Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Xythos Enterprise Document Manager XEDM before 5.0.25.8, and 6.x before 6.0.46.1, allow remote authenticated users to execute commands as arbitrary users via 1 a saved Workflow name or 2 the Content-Type HTTP header. NOTE: item 2 also...

Mac OS X Safari information leak

Saved password can be accessed from the web page via system components...

safari's saved password at risk

I'd like to inform you that safari is prone to a vunlerability that allow a local user to steal safari's saved passwords by using some macosx componenets. More infos about this issue will be made available as soon as apple will provide a fix. I strongly recommend users remove all safari's saved...

DEBIAN-CVE-2007-1893

xmlrpc xmlrpc.php in WordPress 2.1.2, and probably earlier, allows remote authenticated users with the contributor role to bypass intended access restrictions and invoke the publishposts functionality, which can be used to "publish a previously saved post."...

CVE-2007-1893

xmlrpc xmlrpc.php in WordPress 2.1.2, and probably earlier, allows remote authenticated users with the contributor role to bypass intended access restrictions and invoke the publishposts functionality, which can be used to "publish a previously saved post."...

CVE-2003-1324

Race condition in the canopen function in Elm ME+ 2.4, when installed setgid mail and the operating system lacks POSIX saved ID support, allows local users to read and modify certain files with the privileges of the mail group...

CVE-2003-1323

Elm ME+ 2.4 before PL109S, when installed setgid mail and the operating system lacks POSIX saved ID support, allows local users to read and modify certain files with the privileges of the mail group via unspecified vectors...

File(1) 4.13 - Command File_PrintF Integer Underflow

// source: https://www.securityfocus.com/bid/23021/info The file1 command is prone to an integer-underflow vulnerability because the command fails to adequately handle user-supplied data. An attacker can leverage this issue to corrupt heap memory and execute arbitrary code with the privileges of ...

Mozilla Firefox: Multiple vulnerabilities

Background Mozilla Firefox is a popular open-source web browser from the Mozilla Project. Description Tom Ferris reported a heap-based buffer overflow involving wide SVG stroke widths that affects Mozilla Firefox 2 only. Various researchers reported some errors in the JavaScript engine potentiall...

CVE-2007-0852

Cross-site scripting XSS vulnerability in DevTrack 6.x allows remote attackers to inject arbitrary web script or HTML via the "Keyword search" form field and unspecified other form fields that populate a public saved query. NOTE: the provenance of this information is unknown; the details are...

CVE-2007-0852

Cross-site scripting XSS vulnerability in DevTrack 6.x allows remote attackers to inject arbitrary web script or HTML via the "Keyword search" form field and unspecified other form fields that populate a public saved query. NOTE: the provenance of this information is unknown; the details are...

[Full-disclosure] Computer Terrorism (UK) :: Incident Response Centre - Microsoft Outlook Vulnerability

Computer Terrorism UK :: Incident Response Centre www.computerterrorism.com Security Advisory: CT09-01-2007 ======================================================= Microsoft Outlook Advanced Find - Remote Code Execution ======================================================= Advisory Date: 11th...

CVE-2007-0034

Buffer overflow in the Advanced Search Finder.exe feature of Microsoft Outlook 2000, 2002, and 2003 allows user-assisted remote attackers to execute arbitrary code via a crafted Outlook Saved Searches OSS file that triggers memory corruption, aka "Microsoft Outlook Advanced Find Vulnerability."...

Microsoft Outlook fails to properly parse Office Saved Searches (.oss) files

Overview A vulnerability exists in the way Microsoft Outlook handles Office Saved Searches .oss. This vulnerability may allow a remote attacker to execute arbitrary code. Description Office Saved Searches .oss contain views of e-mail items that satisfy previous search criteria.Microsoft Outlook...

PT-2004-3547 · Mozilla · Firefox

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions 1.5.0.1 and possibly other versions Description: The issue allows local users who share a Windows profile to view records of user activity after a new installation of Firefox, even if the previous installation was...

CVE-2003-1323

Elm ME+ 2.4 before PL109S, when installed setgid mail and the operating system lacks POSIX saved ID support, allows local users to read and modify certain files with the privileges of the mail group via unspecified vectors...

PivX Advisory MK002B H&R Block TaxCut Information Disclosure Vulnerability

Mike Kristovich, PivX Security Advisory MK002B Date: January 10, 2003 Application: H&R Block Tax Cut Version: All versions up to current. Bug: Information in saved Tax Returns discloses Social Security Number, Full Information, and more.. Risk: Can allow for identity theft, information disclosure...

Microsoft Internet Explorer saved references and identifiers crossite scripting

By saving location.assign method of parent window it's possible to access it content any time. It's also possible to reference frame by it's identifier...

Trillian Instant Messaging 0.x - Credential Encryption

// source: https://www.securityfocus.com/bid/5677/info The Trillian instant messaging client uses weak encryption to store saved authentication credentials for instant messaging services. The credentials are encrypted by using XOR with a static key that is used with every installation of the...

Linux kernel setgid implementation flaw

Hi, I believe the following to be accurate and of some interest to bugtraq readers, although i did not have time to extensively test it, nor did i warn the vendor, since 1 this is at most a undirect risk - IMHO - and 2 i am going on holidays so i had to balance betweeen disclosing now and letting...