9432 matches found
CVE-2014-4737: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in Textpattern CMS before 4.5.7 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to setup/index.php...
PT-2014-6084
Name of the Vulnerable Software and Affected Versions Textpattern CMS versions prior to 4.5.7 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the PATH INFO to "setup/index.php". This could potentially lead to unauthorized actions on...
qemu: usb: insufficient sanity checking of setup_index+setup_len in post_load
The usbdevicepostload function in hw/usb/bus.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted savevm image, related to a negative setuplen or setupindex value...
krb5: KDC remote DoS (NULL pointer dereference and daemon crash)
It was found that if a KDC served multiple realms, certain requests could cause the setupserverrealm function to dereference a NULL pointer. A remote, unauthenticated attacker could use this flaw to crash the KDC using a specially crafted request...
CVE-2014-3529
The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...
CVE-2014-3529
The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...
JCMS /setup/opr_updatenewmenu.jsp 登录绕过漏洞
No description provided by source...
[SECURITY] Fedora 20 Update: cinnamon-control-center-2.2.10-1.fc20.1
This package contains configuration utilities for the Cinnamon desktop, whi ch allow to configure accessibility options, desktop fonts, keyboard and mouse properties, sound setup, desktop theme and background, user interface properties, screen resolution, and other settings...
[SECURITY] Fedora 20 Update: control-center-3.10.3-2.fc20
This package contains configuration utilities for the GNOME desktop, which allow to configure accessibility options, desktop fonts, keyboard and mouse properties, sound setup, desktop theme and background, user interface properties, screen resolution, and other settings...
qemu: usb: insufficient sanity checking of setup_index+setup_len in post_load
The usbdevicepostload function in hw/usb/bus.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted savevm image, related to a negative setuplen or setupindex value...
Authentication flaw
OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules, when BreeZ is used, do not require authentication for reading the site security key, which allows physically proximate attackers to spoof communication by obtaining this key after use of direct hardware access or manual-setup mod...
CVE-2014-2361
Summary (CVE-2014-2361): OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules, when BreeZ is used, expose a key management flaw that allows a physically proximate attacker to read the site security key and spoof communication. The issue arises from improper key handling (key managem...
qemu: usb: insufficient sanity checking of setup_index+setup_len in post_load
The usbdevicepostload function in hw/usb/bus.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted savevm image, related to a negative setuplen or setupindex value...
UBUNTU-CVE-2014-4022
The allocdomainstruct function in arch/arm/domain.c in Xen 4.4.x, when running on an ARM platform, does not properly initialize the structure containing the grant table pages for a domain, which allows local guest administrators to obtain sensitive information via the GNTTABOPsetuptable...
DCShop Beta 1.0 Form Manipulation Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/4356/info DCShop Beta is a freely available shopping cart system, written in Perl. It will run on most Unix and Linux variants, as well as Microsoft Windows operating systems. It is possible to overwrite setup files .setu...
MS IE 4.x/5.0,Outlook 2000 0/98 0/Express 4.x ActiveX CAB File Execution
No description provided by source. Microsoft Internet Explorer 4.0 for Windows 95/Windows NT 4,Internet Explorer 4.1 for Windows 95/Windows 98/Windows NT 4,Internet Explorer 5.0 for Windows 2000/Windows 95/Windows 98/Windows NT 4,Internet Explorer 4.0.1 for Windows 98/Windows NT 4.0,Outlook 2000...
op5 Monitoring 5.4.2 - (VM Applicance) Multiple Vulnerabilities
No description provided by source. Author: loneferret of Offensive Security Product: op5 Monitoring VM appliance Version: 5.4.2 Vendor Site: http://www.op5.com/ Software Download: http://www.op5.com/get-op5-monitor/get-started/ Software Description: op5 is a market leading developer of Open Sourc...
events calendar 1.1 - Remote File Inclusion Vulnerability
No description provided by source. Events Calendar 1.1 Remote File Inclusion Vulnerability ======================================================== Author: kevin mitnick tunisianblackhat team = = Home : http://tunisianblackhat.com = = email: kevinmitnickAlive.fr = =...
TOSHIBA e-Studio 232/233/282/283 - Change Admin Password CSRF Vulnerability
No description provided by source. Exploit Title: TOSHIBA e-Studio 232/233/282/283 Change Admin Password CSRF Vulnerability Date: 02.10.2013 Exploit Author: Hubert Gradek PL Affected version: firmware T377SY0EXXX Tested on: TOSHIBA e-Studio 232 T377SY0E354 / 233 T377SY0E331 CVE : No CVE exists -...
Poster 2.0 Unauthorized Privileged User Access Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/8426/info A vulnerability has been reported for Poster.version:two. The problem occurs due to the application failing to lock the 'setup' variable after initialization. As a result, an attacker may access this variable to...