6123 matches found
MyST BlogSite URL Redirect / Information Leakage
=============================== MyST BlogSite | Multiple Vulnerabilities =============================== 1. VULNERABILITY DESCRIPTION -- Issue Title: Arbitrary URL Redirect Component: MyST BlogSite ClickDirector Ref: OWASP - Top 10 - 2010 - A10 Ref-Link:...
Spreecommerce < 0.50.0 Arbitrary Command Execution
Exploit for unix platform in category remote exploits $Id: spreesearchlogicexec.rb 12397 2011-04-21 19:38:42Z swtornio $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more informatio...
Spreecommerce < 0.50.0 - Arbitrary Command Execution (Metasploit)
$Id: spreesearchlogicexec.rb 12397 2011-04-21 19:38:42Z swtornio $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...
CVE-2010-4535
The password reset functionality in django.contrib.auth in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not validate the length of a string representing a base36 timestamp, which allows remote attackers to cause a denial of service resource consumption via a URL that...
phpMyAdmin - Client-Side Code Injection Redirect Link Falsification
phpMyAdmin - Client-Side Code Injection Redirect Link Falsification PhpMyAdmin Client Side 0Day Code Injection and Redirect Link Falsification Credits: Emanuele 'emgent' Gentili Marco 'whitesheep' Rondini Alessandro 'scox' Scoscia In error.php, PhpMyAdmin permit to insert text and restricted tag,...
phpMyAdmin - Client-Side Code Injection / Redirect Link Falsification
PhpMyAdmin Client Side 0Day Code Injection and Redirect Link Falsification Credits: Emanuele 'emgent' Gentili Marco 'whitesheep' Rondini Alessandro 'scox' Scoscia In error.php, PhpMyAdmin permit to insert text and restricted tag, like BBCode. With tag a@url@pageClick Me/a, you can insert your own...
kernel: RDS sockets local privilege escalation
The rdspagecopyuser function in net/rds/page.c in the Reliable Datagram Sockets RDS protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg syste...
Oracle Solaris - su Crash
Oracle Solaris - su Crash From http://cvs.opensolaris.org/source/xref/onnv/onnv-gate/usr/src/cmd/su/su.c 521 for j = 0; initenvj != 0; j++ 1 522 if initvar = getenvinitenvj 2 ... 535 else 536 var = char 537 mallocstrleninitenvj 3 538 + strleninitvar 539 + 2; 540 void strcpyvar, initenvj; 4 'su'...
Unfixed XSS vulnerability at courriel.cyberpresse.ca
Security researcher h3xStream, has submitted on 09/07/2010 a cross-site-scripting XSS vulnerability affecting courriel.cyberpresse.ca, which at the time of submission ranked 3431 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 09/07/2010. It is...
FreeBSD-SA-10:06.nfsclient
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-10:06.nfsclient Security Advisory The FreeBSD Project Topic: Unvalidated input in nfsclient Category: core Module: nfsclient Announced: 2010-05-27 Credits:...
FreeBSD -- Unvalidated input in nfsclient
Problem Description: The NFS client subsystem fails to correctly validate the length of a parameter provided by the user when a filesystem is mounted...
PT-2010-2986 · Adobe · Shockwave Player
Name of the Vulnerable Software and Affected Versions: Adobe Shockwave Player versions prior to 11.5.7.609 Description: The issue allows remote attackers to execute arbitrary code or cause a denial of service due to memory corruption. This is achieved through a crafted .dir file that exploits the...
FreeBSD : joomla -- multiple vulnerabilities (8d10038e-515c-11df-83fb-0015587e2cc1)
Joomla! reported the following vulnerabilities : If a user entered a URL with a negative query limit or offset, a PHP notice would display revealing information about the system.. The migration script in the Joomla! installer does not check the file type being uploaded. If the installation...
Unfixed XSS vulnerability at www.noah.org
Security researcher inside0ut, has submitted on 24/03/2010 a cross-site-scripting XSS vulnerability affecting www.noah.org, which at the time of submission ranked 462254 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 06/07/2010. It is currentl...
FreeBSD -- BIND named(8) cache poisoning with DNSSEC validation
Problem Description: If a client requests DNSSEC records with the Checking Disabled CD flag set, BIND may cache the unvalidated responses. These responses may later be returned to another client that has not set the CD flag...
PHP Banner Exchange 1.2 - signupconfirm.php Cross-Site Scripting
PHP Banner Exchange 1.2 - signupconfirm.php Cross-Site Scripting source: https://www.securityfocus.com/bid/40165/info PHP Banner Exchange is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input. An attacker may leverage this issu...
bind security update
30:9.3.6-4.P1.1 - don't cache unvalidated additional sections 538744...
Unfixed XSS vulnerability at www.maidasoli.com
Security researcher Langy, has submitted on 17/08/2009 a cross-site-scripting XSS vulnerability affecting www.maidasoli.com, which at the time of submission ranked 1117839 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 05/07/2010. It is...
Unfixed XSS vulnerability at www.pornosextube.net
Security researcher CLaYMoRE, has submitted on 07/09/2009 a cross-site-scripting XSS vulnerability affecting www.pornosextube.net, which at the time of submission ranked 6962099 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 07/09/2009. It is...
