2270 matches found
CVE-2014-3040
CVE-2014-3040 is a CSRF vulnerability in IBM Emptoris family (Contract Management, Sourcing Portfolio, Spend Analysis). The flaw affects multiple versions across 9.5.x and 10.x, where remote authenticated users can hijack a user’s session by crafting requests that insert XSS sequences. Affected c...
CVE-2014-5196
Cross-site request forgery CSRF vulnerability in improved-user-search-in-backend.php in the backend in the Improved user search in backend plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication of administrators for requests that insert XSS sequences via the...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in improved-user-search-in-backend.php in the backend in the Improved user search in backend plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication of administrators for requests that insert XSS sequences via the...
CVE-2014-5196
Cross-site request forgery CSRF vulnerability in improved-user-search-in-backend.php in the backend in the Improved user search in backend plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication of administrators for requests that insert XSS sequences via the...
CVE-2014-5196
The CVE-2014-5196 entry details a CSRF vulnerability in the WordPress plugin Improved User Search in Backend (backend) prior to version 1.2.5. The flaw resides in the iusib_meta_fields parameter, enabling remote attackers to hijack administrator authentication by injecting XSS sequences. Affected...
Cross site request forgery (csrf)
Multiple cross-site request forgery CSRF vulnerabilities in Omeka before 2.2.1 allow remote attackers to hijack the authentication of administrators for requests that 1 add a new super user account via a request to admin/users/add, 2 insert cross-site scripting XSS sequences via the apikeylabel...
PJ CGI Neo Review Directory Traversal Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/9524/info It has been reported that PJ CGI Neo Review may be prone to a directory traversal vulnerability that may allow a remote attacker to access information outside the server root directory by using '../' character...
Netgear FM114P Wireless Firewall File Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/6807/info Netgear FM114P Wireless Firewalls allow directory traversal using escaped character sequences. It is possible for an unauthenticated user to retrieve the firewall's configuration file by escaping from the...
AN HTTPD 1.x Count.pl Directory Traversal Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/7397/info AN HTTPd contains a sample script named count.pl that may be used as a web counter. This script does not perform adequate access validation on paths containing directory traversal ../ character seqences. The...
Check Point FW-1 Syslog Daemon Unfiltered Escape Sequence Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/7161/info An issue has been discovered in Check Point FW-1 syslog daemon when attempting to process a malicious, remotely supplied, syslog message. Specifically, some messages containing escape sequences are not properly...
reget deluxe 3.0 build 121 - Directory Traversal vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/9951/info It has been reported that ReGet may be prone to a directory traversal vulnerability that may allow remote attackers to upload files to arbitrary locations on a target system. The attacker may supply encoded...
clearswift mimesweeper for web 4.0/5.0 - Directory Traversal vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/10918/info Clearswift MIMEsweeper For Web is reported prone to a directory traversal vulnerability due to insufficient sanitization of user-supplied data. To carry out an attack an attacker may specify a relative path to ...
telcondex simplewebserver 2.13.31027 build 3289 - Directory Traversal vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/8998/info It has been reported that SimpleWebserver may be prone to a directory traversal vulnerability that may allow an attacker to gain access to sensitive information. The issue presents itself due to insufficient...
GLSA-201406-18 : rxvt-unicode: User-assisted execution of arbitrary code
The remote host is affected by the vulnerability described in GLSA-201406-18 rxvt-unicode: User-assisted execution of arbitrary code rxvt-unicode does not properly handle OSC escape sequences, including those used to read and write X window properties. Impact : A remote attacker could entice a us...
openSUSE Security Update : vte/gnome-terminal (openSUSE-SU-2012:0931-1)
Add vte-CVE-2011-2198.patch: fix memory exhaustion through malicious escape sequences. Fix bnc699214, CVE-2011-2198 openSUSE 11.4 only. - Add vte-CVE-2012-2738.patch: fix potential DoS through malicious escape sequences. Fix bnc772761, CVE-2012-2738. %NASLMINLEVEL 70300 C Tenable Network...
openSUSE Security Update : poppler (openSUSE-SU-2013:1371-1)
poppler was updated to fix a security problem. PDF files could emit messages with terminal escape sequences which could be used to inject shell code if the user ran a PDF viewer from a terminal shell CVE-2012-2142. Also a bug was fixed to avoid division by zero when using origpagesizes option...
openSUSE Security Update : gnome-terminal (openSUSE-SU-2012:0933-1)
Add vte-CVE-2012-2738.patch: fix potential DoS through malicious escape sequences. Fix bnc772761, CVE-2012-2738. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2012-472. The text...
CVE-2014-0961
Cross-site request forgery CSRF vulnerability in IBM Tivoli Identity Manager ITIM 5.0 before 5.0.0.15 and 5.1 before 5.1.0.15 and IBM Security Identity Manager ISIM 6.0 before 6.0.0.2 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in IBM Tivoli Identity Manager ITIM 5.0 before 5.0.0.15 and 5.1 before 5.1.0.15 and IBM Security Identity Manager ISIM 6.0 before 6.0.0.2 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS...
CVE-2014-0961
Cross-site request forgery CSRF vulnerability in IBM Tivoli Identity Manager ITIM 5.0 before 5.0.0.15 and 5.1 before 5.1.0.15 and IBM Security Identity Manager ISIM 6.0 before 6.0.0.2 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS...