498 matches found
Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : icedtea-web vulnerabilities (USN-1804-1)
Jiri Vanek discovered that IcedTea-Web would use the same classloader for applets from different domains. A remote attacker could exploit this to expose sensitive information or potentially manipulate applets from other domains. CVE-2013-1926 It was discovered that IcedTea-Web did not properly...
PostgreSQL Denial of Service Vulnerability (Apr 2013) - Windows
PostgreSQL is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
NConf delete_attr.php id Parameter SQL Injection
The version of the NConf installed on the remote host is affected by a SQL injection vulnerability because it fails to properly sanitize user-supplied input to the 'id' parameter of the 'deleteattr.php' script. An attacker may be able to leverage this to manipulate data in the back-end database o...
WordPress Social Sharing Toolkit Plugin <= 2.1.1 - CSRF
Because of this vulnerability, the attackers can hijack the authentication of administrators for requests that manipulate plugin settings via unknown vectors. Solution Update the plugin...
ViewGit 0.0.6 - Multiple Cross-Site Scripting Vulnerabilities
ViewGit 0.0.6 - Multiple Cross-Site Scripting Vulnerabilities Vulnerability Report Author: Matthew R. Bucci Date: 18 March, 2013 CVE-2013-2294 Description of Vulnerability: ----------------------------- ViewGit "is a git web repository viewer that aims to be easy to set up and upgrade, light on...
CVE-2012-4456
The 1 OS-KSADM/services and 2 tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services...
QNAP Turbo NAS privilege escalation
It's possible to manipulate files by absolute path...
Multiple vulnerabilities in Subrion CMS
High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in Subrion CMS, which can be exploited to perform Cross-Site Scripting XSS, SQL Injection and Сross-Site Request Forgery CSRF attacks. 1 SQL Injection in Subrion CMS: CVE-2012-4772 Input passed via the "planid" POST...
Code injection
The Fivestar module 6.x-1.x before 6.x-1.20 for Drupal does not properly validate voting data, which allows remote attackers to manipulate voting averages via a negative value in the vote parameter...
CVE-2012-0237
Advantech/BroadWin WebAccess before 7.0 allows remote attackers to 1 enable date and time syncing or 2 disable date and time syncing via a crafted URL...
sit! support incident tracker 3.64 - Multiple Vulnerabilities
sit! support incident tracker 3.64 - Multiple Vulnerabilities Advisory Details: High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in SiT! Support Incident Tracker, which can be exploited to perform SQL injection, cross-site scripting, cross-site request forgery...
CVE-2011-4701
The CallConfirm jp.gr.javaconf.ofnhwx.callconfirm application 2.0.0 for Android does not properly protect data, which allows remote attackers to read or modify allow/block lists via a crafted application...
Multiple Vulnerabilities in OrangeHRM
High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in OrangeHRM, which can be exploited to perform Cross-Site Scripting XSS and SQL Injection attacks. 1 Cross-Site Scripting XSS vulnerabilities in OrangeHRM 1.1 Input passed via the "uniqcode" GET parameter to...
[SECURITY] Fedora 13 Update: libcgroup-0.35.1-5.fc13
Control groups infrastructure. The tools and library help manipulate, contr ol, administrate and monitor control groups and the associated controllers...
[SECURITY] Fedora 14 Update: libcgroup-0.36.2-6.fc14
Control groups infrastructure. The tools and library help manipulate, contr ol, administrate and monitor control groups and the associated controllers...
RSA Key Manager SQL injection
It's possible to manipilate key cache...
HotWeb Rentals "PageId" SQL Injection Vulnerability
HotWeb Rentals "PageId" SQL Injection Vulnerability PRODUCT http://www.hotwebscripts.co.uk/ Input passed to the "PageId" parameter in default.asp is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. POC...
OneOrZero AIms 2.6.0 Members Edition - Multiple Vulnerabilities
OneOrZero AIms 2.6.0 Members Edition - Multiple Vulnerabilities :::::::::::::::::::::::::::::::::::::: 0x1 :::::::::::::::::::::::::::::::::::::: General Information Advisory/Exploit Title = OneOrZero AIMS v2.6.0 Members Edition Multiple Vulnerabilities Author = Valentin Hoebel Contact =...
E-Xoopport - Samsara SQL Injection Vulnerability
E-Xoopport - Samsara is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
FreeBSD : sudo -- Secure path vulnerability (d42e5b66-6ea0-11df-9c8d-00e0815b8da8)
Todd Miller reports : Most versions of the C library function getenv return the first instance of an environment variable to the caller. However, some programs, notably the GNU Bourne Again SHell bash, do their own environment parsing and may choose the last instance of a variable rather than the...