5662 matches found
Mandrake Security Advisory MDVSA-2009:235 (silc-toolkit)
The remote host is missing an update to silc-toolkit announced via advisory MDVSA-2009:235. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...
Cross site scripting
Cross-site scripting XSS vulnerability in system/admin.php in RunCMS 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the ranktitle parameter in a RankForumAdd action...
CVE-2008-7235
CVE-2008-7235 affects Oracle Forms in Oracle Application Server 10.1.2.2 and E-Business Suite 12.0.3. The vulnerability is described as unspecified, with remote attackers able to affect integrity via unknown vectors (aka AS04). The connected records confirm the affected stack but Do not provide c...
CVE-2009-3076
Mozilla Firefox before 3.0.14 does not properly implement certain dialogs associated with the 1 pkcs11.addmodule and 2 pkcs11.deletemodule operations, which makes it easier for remote attackers to trick a user into installing or removing an arbitrary PKCS11 module...
CVE-2009-3078
CVE-2009-3078 affects Mozilla Firefox: visual truncation allows spoofing the address bar by using Unicode with tall line-height, enabling a remote attacker to hide/alter URL display. Affected versions are Firefox before 3.0.14 and 3.5.x before 3.5.3; fixes exist in Firefox 3.0.14 and 3.5.3. Multi...
CVE-2007-6730
Multiple cross-site request forgery CSRF vulnerabilities in the web management interface in the ZyXEL P-330W router allow remote attackers to hijack the authentication of administrators for requests that 1 enable remote router management via goform/formRmtMgt or 2 modify the administrator passwor...
Design/Logic Flaw
Multiple unspecified vulnerabilities in HP Performance Insight 5.3 allow remote attackers to have an unknown impact, related to 1 a "Remote exploit" on Windows platforms, and 2 a "Remote preauthentication exploit" on the Windows Server 2003 SP2 platform, as demonstrated by certain modules in...
CVE-2009-3096
Multiple unspecified vulnerabilities in HP Performance Insight 5.3 allow remote attackers to have an unknown impact, related to 1 a "Remote exploit" on Windows platforms, and 2 a "Remote preauthentication exploit" on the Windows Server 2003 SP2 platform, as demonstrated by certain modules in...
Code injection
Cisco Unified Communications Manager aka CUCM, formerly CallManager 4.x, 5.x before 5.13g, 6.x before 6.14, 7.0 before 7.02asu1, and 7.1 before 7.12 allows remote attackers to cause a denial of service file-descriptor exhaustion and SCCP outage via a flood of TCP packets, aka Bug ID CSCsx32236...
CVE-2008-7092
CVE-2008-7092 affects Unica Affinium Campaign 7.2.1.0.55. The connected records confirm multiple cross-site scripting (XSS) vulnerabilities where arbitrary web script/HTML can be injected via parameters such as url, PageName, title (CustomBookMarkLink action), displayIcon (updateOfferTemplateSubm...
Cross site request forgery (csrf)
Web Management Console Cross-site request forgery CSRF vulnerability in the web management console in F5 BIG-IP 9.4.3 allows remote attackers to hijack the authentication of administrators for requests that create new administrators and execute shell commands, as demonstrated using...
CVE-2009-2854
Wordpress before 2.8.3 does not check capabilities for certain actions, which allows remote attackers to make unauthorized edits or additions via a direct request to 1 edit-comments.php, 2 edit-pages.php, 3 edit.php, 4 edit-category-form.php, 5 edit-link-category-form.php, 6 edit-tag-form.php, 7...
CVE-2008-6996
CVE-2008-6996 affects Google Chrome BETA 0.2.149.27. The vulnerability is that Chrome does not prompt the user before saving an executable file, potentially enabling a remote attacker or malware to cause disk-based DoS or exploit other vulnerabilities via a URL referencing an executable (possibly...
CVE-2009-2026
Stack-based buffer overflow in a token searching function in the dtscore library in Data Transport Services in CA Software Delivery r11.2 C1, C2, C3, and SP4; Unicenter Software Delivery 4.0 C3; CA Advantage Data Transport 3.0 C1; and CA IT Client Manager r12 allows remote attackers to execute...
CVE-2008-6909
CVE-2008-6909 concerns a Drupal Services module issue where versions 5.x before 5.x-0.92 and 6.x before 6.x-0.13 do not sign all required data in requests. The available documents consistently describe an unspecified impact and suggest a risk of man-in-the-middle modification of data, potentially...
CVE-2009-2412
Multiple integer overflows in the Apache Portable Runtime APR library and the Apache Portable Utility library aka APR-util 0.9.x and 1.3.x allow remote attackers to cause a denial of service application crash or possibly execute arbitrary code via vectors that trigger crafted calls to the 1...
CVE-2009-2493
The Active Template Library ATL in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not properly...
openSUSE Security Update : libsnmp15 (libsnmp15-319)
Remote attackers could crash net-snmp via GETBULK-Request CVE-2008-4309. In addition the following non-security issues have been fixed : - typo in error message bnc439857 - fix duplicate registration warnings on startup bnc326957 - container insert errors reproducable with shared ip setups...
CVE-2009-1892
dhcpd in ISC DHCP 3.0.4 and 3.1.1, when the dhcp-client-identifier and hardware ethernet configuration settings are both used, allows remote attackers to cause a denial of service daemon crash via unspecified requests...