5648 matches found
UBUNTU-CVE-2014-3616
nginx 0.5.6 through 1.7.4, when using the same shared sslsessioncache or sslsessionticketkey for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct "virtual host confusion" attacks...
nss: TOCTOU, potential use-after-free in libssl's session ticket processing (MFSA 2014-12)
A race condition was found in the way NSS implemented session ticket handling as specified by RFC 5077. An attacker could use this flaw to crash an application using NSS or, in rare cases, execute arbitrary code with the privileges of the user running that application...
CVE-2014-3740
Cross-site scripting XSS vulnerability in SpiceWorks before 7.2.00195 allows remote authenticated users to inject arbitrary web script or HTML via the Summary field in a ticket request to the portal page...
Cross site scripting
Cross-site scripting XSS vulnerability in SpiceWorks before 7.2.00195 allows remote authenticated users to inject arbitrary web script or HTML via the Summary field in a ticket request to the portal page...
CVE-2014-3740
CVE-2014-3740 is a stored XSS vulnerability in SpiceWorks IT ticketing system prior to version 7.2.00195. The issue allows remote authenticated users to inject arbitrary script or HTML via the Summary field when submitting a ticket, with exploitation potentially affecting admin sessions when view...
Wordpress Support Plus Responsive Ticket System 2.0 Plugin - Multiple Vulnerabilities
Exploit for php platform in category web applications Exploit Title: Wordpress WP Support Plus Responsive Ticket System 2.0 Plugin - Multiple Vulnerabilities Google Dork: N/A Date: 09.09.2014 Exploit Author: Fikri Fadzil - email protected Vendor Homepage - http://wpsuportplus.byethost7.com/...
CVE-2014-3740: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in SpiceWorks before 7.2.00195 allows remote authenticated users to inject arbitrary web script or HTML via the Summary field in a ticket request to the portal page...
WordPress Plugin WP Support Plus Responsive Ticket System 2.0 - Multiple Vulnerabilities
WordPress Plugin WP Support Plus Responsive Ticket System 2.0 - Multiple Vulnerabilities Exploit Title: Wordpress WP Support Plus Responsive Ticket System 2.0 Plugin - Multiple Vulnerabilities Google Dork: N/A Date: 09.09.2014 Exploit Author: Fikri Fadzil - [email protected] Vendor...
WordPress Plugin WP Support Plus Responsive Ticket System 2.0 - Multiple Vulnerabilities
Exploit Title: Wordpress WP Support Plus Responsive Ticket System 2.0 Plugin - Multiple Vulnerabilities Google Dork: N/A Date: 09.09.2014 Exploit Author: Fikri Fadzil - [email protected] Vendor Homepage - http://wpsuportplus.byethost7.com/ Software...
CVE-2014-2515
EMC Documentum D2 3.1 before P24, 3.1SP1 before P02, 4.0 before P11, 4.1 before P16, and 4.2 before P05 does not properly restrict tickets provided by D2GetAdminTicketMethod and D2RefreshCacheMethod, which allows remote authenticated users to gain privileges via a request for a superuser ticket...
CVE-2014-2515: Undefined Security Weakness
EMC Documentum D2 3.1 before P24, 3.1SP1 before P02, 4.0 before P11, 4.1 before P16, and 4.2 before P05 does not properly restrict tickets provided by D2GetAdminTicketMethod and D2RefreshCacheMethod, which allows remote authenticated users to gain privileges via a request for a superuser ticket...
PT-2014-4753
Name of the Vulnerable Software and Affected Versions EMC Documentum D2 versions 3.1 before P24 EMC Documentum D2 version 3.1SP1 before P02 EMC Documentum D2 version 4.0 before P11 EMC Documentum D2 version 4.1 before P16 EMC Documentum D2 version 4.2 before P05 Description The issue allows remot...
Access Control Bypass in Spring Security
When using Spring Security's CAS Proxy ticket authentication a malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated. This is due to the fact that the proxy ticket authentication uses the information from the HttpServletRequest which is...
USN-2310-1 krb5 vulnerabilities
It was discovered that Kerberos incorrectly handled certain crafted Draft 9 requests. A remote attacker could use this issue to cause the daemon to crash, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS. CVE-2012-1016 It was discovered that Kerberos incorrectly handled...
Debian DSA-2994-1 : nss - security update
Several vulnerabilities have been discovered in nss, the Mozilla Network Security Service library : - CVE-2013-1741 Runaway memset in certificate parsing on 64-bit computers leading to a crash by attempting to write 4Gb of nulls. - CVE-2013-5606 Certificate validation with the verifylog mode did...
DLA-23-1 nss - security update
Bulletin has no description...
Debian Security Advisory DSA 2994-1 (nss - security update)
Several vulnerabilities have been discovered in nss, the Mozilla Network Security Service library: CVE-2013-1741 Runaway memset in certificate parsing on 64-bit computers leading to a crash by attempting to write 4Gb of nulls. CVE-2013-5606 Certificate validation with the verifylog mode did not...
nss: TOCTOU, potential use-after-free in libssl's session ticket processing (MFSA 2014-12)
A race condition was found in the way NSS implemented session ticket handling as specified by RFC 5077. An attacker could use this flaw to crash an application using NSS or, in rare cases, execute arbitrary code with the privileges of the user running that application...
PHP Ticket System Beta 1 - CSRF Vulnerability
No description provided by source. 1. 2. 3. + Exploit Title : php ticket system csrf 4. + Author : Pablo '7days' Riberio 5. + Team: So Good Security 6. + Other 0days : http://pastebin.com/u/7days 7. + Version : = BETA 1 8. + Tested on : windows/internet explorer 9. + Details: Reset admin password...
EGroupWare 1.0 Calendar Module date Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/11013/info It is reported that eGroupWare is susceptible to multiple cross-site scripting and HTML injection vulnerabilities. The cross-site scripting issues present themselves in the various parameters of the 'addressboo...