8377 matches found
CVE-2007-5795
The hack-local-variables function in Emacs before 22.2, when enable-local-variables is set to :safe, does not properly search lists of unsafe or risky variables, which might allow user-assisted attackers to bypass intended restrictions and modify critical program variables via a file containing a...
CVE-2007-5682
Incomplete blacklist vulnerability in tiki-graphformula.php in TikiWiki before 1.9.8.2 allows remote attackers to execute arbitrary code by using variable functions and variable variables to write variables whose names match the whitelist, a different vulnerability than CVE-2007-5423...
S21SEC-038-en: Alcatel Omnivista 4760 Cross-Site Scripting
S21Sec Advisory - Title: Alcatel Omnivista 4760 Cross-Site Scripting ID: S21SEC-038-en Severity: Medium - History: 10.Jun.2007 Vulnerability discovered 20.Jun.2007 Vendor contacted 19.Oct.2007 Advisory released Authors: Juan de la Fuente Costa [email protected] Pablo Seijo Cajaraville...
CVE-2002-2278
Cross-site scripting XSS vulnerability in modsearch/index.php in PortailPHP 0.99 allows remote attackers to inject arbitrary web script or HTML via the 1 $AppTheme, 2 $RubSearch, 3 $RubNews, 4 $RubFile, 5 $RubLiens, or 6 $RubFaq variables...
openSUSE 10 Security Update : apparmor (apparmor-1842)
This update fixes security problems in the AppArmor confinment technology. Since it adds new flags to the profile syntax, you likely should review and adapt your profiles. - If a profile allowed unconfined execution 'ux' of a child binary it was possible to inject code via LDPRELOAD or similar...
IBM DB2 < 8 Fix Pack 15 / 9.x < 9 Fix Pack 3 Multiple Vulnerabilities
Binary data 4239.prm...
Velocity does not automatically escape HTML entities when substituting variables
Velocity should automatically escape encode HTML entities in variables it interpolates in markup. This would remove the need for explicitly escaping variables using $generalUtil.htmlEncode, and fix lots of XSS bugs including ones we haven't discovered yet. This affects all versions of Confluence...
Velocity does not automatically escape HTML entities when substituting variables
Velocity should automatically escape encode HTML entities in variables it interpolates in markup. This would remove the need for explicitly escaping variables using $generalUtil.htmlEncode, and fix lots of XSS bugs including ones we haven't discovered yet. This affects all versions of Confluence...
Velocity does not automatically escape HTML entities when substituting variables
Velocity should automatically escape encode HTML entities in variables it interpolates in markup. This would remove the need for explicitly escaping variables using $generalUtil.htmlEncode, and fix lots of XSS bugs including ones we haven't discovered yet. This affects all versions of Confluence...
ASP Product catalog SQL injection vulnerability
ASP Product catalog SQL injection vulnerability. A nice little SQL injection vulnerability exists within ASP Product Catalog. The application fails to check for bad input from GET'd variables used in SQL query operations. In this case, the variable cid can be used for SQL injection queries...
aspcatalog-sql.txt
ASP Product catalog SQL injection vulnerability. A nice little SQL injection vulnerability exists within ASP Product Catalog. The application fails to check for bad input from GET'd variables used in SQL query operations. In this case, the variable cid can be used for SQL injection queries...
CVE-2007-4727
Buffer overflow in the fcgienvadd function in modproxybackendfastcgi.c in the modfastcgi extension in lighttpd before 1.4.18 allows remote attackers to overwrite arbitrary CGI variables and execute arbitrary code via an HTTP request with a long content length, as demonstrated by overwriting the...
ACG News 1.0 (aid/catid) Remote SQL Injection Vulnerabilities
No description provided by source. ACG News SQL Injection Software: ACG News 1.0 Vendor link: http://www.altercoder.com Vendor Demo link: http://acgnews.uw.hu/index.php Attack: SQL Injection Original Advisory: http://14house.blogspot.com/2007/08/acg-news-sql-injection.html Discovered by: David...
DSA-1362-1 lighttpd - several vulnerabilities
Bulletin has no description...
acg-sql.txt
ACG News SQL Injection Software: ACG News 1.0 Vendor link: http://www.altercoder.com Vendor Demo link: http://acgnews.uw.hu/index.php Attack: SQL Injection Original Advisory: http://14house.blogspot.com/2007/08/acg-news-sql-injection.html Discovered by: David Sopas Ferreira a.k.a SmOk3 SQL...
ACG News 1.0 (aid/catid) Remote SQL Injection Vulnerabilities
Exploit for unknown platform in category web applications ============================================================= ACG News 1.0 aid/catid Remote SQL Injection Vulnerabilities ============================================================= ACG News SQL Injection Software: ACG News 1.0 Vendor...
[SECURITY] Fedora 7 Update: pam_ssh-1.92-2.fc7
This PAM module provides single sign-on behavior for UNIX using SSH keys. Users are authenticated by decrypting their SSH private keys with the password provided. In the first PAM login session phase, an ssh-agent process is started and keys are added. The same agent is used for the following PAM...
Design/Logic Flaw
Untrusted search path vulnerability in the wrapper scripts for the 1 rug, 2 zen-updater, 3 zen-installer, and 4 zen-remover programs on SUSE Linux 10.1 and Enterprise 10 allows local users to gain privileges via modified a LDLIBRARYPATH and b MONOGACPREFIX environment variables...
CVE-2007-4432
Untrusted search path vulnerability in the wrapper scripts for the 1 rug, 2 zen-updater, 3 zen-installer, and 4 zen-remover programs on SUSE Linux 10.1 and Enterprise 10 allows local users to gain privileges via modified a LDLIBRARYPATH and b MONOGACPREFIX environment variables...
CVE-2007-4432
CVE-2007-4432 affects the wrapper scripts for rug, zen-updater, zen-installer, and zen-remover on SUSE Linux 10.1 and SUSE Linux Enterprise 10. The issue is an untrusted search path vulnerability caused by environment variables LD_LIBRARY_PATH and MONO_GAC_PREFIX, allowing local privilege escalat...