Carefully timed redirects can allow cross site scripting – Opera Security Advisories

Scripts on a page are supposed to be restricted so that they can only interact with other pages from the same domain and security context. Carefully timed redirects can cause scripts to execute in the wrong security context in Opera. This allows cross site scripting XSS...

Welcart vulnerable to cross-site scripting

Overview Welcart contains a cross-site scripting vulnerability. Welcart provided by Collne Inc. is a WordPress plugin for creating shopping websites. Welcart contains a cross-site scripting vulnerability. Yoshinori Matsumoto of Kobe Digital Lab., Inc. reported this vulnerability to IPA. JPCERT/CC...

Ruijie Application Control engine of the management server can increase user-vulnerability warning-the black bar safety net

Ruijie Application Control engine of the management server, the RG-ACE series Application Control engine of the management server V3. 1. 3 6. 0 0 1, The Official Website of the connection http://www.ruijie.com.cn/service/down-search.aspx the display is the latest version according to not authorit...

KENT-WEB ACCESS REPORT vulnerable to cross-site scripting

Overview ACCESS REPORT provided by KENT-WEB contains a cross-site scripting vulnerability. ACCESS REPORT provided by KENT-WEB is a software to analyze web access logs. ACCESS REPORT contains a cross-site scripting vulnerability. This is caused by a particular method in which tags are embedded int...

Adobe IndesignServer 5.5 SOAP Server Arbitrary Script Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'Adobe...

Adobe IndesignServer 5.5 - SOAP Server Arbitrary Script Execution (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'Adobe...

Adobe IndesignServer 5.5 SOAP Server Arbitrary Script Execution

This module abuses the "RunScript" procedure provided by the SOAP interface of Adobe InDesign Server, to execute arbitrary vbscript Windows or applescript OSX. The exploit drops the payload on the server and must be removed manually. This module requires Metasploit: https://metasploit.com/downloa...

Debian DSA-2578-1 : rssh - insufficient filtering of rsync command line

James Clawson discovered that rssh, a restricted shell for OpenSSH to be used with scp, sftp, rdist and cvs, was not correctly filtering command line options. This could be used to force the execution of a remote script and thus allow arbitrary command execution. Two CVE were assigned : -...

Error pages can be used to guess local file paths – Opera Security Advisories

Remote web pages should not be able to detect what files a user has on their local machine. Certain error pages do not apply this restriction correctly, allowing web pages to produce an error page where a script can run. The script can then use various events to detect whether files on the user’s...

Pebble vulnerable to HTTP header injection

Overview Pebble contains an HTTP header injection vulnerability. Pebble is an open source weblog system. Pebble contains an HTTP header injection vulnerability. Takahisa Kishiya reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

nginx+cgi to parse php is prone to a vulnerability-vulnerability warning-the black bar safety net

The title is a bit large, when we analyze carefully after, in fact, are generally configuration issues. If someone wants to attack the server, it will scan the machine where there is vulnerability can upload a malicious script file, the upload script is the first step, When a malicious php script...

Tokyo BBS vulnerable to cross-site scripting

Overview Tokyo BBS contains a cross-site scripting vulnerability. Tokyo BBS provided by Come on Girls Interface contains a cross-site scripting vulnerability. Naohiko Tsuda reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

MyWebSearch vulnerable to cross-site scripting

Overview MyWebSearch contains a cross-site scripting vulnerability. MyWebSearch is a CGI script for searching within a website. MyWebSearch contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update to t...

myLittleAdmin for SQL Server 2000 vulnerable to arbitrary script execution

Overview myLittleAdmin for SQL Server 2000 contains a vulnerability that may allow arbitrary script execution. myLittleAdmin for SQL server 2000 from myLittleTools is a web-based database management software.The management screen in myLittleAdmin for SQL server 2000 contains a vulnerability that...

JVN#56373673: myLittleAdmin for SQL Server 2000 vulnerable to arbitrary script execution

myLittleAdmin for SQL server 2000 from myLittleTools is a web-based database management software.The management screen in myLittleAdmin for SQL server 2000 contains a vulnerability that may allow arbitrary script execution. Impact When a user accesses a malicious database entry through the...

PHP FastCGI remote exploit-vulnerability warning-the black bar safety net

Speaking of FastCGI, we all know this is currently the most common webserver dynamic script execution model. Currently, substantially all of the web scripts are the basic support of this model, and even some type of script this is the only mode ROR, Python, etc. FastCGI's main aim is, the webserv...

CVE-2012-3486

Tunnelblick 3.3beta20 and earlier allows local users to gain privileges via an OpenVPN configuration file that specifies execution of a script upon occurrence of an OpenVPN event...

Design/Logic Flaw

Tunnelblick 3.3beta20 and earlier allows local users to gain privileges via an OpenVPN configuration file that specifies execution of a script upon occurrence of an OpenVPN event...

Sleipnir Mobile for Android vulnerable to arbitrary script execution

Overview Sleipnir Mobile for Android contains an arbitrary script execution vulnerability. Sleipnir Mobile for Android is a web browser for Android devices. Sleipnir Mobile for Android contains an arbitrary script execution vulnerability. Gaku Mochizuki of Mitsui Bussan Secure Directions, Inc...

JVN#39519659: Sleipnir Mobile for Android vulnerable to arbitrary script execution

Sleipnir Mobile for Android is a web browser for Android devices. Sleipnir Mobile for Android contains an arbitrary script execution vulnerability. Impact If a user uses a certain function of the affected product that called by other malicious Android application, an attacker may be able to execu...