CVE-2012-1174

The rmrfchildren function in util.c in the systemd-logind login manager in systemd before 44, when logging out, allows local users to delete arbitrary files via a symlink attack on unspecified files, related to "particular records related with user session."...

CVE-2012-1174

The rmrfchildren function in util.c in the systemd-logind login manager in systemd before 44, when logging out, allows local users to delete arbitrary files via a symlink attack on unspecified files, related to "particular records related with user session."...

phpList 2.10.18 Cross Site Scripting

HTTPCS Advisory : HTTPCS25 Product : phpList Version : 2.10.18 Date : 2012-07-09 Criticality level : Less Critical Description : A vulnerability has been discovered in phpList, which can be exploited by malicious people to conduct cross-site scripting attacks. Input passed via the 'footer'...

CVE-2012-1936

The wpcreatenonce function in wp-includes/pluggable.php in WordPress 3.3.1 and earlier associates a nonce with a user account instead of a user session, which might make it easier for remote attackers to conduct cross-site request forgery CSRF attacks on specific actions and objects by sniffing t...

Multiple vulnerabilities in ZENphoto

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in ZENphoto, which can be exploited to perform arbitrary PHP code execution, sql injection and cross site scripting attacks. 1 Arbitrary PHP Code Execution in ZENphoto: CVE-2012-0993 Input passed via...

Design/Logic Flaw

EMC RSA Key Manager RKM Appliance 2.7 SP1 before 2.7.1.6, when Firefox 4.x or 5.0 is used, does not properly terminate a user session upon a logout action, which makes it easier for remote attackers to execute arbitrary code by leveraging an unattended workstation...

Joomla! 1.7.0 Cross Site Scripting

Joomla! 1.7.0 | Multiple Cross Site Scripting XSS Vulnerabilities 1. OVERVIEW Joomla! 1.7.0 stable version is vulnerable to multiple Cross Site Scripting issues. 2. BACKGROUND Joomla is a free and open source content management system CMS for publishing content on the World Wide Web and intranets...

Simple Machines Forum Session Hijacking Vulnerability

The host is installed with Simple Machines Forum and is prone to session hijacking vulnerability. OpenVAS Vulnerability Test $Id: gbsimplemachinesforumsessionhijackingvuln.nasl 7044 2017-09-01 11:50:59Z teissa $ Simple Machines Forum Session Hijacking Vulnerability Authors: Rachana Shetty...

Digital Scribe 1.5 - register_form()' Multiple POST Cross-Site Scripting Vulnerabilities

25: 26: 27: Title:" SIZE=4 Mr., Mrs., etc 28: 29: Last Name:" 30: Password: 31: 32: Password Again: 33: 34: E-Mail: 35:...

Apache Archiva跨站脚本和HTML注入漏洞

Bugtraq ID: 48011 CVE ID：CVE-2011-1077 Apache Archiva是一款管理一个和多个远程存储的软件。 Apache Archiva存在多个存储型和反射型跨站脚本问题，在请求参数中或发送表单中提交包含恶意代码的JavaScript，诱使用户处理可导致恶意脚本在目标用户浏览器上执行，可获得敏感信息或劫持用户会话 Apache Archiva 1.3.4 Apache Archiva 1.3.3 Apache Archiva 1.3.2 Apache Archiva 1.3.1 Apache Archiva 1.3 Apache Archiva...

Lms Web Ensino - Multiple Input Validation Vulnerabilities

Lms Web Ensino - Multiple Input Validation Vulnerabilities source: https://www.securityfocus.com/bid/46829/info LMS Web Ensino is prone to the following input-validation vulnerabilities: 1. Multiple cross-site scripting vulnerabilities 2. An SQL-injection vulnerability 3. A cross-site...

Abuse of Functionality уязвимости в Drupal

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Abuse of Functionality уязвимостях в Drupal. Abuse of Functionality WASC-42: В системе используется ненадёжный механизм смены пароля. В профиле пользователя http://site/user/1/edit можно сменить пароль без знания текущего пароля. И хотя в форме...

NetLink Shell Upload

====================================== NetLink Remote Arbitrary File Upload Vulnerability Download: http://sourceforge.net/projects/kp-netlink/ by lumut-- Homepage: lumutcherenza.biz ====================================== upload.php "; echo ""; echo "Filename: ".$filename; echo "File Type:...

SAP NetWeaver JavaMailExamples - XSS

Application: SAP NetWeaver Versions Affected: SAP NetWeaver JavaMailExamples Vendor URL: http://www.sap.com Bugs:XSS Exploits: YES Reported: 11.05.2010 Vendor response: 12.05.2010 Date of Public Advisory: 19.08.2011 Author: Dmitriy Evdokimov Description SAP Netweaver JavaMailExamples has linked X...

NetWin Surgemail XSS vulnerability

Application NetWin Surgemail 4.3e Vendor NetWin - http://netwinsite.com Discovered by Kerem Kocaer [email protected] Problem ------- Cross-site scripting XSS vulnerability in the Surgemail webmail login page /surgemail allows remote attackers to inject arbitrary web script or HTML. Input...

phpMyAdmin 3.3.5 / 2.11.10 Cross Site Scripting

============================================================================== phpMyAdmin 3.3.5 / 2.11.10 = Cross Site Scripting XSS Vulnerability ============================================================================== 1. OVERVIEW The phpMyAdmin web application was vulnerable to Cross Site...

[Backports-security-announce] Security Update for drupal6

Luigi Gangitano uploaded new packages for drupal6 which fixed the following security problems: SA-CORE-2010-001 Multiple vulnerabilities and weaknesses were discovered in Drupal. Installation cross site scripting A user-supplied value is directly output during installation allowing a malicious us...

Debian DSA-2016-1 : drupal6 - several vulnerabilities

Several vulnerabilities SA-CORE-2010-001 have been discovered in drupal6, a fully-featured content management framework. Installation cross site scripting A user-supplied value is directly output during installation allowing a malicious user to craft a URL and perform a cross-site scripting attac...

[SECURITY] [DSA 2016-1] New drupal6 packages fix several vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-2016-1 [email protected] http://www.debian.org/security/ Giuseppe Iuculano March 13, 2010 http://www.debian.org/security/faq -...

Cross-site scripting cookie theft

Added: 03/09/2010 Background Many web sites include scripts , which are lists of commands which, when executed in sequence, provide some enhancement to a web page. Web browsers are able to recognize scripts in web pages by the tag and handle them accordingly. Problem By sending an HTTP request...