12239 matches found
Mandrake Linux Security Advisory : Zope (MDKSA-2000:035)
A problem exists in the Zope package with the getRoles method of user objects contained in the default UserFolder implementation. Users with the ability to edit DTML could arrange to give themselves extra roles for the duration of a single request by mutating the roles list as a part of the reque...
UBUNTU-CVE-2012-1608
The t3libdiv::RemoveXSS API method in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to bypass the cross-site scripting XSS protection mechanism and inject arbitrary web script or HTML via non printable characters...
CVE-2012-1608
The t3libdiv::RemoveXSS API method in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to bypass the cross-site scripting XSS protection mechanism and inject arbitrary web script or HTML via non printable characters...
OpenJDK: beans MethodElementHandler insufficient permission checks (beans, 7194567)
Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 6 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Beans, a different vulnerability than CVE-2012-1682...
Android Cyobozu Live 任意代码执行漏洞(CVE-2012-4008)
Bugtraq ID:55357 CVE ID:CVE-2012-4008 Android Cybozu Live application是一款基于安卓的办公软件手机应用。 Android Cybozu Live存在一个安全漏洞，允许远程攻击者通过构建恶意WEB站，诱使应用程序解析，执行任意Java方法，可获得敏感信息或执行任意命令。 0 Cybozu Live application 1.0.4 厂商解决方案 用户可联系供应商获得最新的应用程序： http://magazine.cybozulive.com/2012/08/291200.html...
OpenJDK: beans insufficient permission checks, Java 7 0day (beans, 7162473)
Multiple vulnerabilities in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by 1 using com.sun.beans.finder.ClassFinder.findClass and leveraging an...
OpenJDK: beans MethodElementHandler insufficient permission checks (beans, 7194567)
Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 6 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Beans, a different vulnerability than CVE-2012-1682...
Cybozu Live for Android vulnerable to arbitrary Java method execution
Overview Cybozu Live for Android contains an arbitrary Java method execution vulnerability. Cybozu Live for Android is a client software for Cybozu Live. Cybozu Live for Android contains an arbitrary Java method execution vulnerability. Gaku Mochizuki of Mitsui Bussan Secure Directions, Inc...
CVE-2012-4008
The Cybozu Live application 1.0.4 and earlier for Android allows remote attackers to execute arbitrary Java methods, and obtain sensitive information or execute arbitrary commands, via a crafted web site...
Apache Struts Security Update (S2-012) - Active Check
Apache Struts is prone to a java method execution vulnerability. Copyright C 2012 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...
JVN#23009798: Cybozu Live for Android vulnerable to arbitrary Java method execution
Cybozu Live for Android is a client software for Cybozu Live. Cybozu Live for Android contains an arbitrary Java method execution vulnerability. Impact When opening a specially crafted website, an attacker may be able to execute an arbitrary Java method. As a result, information stored in Android...
OpenText WSM CMS Cross Site Scripting
Exploit Title: OpenText WSM cms Cross Site Scripting Vulnerability Google Dork: Intext:" Powered by OpenText WSM" Date: 08/29/2012 Author: Crim3R Site : Http://Ajaxtm.com/ Vendor Home : http://www.opentext.com/uk Tested on: all ================================== + the search form in site is not...
McAfee Virtual Technician ActiveX Control GetObject() Method Remote Command Execution (SB10028)
The remote Windows host has a version of the McAfee Virtual Technician / ePolicy Orchestrator ActiveX control that allows execution of arbitrary code. The 'GetObject' method can be used to load any class on the underlying operating system. For example, by loading the 'WScript.Shell' class,...
Immunity Canvas: JAVA_FORNAME_GETFIELD
Name| javaforNamegetField ---|--- CVE| CVE-2012-4681 Exploit Pack| CANVAS Description| Java forName/getField Method Invocation Sandbox Bypass Notes| CVE Name: CVE-2012-4681 VENDOR: Sun Notes: There is a method invocation vulnerability using sun.awt.SunToolkit.getField This vulnerability can then ...
xt:Commerce VEYTON 4.0.15 (products_name_de) Script Insertion Vulnerability
Exploit for php platform in category web applications xt:Commerce VEYTON 4.0.15 productsnamede Script Insertion Vulnerability form name="XSS" method="POST"...
FCKeditor exploit summary-vulnerability warning-the black bar safety net
Fckeditor exploit summary View Editor Version FCKeditor/whatsnew.html ------------------------------------------------------------- 2. Version 2.2 version Apache+linux environments in the upload files back plus a. Breakthrough! Test passed...
xt:Commerce VEYTON 4.0.15 - 'products_name_de' Script Insertion
xt:Commerce VEYTON 4.0.15 productsnamede Script Insertion Vulnerability input type="hidde...
CVE-2012-1175
Integer overflow in the GnashImage::size method in libbase/GnashImage.h in GNU Gnash 0.8.10 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted SWF file, which triggers a heap-based buffer overflow...
CVE-2012-1175
Integer overflow in the GnashImage::size method in libbase/GnashImage.h in GNU Gnash 0.8.10 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted SWF file, which triggers a heap-based buffer overflow...