2450 matches found
Qemu VT100 emulation vulnerability
ISSUE DESCRIPTION The device model used by fully virtualised HVM domains, qemu, does not properly handle escape VT100 sequences when emulating certain devices with a virtual console backend. IMPACT An attacker who has sufficient privilege to access a vulnerable device within a guest can overwrite...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in e107admin/usersextended.php in e107 before 0.7.26 allows remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting XSS sequences via the userinclude parameter...
DEBIAN-CVE-2012-2104
cgi-bin/munin-cgi-graph in Munin 2.x writes data to a log file without sanitizing non-printable characters, which might allow user-assisted remote attackers to inject terminal emulator escape sequences and execute arbitrary commands or delete arbitrary files via a crafted HTTP request...
CVE-2012-2104
cgi-bin/munin-cgi-graph in Munin 2.x writes data to a log file without sanitizing non-printable characters, which might allow user-assisted remote attackers to inject terminal emulator escape sequences and execute arbitrary commands or delete arbitrary files via a crafted HTTP request...
CVE-2012-2104
cgi-bin/munin-cgi-graph in Munin 2.x writes data to a log file without sanitizing non-printable characters, which might allow user-assisted remote attackers to inject terminal emulator escape sequences and execute arbitrary commands or delete arbitrary files via a crafted HTTP request...
CVE-2012-3867
lib/puppet/ssl/certificateauthority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request CSR, which makes it easier for user-assisted remote attackers to trick...
DEBIAN-CVE-2012-3867
lib/puppet/ssl/certificateauthority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request CSR, which makes it easier for user-assisted remote attackers to trick...
Design/Logic Flaw
lib/puppet/ssl/certificateauthority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request CSR, which makes it easier for user-assisted remote attackers to trick...
CVE-2012-3867
CVE-2012-3867 affects Puppet modules where CSR Common Name validation is lax in Puppet before 2.6.17 and in 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2. This allows user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequenc...
CVE-2012-3867
Removed by vendor...
Small windows can be used in several ways to trick users into executing downloads – Opera Security Advisories
When the download dialog is displayed, it should always be visible to the user, to ensure that the user realizes it is there. If the dialog is displayed in a small enough window, the user may not realize it is being displayed, and if the right keyboard sequence is carefully followed, they can end...
Scientific Linux Security Update : xterm on SL3.x, SL4.x, SL5.x i386/x86_64
A flaw was found in the xterm handling of Device Control Request Status String DECRQSS escape sequences. An attacker could create a malicious text file or log entry, if unfiltered that could run arbitrary commands if read by a victim inside an xterm window. CVE-2008-2383 %NASLMINLEVEL 70300 C...
CentOS Update for ruby CESA-2011:0909 centos5 x86_64
Check for the Version of ruby OpenVAS Vulnerability Test CentOS Update for ruby CESA-2011:0909 centos5 x8664 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under...
CVE-2012-3867
lib/puppet/ssl/certificateauthority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request CSR, which makes it easier for user-assisted remote attackers to trick...
CVE-2012-3555
CVE-2012-3555 affects Opera before 11.65, where keyboard sequences may not be tied to a visible window, enabling user‑assisted remote attackers to perform cross‑site scripting or execute arbitrary code via a crafted page (hidden keyboard navigation). The OpenVAS and vendor notes corroborate Opera...
Cross site request forgery (csrf)
Multiple cross-site request forgery CSRF vulnerabilities in the administrative interface in Bradford Network Sentry before 5.3.3 allow remote attackers to hijack the authentication of administrators for requests that 1 insert XSS sequences or 2 send messages to clients...
CVE-2012-2605
Multiple cross-site request forgery CSRF vulnerabilities in the administrative interface in Bradford Network Sentry before 5.3.3 allow remote attackers to hijack the authentication of administrators for requests that 1 insert XSS sequences or 2 send messages to clients...
CVE-2012-3343
Cross-site request forgery CSRF vulnerability in Microdasys before 3.5.1-B708, as used in Bloxx Web Filtering before 5.0.14 and other products, allows remote attackers to hijack the authentication of arbitrary users for requests that trigger error pages containing XSS sequences, a different...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in Microdasys before 3.5.1-B708, as used in Bloxx Web Filtering before 5.0.14 and other products, allows remote attackers to hijack the authentication of arbitrary users for requests that trigger error pages containing XSS sequences, a different...
CVE-2011-3293
Multiple cross-site request forgery CSRF vulnerabilities in the Solution Engine in Cisco Secure Access Control Server ACS 5.2 allow remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting XSS sequences, aka Bug ID CSCtr78143...