[SECURITY] [DSA 2646-1] typo3-src security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2646-1 [email protected] http://www.debian.org/security/ Yves-Alexis Perez March 15, 2013 http://www.debian.org/security/faq -...

Debian DSA-2646-1 : typo3-src - several vulnerabilities

TYPO3, a PHP-based content management system, was found vulnerable to several vulnerabilities. - CVE-2013-1842 Helmut Hummel and Markus Opahle discovered that the Extbase database layer was not correctly sanitizing user input when using the Query object model. This can lead to SQL injection by a...

PT-2013-1060

Name of the Vulnerable Software and Affected Versions Audio Player plugin versions prior to 2.0.4.6 typo3-src affected versions not specified Description The issue concerns a cross-site scripting XSS vulnerability and multiple vulnerabilities in the typo3-src package. The XSS vulnerability allows...

Microsoft Internet Explorer Domain Policy Bypass Vulnerability

Microsoft Internet Explorer is prone to domain policy bypass vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WS-2013-0240

In php-src, php-5.0.0b2 to php-5.4.12, have a flaw in the TLS compression, that can lead to recovery of secret authentication cookies and allows an attacker to perform session hijacking on an authenticated web session...

CVE-2012-6502

Microsoft Internet Explorer before 10 allows remote attackers to obtain sensitive information about the existence of files, and read certain data from files, via a UNC share pathname in the SRC attribute of a SCRIPT element, as demonstrated by reading a name-value pair from a local file via a...

CVE-2012-6502: Exposure of Sensitive Information to an Unauthorized Actor

Microsoft Internet Explorer before 10 allows remote attackers to obtain sensitive information about the existence of files, and read certain data from files, via a UNC share pathname in the SRC attribute of a SCRIPT element, as demonstrated by reading a name-value pair from a local file via a...

CVE-2012-6301: Improper Input Validation

The Browser application in Android 4.0.3 allows remote attackers to cause a denial of service application crash via a crafted market: URI in the SRC attribute of an IFRAME element...

Debian Security Advisory DSA 2574-1 (typo3-src)

The remote host is missing an update to typo3-src announced via advisory DSA 2574-1. OpenVAS Vulnerability Test $Id: deb25741.nasl 8972 2018-02-28 07:02:10Z cfischer $ Description: Auto-generated from advisory DSA 2574-1 typo3-src Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc...

CVE-2012-4751

Cross-site scripting XSS vulnerability in Open Ticket Request System OTRS Help Desk 2.4.x before 2.4.15, 3.0.x before 3.0.17, and 3.1.x before 3.1.11 allows remote attackers to inject arbitrary web script or HTML via an e-mail message body with whitespace before a javascript: URL in the SRC...

CVE-2012-4751: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Open Ticket Request System OTRS Help Desk 2.4.x before 2.4.15, 3.0.x before 3.0.17, and 3.1.x before 3.1.11 allows remote attackers to inject arbitrary web script or HTML via an e-mail message body with whitespace before a javascript: URL in the SRC...

PT-2012-5574

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS Help Desk versions 2.4.x through 2.4.14 Open Ticket Request System OTRS Help Desk versions 3.0.x through 3.0.16 Open Ticket Request System OTRS Help Desk versions 3.1.x through 3.1.10 Description A cross-site...

WS-2012-0020

In php-src, php-5.1.2RC1 to php-5.4.8 there is a buffer overflow vulnerability. “discardstate” array is 5 chars long although the buffer must be 6 chars long in order to include null char terminator...

CVE-2012-3491: Undefined Security Weakness

src/condorschedd.V6/schedd.cpp in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 does not properly check the permissions of jobs, which allows remote authenticated users to remove arbitrary idle jobs via unspecified vectors...

CVE-2012-2575: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in NetWin SurgeMail 6.0a4 allows remote attackers to inject arbitrary web script or HTML via the SRC attribute of an IFRAME element in the body of an HTML e-mail message...

PT-2012-4421

Name of the Vulnerable Software and Affected Versions Trend Micro InterScan Messaging Security Suite version 7.1-Build Win32 1394 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML...

PT-2012-4114

Name of the Vulnerable Software and Affected Versions SurgeMail version 6.0a4 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the SRC attribute of an IFRAME element in the body of an HTML e-mail message. Recommendations For version...

PT-2012-2148

Name of the Vulnerable Software and Affected Versions CyberLink Power2Go versions 7 build 196 through 8 build 1031 Description The issue is related to multiple stack-based buffer overflows that allow remote attackers to execute arbitrary code. This is achieved via the src and name parameters in a...

CVE-2011-5171: Improper Restriction of Operations within the Bounds of a Memory Buffer

Multiple stack-based buffer overflows in CyberLink Power2Go 7 build 196 and 8 build 1031 allow remote attackers to execute arbitrary code via the 1 src and 2 name parameters in a p2g project file...

[SECURITY] [DSA 2537-1] typo3-src security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2537-1 [email protected] http://www.debian.org/security/ Florian Weimer August 30, 2012 http://www.debian.org/security/faq -...