X.Org libXtst Integer Overflow Vulnerability

X.Org libXtst is an Xlib-based client API proprietary to the XTEST & RECORD extension operated by the X.Org Foundation. An integer overflow vulnerability exists in X.Org libXtst 1.2.2 and earlier versions that can be exploited by an attacker to perform unauthorized operations...

PHPIPAM 'edit-group.php' Cross-Site Scripting Vulnerability

phpipam is a set of open source PHP and MySQL based IP address management application IPAM. A cross-site scripting vulnerability exists in phpipam version 1.2.2, which can be exploited by remote attackers to inject arbitrary web script or HTML due to the failure of edit/php scripts to adequately...

The vulnerability of the Gentoo Linux operating system allows a malicious intruder to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the libgda package up to version 1.2.2-r1 of the Gentoo Linux operating system can lead to violations of privacy, integrity, and accessibility of protected information. This vulnerability can be exploited remotely...

The vulnerability of the CentOS operating system, which allows a malicious attacker to compromise the accessibility of protected information

The vulnerability of the libpng-1.2.2 package on the CentOS operating system can lead to a violation of the accessibility of protected information. Exploiting this vulnerability can be carried out remotely...

XSS vulnerability in login redirect param

Security advisory: XSS vulnerability in login redirect param ZfcUser version 1.2.2 has been released and includes a security for this vulnerability. Fix has been applied in @baf0e460 Affected versions All versions below 1.2.2 are affected. dev-master is fixed starting from @2cc167a Exploits Becau...

phpMyRecipes 1.2.2 dosearch.php SQL Injection

SQL Injection vulnerabilty in phpMyRecipes dosearch.php Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

Plume CMS 1.2.2 - 'manager/xmedia.php' Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/27999/info Plume CMS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data. An attacker may leverage this issue to execute arbitrary script code in the browser...

BP Group Documents 1.2.1 XSS / CSRF / File Move

Details below. We intended to publish these earlier, but they slipped through the net. The most recent version is 1.5, and all these were reported fixed in 1.2.2. First one: https://security.dxw.com/advisories/stored-xss-vulnerability-in-bp-group-documents-1-2-1/ Details ================ Software...

WordPress BP Group Documents Plugin 1.2.1 - Multiple Vulnerabilities

BP Group Documents plugin is prone to multiple vulnerabilities. 1. Stored XSS - “Display name” and “Description” fields are not escaped. It means that any tags can be stored in them. 2. Cross-site request forgery - the fields are vulnerable and an unauthenticated user can logged in user to edit a...

UBUNTU-CVE-2013-7300

Absolute path traversal vulnerability in cantata before 1.2.2 allows local users to read arbitrary files via a full pathname in a request to the internal httpd server. NOTE: this vulnerability can be leveraged by remote attackers using CVE-2013-7301...

Protection Bypass

Overview Affected versions of this package are vulnerable to Protection Bypass via ng-attr-action and ng-attr-srcdoc allowing binding to Javascript. The fix was to require bindings to formaction to be $sce.RESOURCEURL and bindings to iframesrcdoc to be $sce.HTML Remediation Upgrade angularjs to...

OpenVAS Administrator Authentication Bypass Vulnerability (OVSA20131108)

The remote OpenVAS Administrator is prone to an authentication bypass. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

foreman: app/controllers/api/v1/hosts_controller.rb API privilege escalation

app/controllers/api/v1/hostscontroller.rb in Foreman before 1.2.2 does not properly restrict access to hosts, which allows remote attackers to access arbitrary hosts via an API request...

Oracle Linux 6 : icedtea-web (ELSA-2012-1434)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2012-1434 advisory. 1.2.2-1 - Updated to 1.2.2 - Resolves: CVE-2012-4540 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Not...

phpMyRecipes 1.2.2 SQL Injection

SQL Injection vulnerability in rid parameter Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

glFusion Multiple Cross-Site Scripting Vulnerabilities

glFusion is prone to multiple cross-site scripting vulnerabilities. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Batavi - 'index.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/58151/info Batavi is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the...

phpMyRecipes - Multiple HTML Injection Vulnerabilities

source: https://www.securityfocus.com/bid/58160/info phpMyRecipes is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input. Attacker-supplied HTML and script code could be executed in the context of the affected site, potentially allowing the...

Debian DSA-2585-1 : bogofilter - buffer overflow

A heap-based buffer overflow was discovered in bogofilter, a software package for classifying mail messages as spam or non-spam. Crafted mail messages with invalid base64 data could lead to heap corruption and, potentially, arbitrary code execution. %NASLMINLEVEL 70300 C Tenable Network Security,...

CentOS 6 : icedtea-web (CESA-2012:1434)

Updated icedtea-web packages that fix one security issue are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having critical security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...