UBUNTU-CVE-2017-3135

Under some conditions when using both DNS64 and RPZ to rewrite query responses, query processing can resume in an inconsistent state leading to either an INSIST assertion failure or an attempt to read through a NULL pointer. Affects BIND 9.8.8, 9.9.3-S1 - 9.9.9-S7, 9.9.3 - 9.9.9-P5, 9.9.10b1,...

Microsoft Windows - GDI+ EMR_EXTTEXTOUTA / EMR_POLYTEXTOUTA Heap Buffer Overflow (MS16-097)

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=828 The Microsoft GDI+ implementation of the EMF format supports records corresponding to the ExtTextOutA and PolyTextOutA API functions. Both CEmfPlusEnumState::ExtTextOutA and CEmfPlusEnumState::PolyTextOutA handlers suffer from ...

[SECURITY] Fedora 23 Update: lighttpd-1.4.41-1.fc23

Secure, fast, compliant and very flexible web-server which has been optimiz ed for high-performance environments. It has a very low memory footprint compa red to other webservers and takes care of cpu-load. Its advanced feature-set FastCGI, CGI, Auth, Output-Compression, URL-Rewriting and many mo...

Gratipay: PHP 5.4.45 is Outdated and Full of Preformance Interupting Arbitrary Code Execution Bugs

Your PHP version is affected by quite a few remote arbitrary code execution, remote file renaming, and remote file rewriting bugs that require no authentication and can cause big problems, from performance interruptions and messing with server files to DoS attacks. These are not related to any...

[SECURITY] Fedora 21 Update: lighttpd-1.4.36-1.fc21

Secure, fast, compliant and very flexible web-server which has been optimiz ed for high-performance environments. It has a very low memory footprint compa red to other webservers and takes care of cpu-load. Its advanced feature-set FastCGI, CGI, Auth, Output-Compression, URL-Rewriting and many mo...

CVE-2014-6167

Cross-site scripting XSS vulnerability in the URL rewriting feature in IBM WebSphere Application Server 7.x before 7.0.0.37, 8.0.x before 8.0.0.10, and 8.5.x before 8.5.5.4 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

Cross site scripting

Cross-site scripting XSS vulnerability in the URL rewriting feature in IBM WebSphere Application Server 7.x before 7.0.0.37, 8.0.x before 8.0.0.10, and 8.5.x before 8.5.5.4 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-6167

Cross-site scripting XSS vulnerability in the URL rewriting feature in IBM WebSphere Application Server 7.x before 7.0.0.37, 8.0.x before 8.0.0.10, and 8.5.x before 8.5.5.4 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

Ixprim CMS 1.2 - Remote Blind SQL Injection Exploit

No description provided by source. !/usr/bin/perl INFORMATIONS ============ Affected.scr..: Ixprim 1.2 Poc.ID........: 16061221 Type..........: Blind SQL Injection Risk.level....: Medium Conditions....: loadfile privilege ixp code only Src.download..: www.ixprim-cms.org Poc.link......:...

PHP Event Calendar <= 1.5 - Multiple Vulnerabilities

No description provided by source. Title: PHP Event Calendar = v1.5 Multiple Vulnerabilities Author: cp77fk4r | Empty0pagESHIFT+2gmail.com | www.DigitalWhisper.co.il Software Link: http://www.softcomplex.com/download.html Version: = v1.5 Tested on: Apache2+PHP5 on Win32 Cross Site Scripting...

PBLang <= 4.99.17.q Remote File Rewriting / Command Execution

No description provided by source. --------------------------------------------------------------- / | |\ \ / | / |/ | | |/ \ | | / \ \ | \ \ | | | \ | |/ \ | | // | || | ||| /| / /\ | |||| /| / / --------------------------------------------------------------- Http://www.inj3ct-it.org...

openSUSE Security Update : icedtea-web (openSUSE-SU-2011:0706-1)

Icedtea as included in java-160-openjdk was updated to fix several security issues : - S6213702, CVE-2011-0872: so non-blocking sockets with TCP urgent disabled get still selected for read ops win - S6618658, CVE-2011-0865: Vulnerability in deserialization - S7012520, CVE-2011-0815: Heap overflow...

tomcat: session fixation still possible with disableURLRewriting enabled

It was found that previous fixes in Tomcat 6 to path parameter handling introduced a regression that caused Tomcat to not properly disable URL rewriting to track session IDs when the disableURLRewriting option was enabled. A man-in-the-middle attacker could potentially use this flaw to hijack a...

tomcat: session fixation still possible with disableURLRewriting enabled

It was found that previous fixes in Tomcat 6 to path parameter handling introduced a regression that caused Tomcat to not properly disable URL rewriting to track session IDs when the disableURLRewriting option was enabled. A man-in-the-middle attacker could potentially use this flaw to hijack a...

Fedora Update for lighttpd FEDORA-2014-3887

Check for the Version of lighttpd OpenVAS Vulnerability Test Fedora Update for lighttpd FEDORA-2014-3887 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

CVE-2014-0033

org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct session fixation attacks via a crafted URL...

CVE-2014-0033

CVE-2014-0033 affects Apache Tomcat 6.0.33–6.0.37, where the disableURLRewriting setting is not honored when a session ID is in a URL. This could allow remote attackers to hijack a valid user’s session via a crafted link. The vulnerability is documented in IBM advisories and the GHSA entry, which...

UBUNTU-CVE-2014-0033

org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct session fixation attacks via a crafted URL...

CVE-2013-6956

CVE-2013-6956 affects Juniper Junos Pulse Secure Access Service (IVE OS) when the web rewriting feature is enabled. The issue is a cross-site scripting vulnerability in the web rewrite pages, exploitable by remote authenticated users to inject arbitrary script or HTML. Affected IVE OS versions in...

Oracle Linux 5 : java-1.6.0-openjdk (ELSA-2011-0857)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0857 advisory. - RH706250, S6213702, CVE-2011-0872: so non-blocking sockets with TCP urgent disabled get still selected for read ops win - RH706106, S6618658,...