Uzbey: email field doesn't filtered against XSS

Hi, Pre-configuration, create new contact in Gmail with mail a" 1. Go to Invites. 2. Click on Invite Gmail Friends. 3. Accept the pop up. 4. XSS will activate on the email field. Few issues continue during this issue: 1. When you click on this email address you get failure on AJAX functionally. 2...

Debian DSA-2934-1 : python-django - security update

Several vulnerabilities were discovered in Django, a high-level Python web development framework. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2014-0472 Benjamin Bach discovered that Django incorrectly handled dotted Python paths when using the revers...

[SECURITY] [DSA 2934-1] python-django security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2934-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso May 19, 2014 http://www.debian.org/security/faq -...

Debian Security Advisory DSA 2934-1 (python-django - security update)

Several vulnerabilities were discovered in Django, a high-level Python web development framework. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2014-0472 Benjamin Bach discovered that Django incorrectly handled dotted Python paths when using the reverse U...

DSA-2934-1 python-django - security update

Bulletin has no description...

Ubuntu 14.04 LTS : Django vulnerabilities (USN-2212-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2212-1 advisory. Stephen Stewart, Michael Nelson, Natalia Bidart and James Westby discovered that Django improperly removed Vary and Cache-Control headers from HTTP responses when...

Ubuntu Update for indicator-datetime USN-2186-1

Check for the Version of indicator-datetime OpenVAS Vulnerability Test $Id: gbubuntuUSN21861.nasl 7957 2017-12-01 06:40:08Z santu $ Ubuntu Update for indicator-datetime USN-2186-1 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This...

Ubuntu Update for python-django USN-2169-1

Check for the Version of python-django OpenVAS Vulnerability Test $Id: gbubuntuUSN21691.nasl 7957 2017-12-01 06:40:08Z santu $ Ubuntu Update for python-django USN-2169-1 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is...

Ubuntu: Security Advisory (USN-2169-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MGASA-2014-0196 Updated python-django packages fix multiple vulnerabilities

Updated python-django and python-dgango14 packages fix security vulnerabilities: Benjamin Bach discovered that Django incorrectly handled dotted Python paths when using the reverse function. An attacker could use this issue to cause Django to import arbitrary modules from the Python path, resulti...

FreeBSD : django -- multiple vulnerabilities (59e72db2-cae6-11e3-8420-00e0814cab4e)

The Django project reports : These releases address an unexpected code-execution issue, a caching issue which can expose CSRF tokens and a MySQL typecasting issue. While these issues present limited risk and may not affect all Django users, we encourage all users to evaluate their own risk and...

MySQL typecasting

When using a MySQL database, Django don't perform explicit conversion of the fields: FilePathField GenericIPAddressField IPAddressField If a query is performed without first converting values to the appropriate type, this can produce unexpected results, similar to what would occur if the query...

Unexpected code execution using reverse()

Django incorrectly handle dotted Python paths when using the django.core.urlresolvers.reverse function. An attacker can use this issue to cause Django to import arbitrary modules from the Python path, resulting in possible code execution...

django -- multiple vulnerabilities

The Django project reports: These releases address an unexpected code-execution issue, a caching issue which can expose CSRF tokens and a MySQL typecasting issue. While these issues present limited risk and may not affect all Django users, we encourage all users to evaluate their own risk and...

Localize: Unexpected array leaks information about the system

By changing a string parameter on the /pages/settings page to an array see example.png and submitting the form, the page shows an error message leaking information about the server and functions used see error.png. This works on multiple POST parameters. Warning: trim expects parameter 1 to be...

bugzilla -- Social Engineering

A Bugzilla Security Advisory reports: Dangerous control characters can be inserted into Bugzilla, notably into bug comments. If the text, which may look safe, is copied into a terminal such as xterm or gnome-terminal, then unexpected commands could be executed on the local machine...

APPLE-SA-2014-03-10-1 iOS 7.1

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-03-10-1 iOS 7.1 iOS 7.1 is now available and addresses the following: Backup Available for: iPhone 4 and later, iPod touch 5th generation and later, iPad 2 and later Impact: A maliciously crafted backup can alter the filesystem...

Vulnerability of small summary: the browser in those strange logic-vulnerability warning-the black bar safety net

0x00 introduction As early as a few years ago to see a book the dig 0day act, which introduced a sogou browser vulnerabilities-the forge website, although after a lapse of four years, sogou still made the same mistake, but at that time I only know that there is this treatment, but suffer from on...

Basic Integer Overflows

Introduction Basic Integer Overflow : In this paper we are going to describe two classes of programming bugs which can sometimes allow a malicious user to modify the execution path of an affected process. Both of these classes of bug work by causing variables to contain unexpected values, and so...

CVE-2013-4550

Bip before 0.8.9, when running as a daemon, writes SSL handshake errors to an unexpected file descriptor that was previously associated with stderr before stderr has been closed, which allows remote attackers to write to other sockets and have an unspecified impact via a failed SSL handshake, a...