3445 matches found
Gzip Memory Bomb Denial Of Service
This module generates and hosts a 10MB single-round gzip file that decompresses to 10GB. Many applications will not implement a length limit check and will eat up all memory and eventually die. This can also be used to kill systems that download/parse content from a user-provided URL...
Novell Client 2 SP3 nicm.sys Local Privilege Escalation
This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex' require 'msf/core/post/common' require...
PT-2013-3905 · Red Hat +1 · Red Hat +1
Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The issue is related to a security problem, but specific details are not provided. Recommendations: At the moment, there is no information about...
PT-2013-4300 · Red Hat +1 · Red Hat +1
Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: General information about the issue is not provided. Recommendations: At the moment, there is no information about a newer version that contains...
JVN#69880570: Opera address bar spoofing vulnerability
Opera contains a vulnerability where certain characters may be displayed in the address bar, causing 2 URLs to potentially be indistinguishable from each other. Impact Phishing attacks may be possible, due to the difficulty in determining that the URL displayed in the address bar and the URL bein...
Joomla 1.5.26 ja_purity Cross Site Scripting
waraxe-2012-SA087 - Reflected XSS in Joomla 1.5.26 "japurity" template =============================================================================== Author: Janek Vind "waraxe" Date: 03. May 2012 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-87.html CVE:...
JVN#41657660: Safari for iOS vulnerable to cross-site scripting
Safari for iOS provided by Apple does not support the "attachment" value for the HTTP Content-Disposition header, resulting in a cross-site scripting vulnerability. Impact Opening a maliciously crafted file may lead to an arbitrary script being executed on the user's web browser. Solution Update...
Fedora 13 : whatsup-1.12-1.fc13 (2011-2794)
Mon Mar 7 2011 Ruben Kerkhof 1.12-1 - Upstream released new version - Link against system-provided expat 652981 - Fixes FTBFS 661001 - Drop patch for incorrect open which was merged upstream - no InfiniBand on s390x Note that Tenable Network Security has extracted the preceding description block...
Fedora 14 : whatsup-1.12-1.fc14 (2011-2801)
Mon Mar 7 2011 Ruben Kerkhof 1.12-1 - Upstream released new version - Link against system-provided expat 652981 - Fixes FTBFS 661001 - Drop patch for incorrect open which was merged upstream - Thu Sep 30 2010 Dan Horak 1.10-2 - no InfiniBand on s390x Note that Tenable Network Security has...
Linux RDS Protocol Local Privilege Escalation
Exploit for linux platform in category local exploits ============================================= Linux RDS Protocol Local Privilege Escalation ============================================= / Linux Kernel Copyright 2010 Virtual Security Research, LLC The handling functions for sending and...
[SECURITY] [DSA 2088-1] New wget packages fix potential code execution
------------------------------------------------------------------------ Debian Security Advisory DSA-2088-1 [email protected] http://www.debian.org/security/ Florian Weimer August 05, 2010 http://www.debian.org/security/faq -...
SA-CONTRIB 2010-075 - Tagging - Cross Site Scripting
The Tagging module provides an alternative input widget and other features for taxonomy terms. The module does not properly escape user-provided content submitted to free-tagging vocabularies displayed on node previews, leading to a Cross Site Scripting XSS vulnerability. Any user with permission...
XSS in page renderer
An XSS vulnerability has been identified in the page renderer. This issue provides a fix for this problem. The severity of this issue is rated HIGH. Please see http://confluence.atlassian.com/x/ZILmD for other security related issues as well as more information on how we rate issues...
XSS in page renderer
An XSS vulnerability has been identified in the page renderer. This issue provides a fix for this problem. The severity of this issue is rated HIGH. Please see http://confluence.atlassian.com/x/ZILmD for other security related issues as well as more information on how we rate issues...
JVN#60969543 HL-SiteManager vulnerable to SQL injection
HL-SiteManager from Heartlogic is a contents management system CMS software. HL-SiteManager contains a SQL injection vulnerability. Impact A remote attacker may view or modify information stored by the product. Solution Do not use HL-SiteManager As patches will not be provided, users are...
CVE-2010-0736
Cross-site scripting XSS vulnerability in the viewqueryform function in lib/viewvc.py in ViewVC before 1.0.10, and 1.1.x before 1.1.4, allows remote attackers to inject arbitrary web script or HTML via "user-provided input."...
CVE-2010-0736
Removed by vendor...
Debian DSA-1979-1 : lintian - multiple vulnerabilities
Multiple vulnerabilities have been discovered in lintian, a Debian package checker. The following Common Vulnerabilities and Exposures project ids have been assigned to identify them : - CVE-2009-4013: missing control files sanitation Control field names and values were not sanitised before using...
CVE-2010-0349
CVE-2010-0349 concerns the WebCalenderC3 web calendar from C3 Corp. A cross-site scripting (XSS) flaw exists in WebCalenderC3 v0.32 and earlier, with the vendor unable to reproduce it but a patch/security-enhanced version was released. The vulnerability may allow arbitrary script execution in a u...