Zarafa WebApp Denial of Service Vulnerability

Zarafa WebApp is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:zarafa:webapp"; ...

Symantec Endpoint Protection 12.1.4023.4080 - Multiple Vulnerabilities

Symantec Endpoint Protection 12.1.4023.4080 - Multiple Vulnerabilities SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: XXE & XSS & Arbitrary File Write vulnerabilities product: Symantec Endpoint Protection vulnerable...

2Wire Routers 'H04_POST' - Access Validation Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/27516/info Multiple 2Wire routers are prone to an access-validation vulnerability because they fail to adequately authenticate users before performing certain actions. Unauthenticated attackers can leverage this issue to...

Remote DoS Exploit on JIRA

An attacker is able to perform the billion laughs attack on a default JIRA installation including OnDemand installations. This attack can be executed without authentication and leads to the complete use of resources on the victim machine causing the server to crash or hang. It is possible due to...

[ MDVSA-2014:044 ] zarafa

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:044 http://www.mandriva.com/en/support/security/ Package : zarafa Date : February 19, 2014 Affected: Business Server 1.0 Problem Description: Robert Scheck discovered multiple vulnerabilities in Zarafa that...

Google Search Appliance dynamic navigation cross-site scripting vulnerability

Overview Google Search Appliance GSA devices contain a cross-site scripting XSS vulnerability when dynamic navigation is enabled. Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' Google Search Appliance versions earlier than 7.2.0.G.114 and...

WP Planet <= 0.1 - Unauthenticated Reflected XSS

The last time it was checked the plugin was still affected and had been closed. https://www.example.com/wp-content/plugins/wp–planet/rss.class/scripts/magpiedebug.php?url=alert1...

Ultimate Weather Plugin <= 1.0 - Unauthenticated Reflected XSS

The last time it was checked the plugin was still affected and had been closed. http://www.example.com/wp-content/plugins/ultimate–weather–plugin/magpierss/scripts/magpiedebug.php?url=%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E...

Cybozu Remote Service Manager vulnerable to session fixation

Overview Remote Service Manager provided by Cybozu,Inc. is a software to access on-premise systems such as Cybozu products via "Cybozu Remote Service". Remote Service Manager contains a session fixation vulnerability. Impact A remote, unauthenticated attacker may impersonate a registered user. As...

Cisco Jabber for Windows Remote Code Execution Vulnerability

A vulnerability in the Send Screen Capture function of Cisco Jabber for Windows could allow an unauthenticated, remote attacker to install arbitrary files on a targeted system. The vulnerability is due to insufficient validation of data in the packets sent via the send screen capture functionalit...

Sophos Web Protection Appliance sblistpack Arbitrary Command Execution (CVE-2013-4983)

A command injection vulnerability has been reported in Sophos Web Protection Appliance. The vulnerability is due to sblistpack component, reachable from the web interface without authentication. An unauthenticated remote attacker could execute arbitrary OS commands on the Sophos appliance...

Cisco Prime Data Center Network Manager RMI Remote Code Execution (uncredentialed check)

According to its self-reported version number, the version of Cisco Prime Data Center Network Manager DCNM installed on the remote host is affected by a remote code execution vulnerability. Unauthorized users have access to the JBoss Application Server Remote Method Invocation services. A remote,...

IBM Notes runs arbitrary JAVA and Javascript in emails

Overview IBM Notes parses arbitrary JAVA and Javascript code by default when viewing emails. Description The n.runs AG security advisory states:Notes 8.5.3 does not filter tags inside HTML emails. This can be used to load arbitrary Java applets from remote sources making it an information...

MS12-053: Vulnerability in Remote Desktop Could Allow Remote Code Execution (2723135)

An arbitrary remote code vulnerability exists in the implementation of the Remote Desktop Protocol RDP on the remote Windows host. The vulnerability is due to the way that RDP accesses an object in memory that has been deleted. If RDP has been enabled on the affected system, an unauthenticated,...

Eaton Network Shutdown Module view_list.php paneStatusListSortBy Parameter eval() Call Remote PHP Code Execution

The version of the Eaton Network Shutdown Module hosted on the remote web server does not sanitize user input to the 'paneStatusListSortBy' parameter of the 'viewlist.php' script before using it as part of a command to be executed via PHP's 'eval' function. An unauthenticated, remote attacker can...

Basilic diff.php Command Injection

Basilic, a bibliography server for research laboratories, has a command injection vulnerability. Input to the file parameter of diff.php is not properly sanitized. A remote, unauthenticated attacker could exploit this to execute arbitrary shell commands. %NASLMINLEVEL 70300 C Tenable Network...

织梦(DedeCMS)后门远程代码执行漏洞

DEDECMS是织梦内容管理系统，国内一款基于PHP+MySQL的技术开发的，支持多种服务器平台的PHP网站内容管理系统。 DedeCMS某些版本/include/shopcar.class.php文件中，被添加后门代码，远程未验证的攻击者利用该后门可以执行任意命令。 0 dedecms 临时解决方法： 如果您不能立刻安装补丁或者升级，NSFOCUS建议您采取以下措施以降低威胁： 直接找到站点include目录下shopcar.class.php文件，去掉里面的代码 @evalfilegetcontents'php://input';即可。 厂商补丁： dedecms -------...

MS12-020: Vulnerabilities in Remote Desktop Could Allow Remote Code Execution (2671387) (uncredentialed check)

Binary data ms12-020remote.nbin...

GLSA-201110-16 : Cyrus IMAP Server: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201110-16 Cyrus IMAP Server: Multiple vulnerabilities Multiple vulnerabilities have been discovered in the Cyrus IMAP Server. Please review the CVE identifiers referenced below for details. Impact : An unauthenticated local or...

NetSupport Manager Remote Buffer Overflow Vulnerability

NetSupport Manager is prone to a buffer overflow vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...