CVE-2014-0974

The vulnerability CVE-2014-0974 affects the Little Kernel (LK) bootloader’s boot_linux_from_mmc function (app/aboot/aboot.c). The root cause is insufficient validation of a certain address value, which can allow an attacker to write data to a controllable memory location by initiating an attempte...

CVE-2014-3251

The MCollective aessecurity plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, does not properly validate new server certificates based on the CA certificate, which allows local users to establish unauthorized Mcollective connections via unspecified vectors related to...

FuseTalk Forum 4.0 - Multiple Cross-Site Scripting Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/11407/info FuseTalk Forum is reported prone to multiple input validation vulnerabilities. These issues may allow a remote attacker to carry out cross-site scripting attacks. The cause of these issues is insufficient...

JiRos Link Manager 1.0 openlink.asp LinkID Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/21226/info JiRos Links Manager is prone to multiple input-validation vulnerabilities, including SQL- and HTML-injection issues, because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could...

LandShop 0.6.3 ls.php Multiple Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/20989/info LandShop is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data. Exploiting these issues could allow an attacker to steal cookie-based...

SAP Business Connector 4.6/4.7 adapter-index.dsp url Variable Arbitrary Site Redirect

No description provided by source. source: http://www.securityfocus.com/bid/16671/info SAP Business Connector is susceptible to an input-validation vulnerability. This issue is due to the application's failure to properly sanitize user-supplied input. This issue allows remote attackers to execute...

Campus Bulletin Board 3.4 - post3/book.asp review Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/29375/info Campus Bulletin Board is prone to multiple input-validation vulnerabilities, including multiple SQL-injection issues and a cross-site scripting issue, because it fails to sufficiently sanitize user-supplied dat...

Easy File Sharing Web Server 3.2 Full Path Request Arbitrary File Upload

No description provided by source. source: http://www.securityfocus.com/bid/17046/info Easy File Sharing Web Server is prone to multiple input-validation vulnerabilities. The application fails to properly sanitize user-supplied input before using it in dynamically generated content. The issues...

Scout Portal Toolkit 1.3.1 - SPT-UserLogin.php Multiple Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/15818/info Scout Portal Toolkit is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. A successful exploit could allow an attacker to compromise the...

Simple PHP Blog 0.4 preview_static_cgi.php Multiple Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/15283/info Simple PHP Blog is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to hav...

AnnonceScriptHP 2.0 admin/admin_config/Aide.php email Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/21514/info AnnonceScriptHP is prone to multiple input-validation vulnerabilities, including SQL-injection and cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data. Exploiting these...

AnnonceScriptHP 2.0 Templates/admin.dwt.php email Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/21514/info AnnonceScriptHP is prone to multiple input-validation vulnerabilities, including SQL-injection and cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data. Exploiting these...

UebiMiau <= 2.7.10 demo/pop3/error.php selected_theme Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/24210/info Uebimiau is prone to multiple input-validation vulnerabilities, including cross-site scripting issues and an information-disclosure issue, because the application fails to properly sanitize user-supplied input...

Private Photo+Video 1.1 Pro iOS - Persistent Vulnerability

No description provided by source. Document Title: =============== Private Photo+Video v1.1 Pro iOS - Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1249 Release Date: ============= 2014-04-01 Vulnerability Laboratory ID VL-ID:...

MGinternet Property Site Manager listings.asp Multiple Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/21073/info MGinternet Property Site Manager is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues, because it fails to sufficiently sanitize user-supplied input. An...

3R Soft MailStudio 2000 2.0 Arbitrary File Access

No description provided by source. source: http://www.securityfocus.com/bid/1335/info MailStudio 2000 is vulnerable to multiple attacks. It is possible for a remote user to gain read access to all files located on the server via the usage of the /.. string passed to a CGI, thereby compromising th...

Paypal Bug Bounty #36 - SecurityKey Card Vulnerability

Document Title: =============== Paypal Bug Bounty 36 - SecurityKey Card Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=834 Release Date: ============= 2014-06-17 Vulnerability Laboratory ID VL-ID: ==================================== 834...

Session fixation

debian/guest-account in Light Display Manager lightdm 1.0.x before 1.0.6 and 1.1.x before 1.1.7, as used in Ubuntu Linux 11.10, allows local users to delete arbitrary files via a space in the name of a file in /tmp. NOTE: this identifier was SPLIT per ADT1/ADT2 due to different codebases and...

CVE-2014-3717

Summary : The CVE affects Xen 4.4.x on 64-bit ARM, where the load address for guest kernels is not properly validated. This allows a local attacker to read system memory or cause a denial of service (crash) via a crafted kernel, due to a buffer overflow. The connected documents do not provide spe...

Private Photo+Video v1.1 Pro iOS - Persistent Vulnerability

Document Title: =============== Private Photo+Video v1.1 Pro iOS - Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1249 Release Date: ============= 2014-04-01 Vulnerability Laboratory ID VL-ID: ===================================...