Seeks More Info On DOJ Location Tracking Practices

Senator Al Franken D-MN is demanding answers to questions about the U.S. Department of Justice DOJ practice of gathering data from wireless providers in order to monitor individuals’ movements using mobile phone location data. Franken released a copy of a letter to Attorney General Eric Holder on...

DecisionTools SharpGrid Active-X Code Execution

Application: DecisionTools SharpGrid ActiveX Control Code Execution Vulnerability Platforms: Windows Secunia: SA48571 Date: 2012-05-09 Author: Francis Provencher Protek Research Lab's Website: http://www.protekresearchlab.com/ Twitter: @ProtekResearch 1 Introduction 2 Report Timeline 3 Technical...

DecisionTools SharpGrid - ActiveX Control Remote Code Execution

Application: DecisionTools SharpGrid ActiveX Control Code Execution Vulnerability Platforms: Windows Secunia: SA48571 Date: 2012-05-09 Author: Francis Provencher Protek Research Lab's Website: http://www.protekresearchlab.com/ Twitter: @ProtekResearch 1 Introduction 2 Report Timeline 3 Technical...