13835 matches found
MS15-021: Vulnerabilities in Adobe Font Driver Could Allow Remote Code Execution (3032323)
The remote Windows host is affected by the following vulnerabilities in the Adobe Font driver : - A flaw exists in the Adobe Font Driver due to improper allocation of memory. This allows a remote attacker, using a specially crafted font in a file or website, to cause a denial of service...
Ultimate PHP Board (UPB) 2.2.7 Cross Site Scripting Vulnerability
Ultimate PHP Board UPB version 2.2.7 suffers from a cross site scripting vulnerability. Exploit Title : Ultimate PHP Board UPB 2.2.7 Cross Site Scripting Vulnerability CVE : CVE-2015-2217 Date : 4 March 2015 Exploit Author : CWH Underground Discovered By : ZeQ3uL Site : www.2600.in.th Vendor...
WordPress Survey and Poll Blind SQL Injection Vulnerability
The WordPress plugin SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wordpress:wordpress"; ifdescription...
SA-CONTRIB-2015-054 - SMS Framework - Cross Site Scripting (XSS)
SMS Framework module enables you to send and receive SMS messages from and into Drupal. The module doesn't sufficiently sanitize user supplied text in message previews, thereby exposing a reflected Cross Site Scripting vulnerability. An attacker could exploit this vulnerability by getting the...
Python-2.2-ImageOP-Integer-Overflow
Python's imageop module is prone to multiple integer-overflow vulnerabilities because it fails to properly bounds-check user-supplied input to ensure that integer operations do not overflow. To successfully exploit these issues, an attacker must be able to control the arguments to imageop...
Adobe Flash Player Multiple Vulnerabilities-01 (Feb 2015) - Linux
Adobe Flash Player is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:adobe:flashplayer";...
Apple Safari 'Webkit' Multiple Vulnerabilities -01 (Feb 2015) - Mac OS X
Apple Safari is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apple:safari"; ifdescription...
Splunk XSS Vulnerability (Feb 2015)
Splunk is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:splunk:splunk";...
Apple-QuickTime-7.5-(.m3u)
Apple QuickTime is prone to a stack-based buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data. An attacker can exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely result i...
Schneider Electric ProClima ATX45 SetHtmlFileName Heap Buffer Overflow (CVE-2014-8511)
A code execution vulnerability has been reported in Schneider Electric ProClima. The vulnerability is due to a heap buffer overflow when processing user supplied parameter input to SetHtmlFileName in the Atx45.ocx ActiveX control. A remote unauthenticated attacker could exploit this vulnerability...
Magento eCommerce Web Sites Remote File Inclusion (CVE-2015-1399)
A remote file inclusion vulnerability has been reported in Magento component. The vulnerability is due to lack of sanitization for user-supplied data. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...
Vaadin Framework 6.0.0 - 6.8.13 XSS Vulnerability
Vaadin Framework is prone to a cross-site scripting XSS vulnerability because the application fails to properly sanitize user-supplied input. SPDX-FileCopyrightText: 2015 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective rig...
Updated coreutils packages fix CVE-2014-9471
Updated coreutils packages fix security vulnerability: Bertrand Jacquin and Fiedler Roman discovered date and touch incorrectly handled user-supplied input. An attacker could possibly use this to cause a denial of service or potentially execute code CVE-2014-9471...
Ubuntu 14.04 LTS : coreutils vulnerabilities (USN-2473-1)
The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2473-1 advisory. It was discovered that the distcheck rule in dist-check.mk in GNU coreutils allows local users to gain privileges via a symlink attack on a directory tre...
USN-2473-1: coreutils vulnerabilities
It was discovered that the distcheck rule in dist-check.mk in GNU coreutils allows local users to gain privileges via a symlink attack on a directory tree under /tmp. This issue only affected Ubuntu 10.04 LTS. CVE-2009-4135 Bertrand Jacquin and Fiedler Roman discovered date and touch incorrectly...
IBM Network Security Protection XGS Remote Code Execution (swg21690823) (credentialed check)
The firmware version installed on the remote IBM XGS appliance does not properly sanitize certain user-supplied inputs which can allow a remote, authenticated attacker to execute shell commands with the privileges of the 'www-data' user via a standard HTTP request. C Tenable Network Security, Inc...
PHPok v4.1 /framework/www/project/control.php SQL注入漏洞
/framework/www/projectcontrol.php $ext = $this-get"ext"; if$ext && isarray$ext $c = ''; foreach$ext AS $key=$value if$key && $value $c = "ext.".$key." LIKE '%".$value."%'"; $pageurl .= "ext".$key."=".rawurlencode$value."&"; if$c $dt'sqlext' = implode" AND ",$c; $this-assign'ext',$ext;...
Revive Adserver < 3.1.0 Multiple Vulnerabilities
Binary data 8607.prm...
Microsoft Windows VBScript Remote Code Execution Vulnerability (3016711)
This host is missing a critical security update according to Microsoft Bulletin MS14-084. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...