RealNetworks RealPlayer CDDA URI Initialization Vulnerability

$Id: realplayercddauri.rb 12009 2011-03-17 15:42:28Z bannedit $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Trend Micro WebReputation API URI安全限制绕过漏洞

BUGTRAQ ID: 46864 Trend Micro WebReputation API是趋势科技网页声誉应用程序界面。 Trend Micro WebReputation API在实现上存在安全限制绕过漏洞，远程攻击者可利用此漏洞绕过下载机制中包含的过滤程序，下载恶意文件到受影响计算机。 Trend Micro WebReputation API 10.5 Trend Micro WebReputation API 0 厂商补丁： Trend Micro ----------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

RealNetworks RealPlayer - CDDA URI Initialization (Metasploit)

$Id: realplayercddauri.rb 12009 2011-03-17 15:42:28Z bannedit $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

CVE-2011-0751

Directory traversal vulnerability in nhttpd aka Nostromo webserver before 1.9.4 allows remote attackers to execute arbitrary programs or read arbitrary files via a ..%2f encoded dot dot slash in a URI...

CVE-2011-0751

Nostromo nhttpd (Nazgul Nostromo) versions up to 1.9.3 are vulnerable to CVE-2011-0751 due to improper validation of user-supplied paths, allowing directory traversal via encoded dot dot slash ("..%2f") in URIs and resulting in arbitrary file read or remote command execution. The issue affects th...

nostromo nhttpd directory traversal

Directory traversal including code execution via CGI with escaped URI...

[SECURITY] Fedora 14 Update: libxml2-2.7.7-3.fc14

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...

Joomla! < 1.6.1 Multiple Security Vulnerabilities

Joomla! is prone to multiple security vulnerabilities. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:joomla:joomla"; if...

Fedora 15 : telepathy-gabble-0.11.7-1.fc15 / telepathy-glib-0.13.13-1.fc15 (2011-1284)

Telepathy-Gabble changes, including a security fix : - fd.o32390: Gabble now treats a request for a ContactSearch channel with Server set to the empty string as equivalent to not specifying a server, and rejects requests where the JID specified for Server is invalid. - fd.o32874: Offline contacts...

SAP Management Console Instance Properties

This module simply attempts to identify the instance properties through the SAP Management Console SOAP Interface. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SAP Management Console Instanc...

Microsoft Submits Tracking Protection Proposal to W3C

Microsoft has submitted its proposal for web tracking protection to the W3C for consideration as a standard, hoping to get the organization’s stamp of approval for its browser privacy technology. The proposal is in the earliest stages of the process and has not been approved, a process that can...

Adobe Reader Crafted URI Action in PDF File Cross-Site Scripting (APSB11-03; CVE-2011-0587)

Adobe Reader and Acrobat is a family of computer programs developed by Adobe Systems, designed to view, create, manipulate and manage files in Adobe's core technology, the Portable Document Format PDF. A cross-site scripting XSS vulnerability has been discovered in Adobe Reader and Acrobat. PDF...

Atlassian JIRA Unspecified URI Redirection Vulnerability

Atlassian JIRA is prone to a URI-redirect vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:atlassian:jira"; if...

IBM Lotus Notes code execution

Code injection via cai: URI is not fixed for more than year...

ZDI-11-051: IBM Lotus Notes cai URI Handler Remote Code Execution Vulnerability

ZDI-11-051: IBM Lotus Notes cai URI Handler Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-051 February 7, 2011 - This vulnerability is being disclosed publicly without a patch in accordance with the ZDI 180 day deadline. To view mitigations for this...

CentOS Update for apr-util CESA-2010:0950 centos4 i386

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

CVE-2011-0048

Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 creates a clickable link for a 1 javascript: or 2 data: URI in the URL aka bugfileloc field, which allows remote attackers to conduct cross-site scripting XSS attacks against logged-out users via a crafted UR...

CVE-2010-4567

Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 does not properly handle whitespace preceding a 1 javascript: or 2 data: URI, which allows remote attackers to conduct cross-site scripting XSS attacks via the URL aka bugfileloc field...

CVE-2010-4567

Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 does not properly handle whitespace preceding a 1 javascript: or 2 data: URI, which allows remote attackers to conduct cross-site scripting XSS attacks via the URL aka bugfileloc field...

DEBIAN-CVE-2011-0495

Stack-based buffer overflow in the asturiencode function in main/utils.c in Asterisk Open Source before 1.4.38.1, 1.4.39.1, 1.6.1.21, 1.6.2.15.1, 1.6.2.16.1, 1.8.1.2, 1.8.2.; and Business Edition before C.3.6.2; when running in pedantic mode allows remote authenticated users to execute arbitrary...