smack: incorrect X.509 certificate validation

It was found that the ServerTrustManager in the Smack XMPP API did not verify basicConstraints and nameConstraints in X.509 certificate chains. A man-in-the-middle attacker could use this flaw to spoof servers and obtain sensitive information...

phpMyAdmin 4.1.x < 4.1.14.1 / 4.2.x < 4.2.4 Navigation Hiding Items Multiple XSS (PMASA-2014-3)

According to its self-reported version number, the phpMyAdmin install hosted on the remote web server is 4.1.x prior to 4.1.14.1 or 4.2.x prior to 4.2.4. It is, therefore, affected by multiple cross-site scripting vulnerabilities. The flaws exist due to user input not being validated in a crafted...

Puppet Enterprise Multiple XSS Vulnerabilities

According to its self-reported version number, the Puppet Enterprise install on the remote host is later than version 1.0 but prior to 1.2.5 / 2.0.1. It is, therefore, affected by multiple cross-site scripting vulnerabilities. Multiple cross-site scripting flaws exist where unspecified input is n...

Puppet Dashboard Multiple XSS Vulnerabilities

According to its self-reported version number, the Puppet Dashboard install on the remote host is later than version 1.0 but prior to 1.2.5. It is, therefore, affected by multiple cross-site scripting vulnerabilities. Multiple cross-site scripting flaws exist where unspecified input is not...

CUPS < 1.7.2 is_path_absolute Function XSS

According to its banner, the version of CUPS installed on the remote host is prior to version 1.7.2. It is, therefore, affected by a cross-site scripting vulnerability. A flaw exists with the ispathabsolute function within the scheduler/client.cscript. This could allow a context-dependent attacke...

Symantec Messaging Gateway 10.x < 10.5.2 Management Console XSS (SYM14-006)

According to its self-reported version number, the version of Symantec Messaging Gateway running on the remote host is 10.x less than 10.5.2, and is therefore affected by a cross-site scripting vulnerability. A cross-site scripting flaw exists in the...

CVS Kit CVS Server 1.10.8 - Instructed File Create

CVS Kit CVS Server 1.10.8 - Instructed File Create source: https://www.securityfocus.com/bid/1523/info The cvs client blindly trust paths returned to it by the server. Therefore, a cvs client could be tricked into creating a file anywhere on the system by a malicious server. This problem can be...

nftp-bof.txt

Date: Mon, 16 Nov 1998 18:02:43 -0700 Reply-To: Eric Wanner Sender: Bugtraq List From: Eric Wanner Subject: nftp vulnerability fwd Content-Type:MULTIPART/MIXED; nftp is a shareware ftp program available at ftp://crydee.sai.msu.su/pub/comp/software/asv/nftp/ that is becoming more and more widely...