RHEL 4 : autofs5 (RHSA-2007:1177)

Updated autofs5 technology preview packages that fix a security issue are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. The autofs utility controls the operation of the automount daemon, which...

Cross site scripting

Unspecified vulnerability in the benchmark reporting system in Google Web Toolkit GWT before 1.4.61 has unknown impact and attack vectors, possibly related to cross-site scripting XSS...

CVE-2007-6452

Unspecified vulnerability in the benchmark reporting system in Google Web Toolkit GWT before 1.4.61 has unknown impact and attack vectors, possibly related to cross-site scripting XSS...

CVE-2007-6452

Unspecified vulnerability in the benchmark reporting system in Google Web Toolkit GWT before 1.4.61 has unknown impact and attack vectors, possibly related to cross-site scripting XSS...

CVE-2007-6452: Improper Neutralization of Input During Web Page Generation

Unspecified vulnerability in the benchmark reporting system in Google Web Toolkit GWT before 1.4.61 has unknown impact and attack vectors, possibly related to cross-site scripting XSS...

CVE-2007-6452

Unspecified vulnerability in the benchmark reporting system in Google Web Toolkit GWT before 1.4.61 has unknown impact and attack vectors, possibly related to cross-site scripting XSS...

Cross site scripting

Cross-site scripting XSS vulnerability in the logon page in Web Reporting Tools portal in Websense Enterprise and Web Security Suite 6.3 allows remote attackers to inject arbitrary web script or HTML via the username field...

CVE-2007-6312

Cross-site scripting XSS vulnerability in the logon page in Web Reporting Tools portal in Websense Enterprise and Web Security Suite 6.3 allows remote attackers to inject arbitrary web script or HTML via the username field...

CVE-2007-6312

CVE-2007-6312 is an XSS vulnerability in the login page of Websense’s Web Reporting Tools portal (Websense Enterprise/Web Security Suite 6.3). The issue arises because the username field is not properly sanitized, allowing remote attackers to inject arbitrary script or HTML via that input. Affect...

Websense Reporting Tools WsCgiLogin.exe username Parameter XSS

The remote host is running Websense, a commercial suite of web filtering products. The remote instance of Websense fails to sanitize user input to the 'UserName' parameter of the 'Websense/cgi-bin/WsCgiLogin.exe' script before using it to generate dynamic content. An unauthenticated remote attack...

runcms-overwrite.txt

RunCmss Bug Yahoo! Crawler body font-size: 10px; font-family: verdana; INPUT BORDER-TOP-WIDTH: 1px; FONT-WEIGHT: bold; BORDER-LEFT-WIDTH: 1px; FONT-SIZE: 10px; BORDER-LEFT-COLOR: D50428; BACKGROUND: 590009; BORDER-BOTTOM-WIDTH: 1px; BORDER-BOTTOM-COLOR: D50428; COLOR: 00ff00; BORDER-TOP-COLOR:...

Ubuntu 6.06 LTS / 6.10 / 7.04 : moin vulnerabilities (USN-458-1)

A flaw was discovered in MoinMoin's error reporting when using the AttachFile action. By tricking a user into viewing a crafted MoinMoin URL, an attacker could execute arbitrary JavaScript as the current MoinMoin user, possibly exposing the user's authentication information for the domain where...

Ubuntu 5.10 : mysql-dfsg-4.1 vulnerability (USN-321-1)

Jean-David Maillefer discovered a format string bug in the dateformat function's error reporting. By calling the function with invalid arguments, an authenticated user could exploit this to crash the server. Note that Tenable Network Security has extracted the preceding description block directly...

CVE-2004-2748

The vulnerability CVE-2004-2748 affects NetIQ WebTrends Reporting Center Enterprise Edition 6.1a, specifically viewreport.pl. The root cause is an invalid profileid parameter that causes an error message to leak the installation pathname, enabling remote attackers to determine the installation pa...

CVE-2004-2748

viewreport.pl in NetIQ WebTrends Reporting Center Enterprise Edition 6.1a allows remote attackers to determine the installation path via an invalid profileid parameter, which leaks the pathname in an error message...

CVE-2004-2748: Exposure of Sensitive Information to an Unauthorized Actor

viewreport.pl in NetIQ WebTrends Reporting Center Enterprise Edition 6.1a allows remote attackers to determine the installation path via an invalid profileid parameter, which leaks the pathname in an error message...

[Full-disclosure] Local Privilege Escalation in Norton AntiVirus for Mac

Text from URL: http://blog.carrel.org/2007/11/security-advisory-norton-antivirus-for.html == Synopsis == Symantec's Norton AntiVirus for Macintosh NAV contains a vulnerability that can lead to local privilege escalation from group admin to root the super-user without any of the usual password...

HP-UX Security Patch : PHSS_28587

X OV NNM6.2 Reporting e-mail fails with qmail %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if !definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid26665; scriptversion"1.9"; scriptsetattributeattribute:"pluginmodificationdate",...

jdk/jre -- Applet Caching May Allow Network Access Restrictions to be Circumvented

SUN reports: A vulnerability in the Java Runtime Environment JRE with applet caching may allow an untrusted applet that is downloaded from a malicious website to make network connections to network services on machines other than the one that the applet was downloaded from. This may allow network...

nfs-utils-lib NFSv4 user id mapping flaw

The NFSv4 ID mapper nfsidmap before 0.17 does not properly handle return values from the getpwnamr function when performing a username lookup, which can cause it to report a file as being owned by "root" instead of "nobody" if the file exists on the server but not on the client...