SA-CONTRIB-2009-085 - Insert Node - Cross Site Scripting

The Insert Node module provides an input filter that enables a node to be inserted within the body field of another node. The module fails to sanitize the inserted node, making it vulnerable to a cross site scripting XSS attack. Versions affected Insert Node module versions for Drupal 5.x prior t...

[SECURITY] Fedora 10 Update: planet-2.0-10.fc10

Planet is a flexible feed aggregator, this means that it downloads feeds and aggregates their content together into a single combined feed with the latest news first. It uses Mark Pilgrim's Ultra-liberal feed parser so can read from RDF, RSS and Atom feeds and Tomas Styblo's template library to...

[SECURITY] Fedora 11 Update: planet-2.0-10.fc11

Planet is a flexible feed aggregator, this means that it downloads feeds and aggregates their content together into a single combined feed with the latest news first. It uses Mark Pilgrim's Ultra-liberal feed parser so can read from RDF, RSS and Atom feeds and Tomas Styblo's template library to...

DEBIAN-CVE-2008-3075

The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted attackers to execute arbitrary code via the "!" exclamation point shell metacharacter in 1 the filename of a ZIP archive and possibly 2 the filename of the first file in a ZIP archive, which is not properly...

plugin: improper Implementation of shellescape() (arbitrary code execution)

The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted attackers to execute arbitrary code via the "!" exclamation point shell metacharacter in 1 the filename of a ZIP archive and possibly 2 the filename of the first file in a ZIP archive, which is not properly...

Mozilla BOM characters stripped from JavaScript before execution

Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allow remote attackers to bypass cross-site scripting XSS protection mechanisms and conduct XSS attacks via byte order mark BOM characters that are removed from JavaScript code before...

CVE-2008-4065

Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allow remote attackers to bypass cross-site scripting XSS protection mechanisms and conduct XSS attacks via byte order mark BOM characters that are removed from JavaScript code before...

CVE-2008-4065: Improper Neutralization of Input During Web Page Generation

Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allow remote attackers to bypass cross-site scripting XSS protection mechanisms and conduct XSS attacks via byte order mark BOM characters that are removed from JavaScript code before...

SA-2008-051 - Mailsave - Cross site scripting

Mailsave is a module that is designed to interact with mailhandler. It will detach files that are emailed to the site and save them with the node. The module trusts the mimetype that is send with the file enabling malicious users with the ability to upload files to execute cross site scripting...

RedDot CMS 7.5 (LngId) Remote SQL Injection Exploit

No description provided by source. !/usr/bin/env python un-comment your selection. import urllib2 import urllib import string import getopt import sys def banner: print print "RED DOT CMS 7.5 database enumeration" print "by Mark Crowther and Rodrigo Marcos" def usage: print print "usage:" print...

Unfixed XSS vulnerability at critical-security.pastebin.org

Security researcher Mark, has submitted on 13/02/2008 a cross-site-scripting XSS vulnerability affecting critical-security.pastebin.org, which at the time of submission ranked 662286 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 19/03/2008. I...

Debian Security Advisory DSA 257-1 (sendmail)

The remote host is missing an update to sendmail announced via advisory DSA 257-1. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 6.06 LTS : mozilla-thunderbird vulnerabilities (USN-297-1)

Jonas Sicking discovered that under some circumstances persisted XUL attributes are associated with the wrong URL. A malicious website could exploit this to execute arbitrary code with the privileges of the user. MFSA 2006-35, CVE-2006-2775 Paul Nickerson discovered that content-defined setters o...

Ubuntu 5.04 / 5.10 / 6.06 LTS : openssh vulnerabilities (USN-355-1)

Tavis Ormandy discovered that the SSH daemon did not properly handle authentication packets with duplicated blocks. By sending specially crafted packets, a remote attacker could exploit this to cause the ssh daemon to drain all available CPU resources until the login grace time expired...

CVE-2003-1530: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in privmsg.php in phpBB 2.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the mark parameter...

SA-2007-025 - Drupal core - Arbitrary code execution via installer.

The Drupal installer allows any visitor to provide credentials for a database when the site's own database is not reachable. This allows attackers to run arbitrary code on the site's server. An immediate workaround is the removal of the file install.php in the Drupal root directory. Versions...

NGS-enjoysap-stack.txt

======= Summary ======= Name: EnjoySAP, SAP GUI for Windows - Stack Overflow Release Date: 5 July 2007 Reference: NGS00483 Discover: Mark Litchfield Vendor: SAP Vendor Reference: SECRES-289 Systems Affected: All Versions Risk: High Status: Fixed ======== TimeLine ======== Discovered: 4 January 20...

EnjoySAP ActiveX kweditcontrol.kwedit.1 Remote Stack Overflow PoC

No description provided by source. !-- ======= Summary ======= Name: EnjoySAP, SAP GUI for Windows - Stack Overflow Release Date: 5 July 2007 Reference: NGS00483 Discover: Mark Litchfield [email protected] Vendor: SAP Vendor Reference: SECRES-289 Systems Affected: All Versions Risk: High Statu...

EnjoySAP ActiveX kweditcontrol.kwedit.1 - Remote Stack Overflow (PoC)

Vendor: SAP Vendor Reference: SECRES-289 Systems Affected: All Versions Risk: High Status: Fixed ======== TimeLine ======== Discovered: 4 January 2007 Released: 19 January 2007 Approved: 29 January 2007 Reported: 11 January 2007 Fixed: 18 May 2007 Published: =========== Description ===========...

EnjoySAP ActiveX rfcguisink.rfcguisink.1 Remote Heap Overflow PoC

Exploit for unknown platform in category dos / poc ================================================================= EnjoySAP ActiveX rfcguisink.rfcguisink.1 Remote Heap Overflow PoC ================================================================= Vendor: SAP Vendor Reference: SECRES-290 Systems...