William Deich Super 3.x SysLog Format String Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5367/info super is prone to a format string vulnerability. This problem is due to incorrect use of the syslog function to log error messages. It is possible to corrupt memory by passing format strings through the vulnerab...

Geeklog 1.3.x Authentication SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7742/info Geeklog is reported to be prone to SQL injection attacks during authentication. This is due to insufficient sanitization of cookie values, which could permit an attacker to inject SQL code. This issue could be...

Qualiteam X-Cart 3.x general.php perl_binary Parameter Arbitrary Command Execution

No description provided by source. source: http://www.securityfocus.com/bid/9560/info X-Cart has been reported to be prone to an issue that may allow remote attackers to execute arbitrary commands on the affected system. The issue is caused by a failure of the application to sanitize values...

Apple QuickTime/Darwin Streaming MP3Broadcaster 0 ID3 Tag Handling Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7660/info MP3Broadcaster is shipped as part of Darwin Streaming Server software. MP3Broadcaster has been reported prone to a vulnerability when processing malicious ID3 tags. This is likely due to insufficient sanity chec...

PHP Nuke 5.0 'user.php' Form Element Substitution Vulnerabilty

No description provided by source. source: http://www.securityfocus.com/bid/3107/info PHP-Nuke is a website creation/maintenance tool written in PHP3. If a malicious user may subtitute arbitrary values for image form elements in the PHP-Nuke User Registration Form by saving the webpage locallyas...

Webfroot Shoutbox 2.32 URI Parameter File Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7737/info Shoutbox is prone to directory traversal attacks. The vulnerability exists due to insufficient sanitization of user-supplied values to URI parameters. An attacker can exploit this vulnerability by manipulating t...

Linksys WRT54GL apply.cgi Command Execution

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3...

openSUSE Security Update : mozilla-xulrunner191 (mozilla-xulrunner191-2779)

This update brings Mozilla XULRunner to the 1.9.1.11 security release. It fixes following security bugs: MFSA 2010-34 / CVE-2010-1211: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs show...

CVE-2013-1973

The autocomplete callback in Autocomplete Widgets for Text and Number Fields autocompletewidgets module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.0-rc1 does not properly handle node permissions, which allows remote authenticated users to obtain sensitive field values via unspecified vectors...

USN-2230-1 chkrootkit vulnerability

Thomas Stangner discovered that chkrootkit incorrectly quoted certain values. A local attacker could use this issue to execute arbitrary code when chkrootkit is run and gain root privileges...

PT-2014-5637 · WordPress · Participants Database

Name of the Vulnerable Software and Affected Versions: Participants Database plugin versions prior to 1.5.4.9 Description: The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the query parameter in an "output CSV" action to the "pdb-signup/" endpoint...

CVE-2013-6788

The Bitrix e-Store module before 14.0.1 for Bitrix Site Manager uses sequential values for the BITRIXSMSALEUID cookie, which makes it easier for remote attackers to guess the cookie value and bypass authentication via a brute force attack...

Open Web Analytics < 1.5.6 Multiple Vulnerabilities

According to its banner, the version of Open Web Analytics installed on the remote host is prior to version 1.5.6. It is, therefore, affected by the following vulnerabilities : - A cross-site scripting flaw exists with the login page where input to the 'owauserid' parameter is not properly...

Tape Jobs fail with I/O errors or (SCSI) Bus resets

Challenge Failures occur during the File to tape or Backup to tape jobs. The jobname.log shows error messages similar to: error: The request could not be performed because of an I/O device error error: Tape fatal error.\nThe I/O bus was reset Cause Depending on the type of connection, controller ...

CVE-2014-0135

Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable permissions for defaultvalues.yaml, which allows local users to obtain passwords and other sensitive information by reading the file...

DSA-2925-1 rxvt-unicode - security update

Bulletin has no description...

CVE-2013-7064

Cross-site scripting XSS vulnerability in the EU Cookie Compliance module 7.x-1.x before 7.x-1.12 for Drupal allows remote authenticated administrators with the "Administer EU Cookie Compliance popup" permission to inject arbitrary web script or HTML via unspecified configuration values...

Cross site scripting

Cross-site scripting XSS vulnerability in redirect.php in the Socolissimo module modules/socolissimo/ in PrestaShop before 1.4.7.2 allows remote attackers to inject arbitrary web script or HTML via vectors related to "parameter names and values."...

CVE-2012-6641

CVE-2012-6641 is a cross-site scripting (XSS) vulnerability in the PrestaShop Socolissimo module (redirect.php, modules/socolissimo/) that allows injection of arbitrary script/HTML via parameter names and values. Affected software: PrestaShop before 1.4.7.2 (Socolissimo integration). Root cause: ...

Stack overflow

Multiple stack-based buffer overflows in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to cause a denial of service crash or possibly execute arbitrary code via vectors related to an incorrect...