Cross site scripting

Cross-site scripting XSS vulnerability in Apache Struts before 1.2.9-162.31.1 on SUSE Linux Enterprise SLE 11, before 1.2.9-108.2 on SUSE openSUSE 10.3, before 1.2.9-198.2 on SUSE openSUSE 11.0, and before 1.2.9-162.163.2 on SUSE openSUSE 11.1 allows remote attackers to inject arbitrary web scrip...

CVE-2008-2025: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Apache Struts before 1.2.9-162.31.1 on SUSE Linux Enterprise SLE 11, before 1.2.9-108.2 on SUSE openSUSE 10.3, before 1.2.9-198.2 on SUSE openSUSE 11.0, and before 1.2.9-162.163.2 on SUSE openSUSE 11.1 allows remote attackers to inject arbitrary web scrip...

SuSE Update for yast2-backup SUSE-SA:2008:054

Check for the Version of yast2-backup OpenVAS Vulnerability Test $Id: gbsuse2008054.nasl 8050 2017-12-08 09:34:29Z santu $ SuSE Update for yast2-backup SUSE-SA:2008:054 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is fr...

openSUSE 10 Security Update : moodle (moodle-5938)

Insufficient quoting of wiki page titles allowed attackers to conduct cross site scripting XSS attacks CVE-2008-5432 . %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update moodle-5938. The text...

vim security update

6.3.046-1.el47.5z - remove duplicate vimtutor manpage 6.3.046-1.el47.4z - fix netrw 6.3.046-1.el47.3z - add fix for CVE-2008-4101 6.3.046-1.el46.2z - don't add empty line when editing files with netrw 6.3.046-1.el46.1z - fix erroneous quoting in CVE-2008-2712 patch 6.3.046-1.el46.z - add fix for...

vim-exec.txt

Summary Product : Vim -- Vi IMproved Version : Tested with 7.1.314 and 6.4 Impact : Arbitrary code execution Wherefrom: Local and remote Original : http://www.rdancer.org/vulnerablevim.html Improper quoting in some parts of Vim written in the Vim Script can lead to arbitrary code execution upon...

vim -- Vim Shell Command Injection Vulnerabilities

Rdancer.org reports: Improper quoting in some parts of Vim written in the Vim Script can lead to arbitrary code execution upon opening a crafted file...

PHP Toolkit: Data disclosure and Denial of service

Background PHP Toolkit is a utility to manage parallel installations of PHP within Gentoo. It is executed by the PHP ebuilds at setup. Description Toni Arnold, David Sveningsson, Michal Bartoszkiewicz, and Joseph reported that php-select does not quote parameters passed to the "tr" command, which...

Design/Logic Flaw

Multiple unspecified vulnerabilities in Oracle E-Business Suite 12.0.2 have unknown impact and attack vectors related to 1 Public Sector Human Resources APP03 and 2 Quoting component APP06...

CVE-2007-5528

CVE-2007-5528 is linked to concrete details in related records: Oracle E-Business Suite 11/12 vulnerabilites (notably CVE-2007-5766) describe an SQL injection in okxLOV.jsp for 11 and 12, enabling remote execution of arbitrary SQL via unknown vectors. The 12.0.2 entry mentions unknown impact/atta...

CVE-2007-5528

Multiple unspecified vulnerabilities in Oracle E-Business Suite 12.0.2 have unknown impact and attack vectors related to 1 Public Sector Human Resources APP03 and 2 Quoting component APP06...

openSUSE 10 Security Update : OpenOffice_org (OpenOffice_org-2652)

Following security problems were fixed in OpenOfficeorg : CVE-2007-0002: Various problems were fixed in the Wordperfect converter library libwpd in OpenOfficeorg which could be used by remote attackers to potentially execute code or crash OpenOfficeorg. CVE-2007-0238: A stack overflow in the...

CVE-2007-5528: Undefined Security Weakness

Multiple unspecified vulnerabilities in Oracle E-Business Suite 12.0.2 have unknown impact and attack vectors related to 1 Public Sector Human Resources APP03 and 2 Quoting component APP06...

CVE-2007-0849

scripts/cronscript.php in SysCP 1.2.15 and earlier does not properly quote pathnames in user home directories, which allows local users to gain privileges by placing shell metacharacters in a directory name, and then using the control panel to protect this directory, a different vulnerability tha...

CVE-2006-6979

The ruby handlers in the Magnatune component in Amarok do not properly quote text in certain contexts, probably including construction of an unzip command line, which allows attackers to execute arbitrary commands via shell metacharacters...

Debian DSA-1220-1 : pstotext - insecure file name quoting

Brian May discovered that pstotext, a utility to extract plain text from Postscript and PDF files, performs insufficient quoting of file names, which allows execution of arbitrary shell commands. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

DSA-1220 pstotext

Bulletin has no description...

[SECURITY] [DSA 1220-1] New pstotext packages fix arbitrary shell command execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 1220-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff November 26th, 2006 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1220-1] New pstotext packages fix arbitrary shell command execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 1220-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff November 26th, 2006 http://www.debian.org/security/faq -...

gmc, mc, mcserv security update

CentOS Errata and Security Advisory CESA-2005:512-01 Updated mc packages that fix several security issues are now available for Red Hat Enterprise Linux 2.1. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Midnight Commander is a visual shell...