CVE-2008-5323

Cross-site scripting XSS vulnerability in index.php in Wysi Wiki Wyg 1.0 allows remote attackers to inject arbitrary web script or HTML via the s parameter...

CVE-2008-5323: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in Wysi Wiki Wyg 1.0 allows remote attackers to inject arbitrary web script or HTML via the s parameter...

Important: Red Hat Security Advisory: kernel security and bug fix update

Updated kernel packages that resolve several security issues and fix various bugs are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any...

dedecms fill out a tasteless vulnerability-vulnerability warning-the black bar safety net

Author: Ice the origin of theL. S. T&0. S. T Just look at the small handsome gay blog found above also describes a About dedecms a 0day（http://www. xssor. cn/sa/? action=show&id=5 A 8, but this bug and a few months ago that write directly to the file in the vulnerability If is not a file, I...

CVE-2008-4671: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in wp-admin/wp-blogs.php in Wordpress MU WPMU before 2.6 allows remote attackers to inject arbitrary web script or HTML via the 1 s and 2 ipaddress parameters...

CVE-2008-4491

Apple Mail.app 3.5 on Mac OS X, when "Store draft messages on the server" is enabled, stores draft copies of S/MIME email in plaintext on the email server, which allows server owners and remote man-in-the-middle attackers to read sensitive mail...

Code injection

Apple Mail.app 3.5 on Mac OS X, when "Store draft messages on the server" is enabled, stores draft copies of S/MIME email in plaintext on the email server, which allows server owners and remote man-in-the-middle attackers to read sensitive mail...

CVE-2008-4491

Apple Mail.app 3.5 on Mac OS X, when "Store draft messages on the server" is enabled, stores draft copies of S/MIME email in plaintext on the email server, which allows server owners and remote man-in-the-middle attackers to read sensitive mail...

CVE-2008-4491

CVE-2008-4491 affects Apple Mail.app 3.5 on Mac OS X. When “Store draft messages on the server” is enabled, draft copies of S/MIME mail are stored in plaintext on the mail server, allowing server admins and remote MITM attackers to read sensitive mail. The provided documents do not include exploi...

CVE-2008-4491: Exposure of Sensitive Information to an Unauthorized Actor

Apple Mail.app 3.5 on Mac OS X, when "Store draft messages on the server" is enabled, stores draft copies of S/MIME email in plaintext on the email server, which allows server owners and remote man-in-the-middle attackers to read sensitive mail...

[ENABLESECURITY] Apple's Mail.app stores your S/MIME encrypted emails in clear text

Just published the below advisory describing an issue with Mail.app and a solution. I comment on the flaw on my blog: http://enablesecurity.com/2008/10/03/apple-mailapp-security-advisory/ An up to date version of the advisory can be found:...

CVE-2008-4424: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in Domain Group Network GooCMS 1.02 allows remote attackers to inject arbitrary web script or HTML via the s parameter in a comments action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

Postfix 2.4.92.5.52.6-20080902 - .forward Local Denial of Service

Postfix 2.4.92.5.52.6-20080902 - .forward Local Denial of Service / http://www.wekk.net/research/CVE-2008-4042/CVE-2008-4042-exploit.c http://www.wekk.net/research/CVE-2008-3889/CVE-2008-3889-exploit.c Exploit for Postfix 2.4 before 2.4.9, 2.5 before 2.5.5, and 2.6 before 2.6-20080902, when used...

[SECURITY] Fedora 9 Update: R-2.7.2-1.fc9

A language and environment for statistical computing and graphics. R is similar to the award-winning S system, which was developed at Bell Laboratories by John Chambers et al. It provides a wide variety of statistical and graphical techniques linear and nonlinear modelling, statistical tests, tim...

Unfixed XSS vulnerability at www.i-s-i-s.com

Security researcher JoCk3r, has submitted on 25/08/2008 a cross-site-scripting XSS vulnerability affecting www.i-s-i-s.com, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 31/08/2008. It is currently...

CA kmxfw.sys Code Execution and DoS Vulnerabilities

CA Products are prone to local code execution and denial of service DoS vulnerabilities. SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Low: Red Hat Security Advisory: Red Hat Network Satellite Server IBM Java Runtime security update

Red Hat Network Satellite Server version 5.1.1 is now available. This update includes fixes for a number of security issues in the Red Hat Network Satellite Server IBM Java Runtime Environment for IBM S/390 and IBM System z architectures. This update has been rated as having low security impact b...

Afuse afuse.c文件Shell命令注入漏洞

BUGTRAQ ID: 30245 CVECAN ID: CVE-2008-2232 Afuse是使用FUSE在用户域实现的自动加载文件系统。 Afuse没有正确地过滤文件名便将其用在了system调用中。如果能够读访问afuse文件系统的攻击者使用了类似于以下的路径的话： /path/";arbitrary command;" /path/arbitrary command 则从注册为Afuse加载的目录请求上述特制文件就会导致以提升的权限执行任意命令。 Jacob Bower Afuse 0.2 Debian ------...

S/Key和OPIE数据库漏洞

在使用S/Key或OPIE认证的服务器上存在一个安全漏洞。这个漏洞允许本地用户获得对S/Key或OPIE数据库的访问权。 S/Key是使用一次性口令技术的认证机制。系统管理员可以进行配置，使用户能够通过S/Key认证访问使用login8的任何服务，如Telnet和FTP。制定认证类型的配置文件是/etc/login.conf。 为了配置一个用户能够使用S/Key，管理员或该用户（如果程序是suid root）首先必须使用skeyinit（或keyinit）程序。这个程序初始化S/Key数据库（/etc/skeykeys）中的用户入口项。这个数据库文件包含输入S/Key口令时需要比较的信息...

CVE-2008-3068

Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List CRL checks by using an arbitrary URL from a certificate embedded in a 1 S/MIME e-mail message or 2 signed document, which allows remote attackers to obtai...