CVE-2012-3844

Cross-site scripting XSS vulnerability in vBulletin 4.1.12 allows remote attackers to inject arbitrary web script or HTML via a long string in the subject parameter when creating a post...

CVE-2012-3844

CVE-2012-3844 affects vBulletin 4.1.12 and is a cross-site scripting (XSS) vulnerability. The flaw allows remote attackers to inject arbitrary web script or HTML through an excessively long string in the subject parameter when creating a post. The available sources consistently describe the vulne...

Unfixed XSS vulnerability at subjectguides.library.american.edu

Security researcher Sony, has submitted on 06/02/2012 a cross-site-scripting XSS vulnerability affecting subjectguides.library.american.edu, which at the time of submission ranked 32595 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 16/02/2012...

http-icloud-sendmsg NSE Script

Sends a message to a iOS device through the Apple MobileMe web service. The device has to be registered with an Apple ID using the Find My Iphone application. Script Arguments http-icloud-sendmsg.username the Apple ID username http-icloud-sendmsg.sound boolean specifying if a loud sound should be...

SuSE 10 Security Update : NetworkManager (ZYPP Patch Number 7957)

NetworkManager did not pin a certificate's subject to an ESSID. A rogue access point could therefore be used to conduct MITM attacks by using any other valid certificate issued by same CA as used in the original network. CVE-2006-7246 Please note that existing WPA2 Enterprise connections need to ...

PT-2012-2039 · Whmcs · Whmcs

Name of the Vulnerable Software and Affected Versions: WHMCS versions 4.0.x through 5.0.x Description: The issue is related to improper handling of characters in the subject field of a crafted ticket, which can trigger arbitrary code execution in the Smarty templating system. This allows remote...

PT-2012-2798 · Whmcs · Whmcs

Name of the Vulnerable Software and Affected Versions: WHMCS version 5.03 Description: The issue allows remote attackers to inject arbitrary code into a subject field via crafted ticket data in the submitticket.php file. Note that the vendor disputes this issue, stating that some details overlap...

Personal Information of 3.5 Million Poker Players Spilled Online

Customers of the online poker Website Ultimate Bet UB are the victims of a data breach that spilled the private information of up to 3.5 million of its customers online over the weekend. Ultimate Bet, a property of the Cereus Poker Network, saw a slew of customer information posted online includi...

UBUNTU-CVE-2011-4078

include/iniset.php in Roundcube Webmail 0.5.4 and earlier, when PHP 5.3.7 or 5.3.8 is used, allows remote attackers to trigger a GET request for an arbitrary URL, and cause a denial of service resource consumption and inbox outage, via a Subject header containing only a URL, a related issue to...

CVE-2011-4078

include/iniset.php in Roundcube Webmail 0.5.4 and earlier, when PHP 5.3.7 or 5.3.8 is used, allows remote attackers to trigger a GET request for an arbitrary URL, and cause a denial of service resource consumption and inbox outage, via a Subject header containing only a URL, a related issue to...

Ubuntu: Security Advisory (USN-1238-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DEBIAN-CVE-2011-3848

Directory traversal vulnerability in Puppet 2.6.x before 2.6.10 and 2.7.x before 2.7.4 allows remote attackers to write X.509 Certificate Signing Request CSR to arbitrary locations via 1 a double-encoded key parameter in the URI in 2.7.x, 2 the CN in the Subject of a CSR in 2.6 and 0.25...

CVE-2011-3872

Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise PE Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master's certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which allows remote attackers to spoof ...

CVE-2011-3848

Directory traversal vulnerability in Puppet 2.6.x before 2.6.10 and 2.7.x before 2.7.4 allows remote attackers to write X.509 Certificate Signing Request CSR to arbitrary locations via 1 a double-encoded key parameter in the URI in 2.7.x, 2 the CN in the Subject of a CSR in 2.6 and 0.25...

CVE-2010-4837

Cross-site scripting XSS vulnerability in the JSupport comjsupport component 1.5.6 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the subject parameter title field in a saveTicket action to index2.php. NOTE: some of these details are obtained from third party...

Nmap NSE net: ssl-cert

Retrieves a server's SSL certificate. The amount of information printed about the certificate depends on the verbosity level. With no extra verbosity, the script prints the validity period and the commonName, organizationName, stateOrProvinceName, and countryName of the subject. '443/tcp open htt...

Cross site scripting

Cross-site scripting XSS vulnerability in actions/add.php in InTerra Blog Machine 1.84, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the subject parameter to posturl/edit...

CVE-2011-1670

Cross-site scripting XSS vulnerability in actions/add.php in InTerra Blog Machine 1.84, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the subject parameter to posturl/edit...

AZL-36964 CVE-2011-1429 affecting package mutt 2.2.12-1

Mutt does not verify that the smtps server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL SMTP server via an arbitrary certificate, a different vulnerability than CVE-2009-3766...

DEBIAN-CVE-2011-1429

Mutt does not verify that the smtps server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL SMTP server via an arbitrary certificate, a different vulnerability than CVE-2009-3766...