PT-2013-3408 · Red Hat · Red Hat Subscription Asset Manager

Name of the Vulnerable Software and Affected Versions: Red Hat Subscription Asset Manager versions prior to 1.2.1 Description: A cross-site scripting XSS issue exists in the Notifications form, allowing remote attackers to inject arbitrary web script or HTML via the username field. This could...

Katello: Notifications page Username XSS

Cross-site scripting XSS vulnerability in the Notifications form in Red Hat Subscription Asset Manager before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the username field...

Path traversal

admin/core/adminfunc.php in razorCMS before 1.2.1 does not properly restrict access to certain administrator directories and files, which allows remote authenticated users to read, edit, rename, move, copy and delete files via the 1 dir parameter in a fileman or 2 filemanview action. NOTE: this...

Null pointer dereference

OpenTTD 0.6.0 through 1.2.1 does not properly validate requests to clear a water tile, which allows remote attackers to cause a denial of service NULL pointer dereference and server crash via a certain sequence of steps related to "the water/coast aspect of tiles which also have railtracks on one...

WordPress Plugin ORGanizer - Multiple Vulnerabilities

WordPress Plugin ORGanizer - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/54039/info The Organizer plugin for WordPress is prone to the following security vulnerabilities: 1. A cross-site scripting vulnerability. 2. An information-disclosure vulnerability. 3. A...

libjpeg-turbo -- heap-based buffer overflow

The Changelog for version 1.2.1 says: Fixed a regression caused by 1.2.06 in which decompressing corrupt JPEG images specifically, images in which the component count was erroneously set to a large value would cause libjpeg-turbo to segfault. A Heap-based buffer overflow was found in the way...

11in1 CMS 1.2.1 - 'index.php?class' Traversal Local File Inclusion

source: https://www.securityfocus.com/bid/52025/info 11in1 is prone to a cross-site request-forgery and a local file include vulnerability. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal...

Meditate Web Content Editor 'username_input' SQL-Injection vulnerability

Advisory: Meditate Web Content Editor 'usernameinput' SQL-Injection vulnerability Advisory ID: SSCHADV2011-039 Author: Stefan Schurtz Affected Software: Successfully tested on Meditate 1.2 Vendor URL: http://www.arlomedia.com/ Vendor Status: fixed ========================== Vulnerability...

Meditate Web Content Editor 1.2 SQL Injection

Advisory: Meditate Web Content Editor 'usernameinput' SQL-Injection vulnerability Advisory ID: SSCHADV2011-039 Author: Stefan Schurtz Affected Software: Successfully tested on Meditate 1.2 Vendor URL: http://www.arlomedia.com/ Vendor Status: fixed ========================== Vulnerability...

Meditate Web Content Editor (username_input) SQL Injection

Exploit for php platform in category web applications Advisory: Meditate Web Content Editor 'usernameinput' SQL-Injection vulnerability Author: Stefan Schurtz Affected Software: Successfully tested on Meditate 1.2 Vendor URL: http://www.arlomedia.com/ Vendor Status: fixed ========================...

Meditate Web Content Editor 'username_input' - SQL Injection

Advisory: Meditate Web Content Editor 'usernameinput' SQL-Injection vulnerability Advisory ID: SSCHADV2011-039 Author: Stefan Schurtz Affected Software: Successfully tested on Meditate 1.2 Vendor URL: http://www.arlomedia.com/ Vendor Status: fixed ========================== Vulnerability...

Community Events <= 1.2.1 - SQL Injection

The Community Events WordPress plugin was affected by a SQL Injection security vulnerability. curl --data "id=-1 AND EXTRACTVALUE1, CONCATCHAR58,@@version,CHAR58-- " http://www.site.com/wp-content/plugins/community-events/tracker.php...

Muraus Open Blog - Multiple HTML Injection Vulnerabilities

Muraus Open Blog - Multiple HTML Injection Vulnerabilities source: https://www.securityfocus.com/bid/42255/info Tomaž Muraus Open Blog is prone to multiple HTML-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in dynamically generat...

Mantis Attachment HTML Injection Vulnerability

Mantis is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing...

Gentoo Security Advisory GLSA 200909-16 (wireshark)

The remote host is missing updates announced in advisory GLSA 200909-16. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

AN Guestbook Local File Inclusion Vulnerability

AN Guestbook is prone to Local File Inclusion vulnerability. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

RQms (Rash) 1.2.2 - Multiple SQL Injections

Product : RQMS Version : 1.2.2 Dork : Rash Version: 1.2.1 Site: http://rqms.sourceforge.net Found by: Dimi4 Greetz: UASC http://uasc.org.ua, antichat Multiple Remote Vulnerabilities Need: magicquotesgpc = OFF 1Auth BYPASS http://127.0.0.1/rash-v1.2.2/?admin Login: ' OR 1=1/ 2 Sql-injection...

PT-2008-6517 · Mvnforum · Mvnforum

Name of the Vulnerable Software and Affected Versions: mvnForum versions prior to 1.2.1 GA Description: The issue allows remote attackers to perform various actions as a product administrator, including creating forums, changing account privileges, enabling accounts, or disabling accounts. This i...

freeSSHd 1.2.1 Remote Stack Overflow PoC (auth)

Exploit for unknown platform in category dos / poc =============================================== freeSSHd 1.2.1 Remote Stack Overflow PoC auth =============================================== FreeSSHD remote Buffer Overflow Website: http://freesshd.com/ Version:1.2.1 Bug: Remote Buffer Overflow ...

Java Cryptography Extension 1.2.1 (JCE 1.2.1) will no longer function properly after July 28, 2005 due to the expiration of its digital certificate

Overview The digital certificate that was used to sign jar files in the Java Cryptography Extension JCE 1.2.1 expires on July 28, 2005. JCE 1.2.1 limits program behaviors after the expiration of the digital certificate. As a result, specific methods of JCE 1.2.1 will no longer work properly after...