JVN#01162446 Cross-site scripting vulnerabilities in multiple Hal Networks shopping cart products

Multiple Hal Networks shopping cart software products are vulnerable to cross-site scripting. Impact An arbitrary script can be executed on the user's web browser. Solution Update the Software Apply the latest updates provided by the vendor. For more information, refer to the vendor's website...

Debian Security Advisory DSA 1405-1 (zope-cmfplone)

The remote host is missing an update to zope-cmfplone announced via advisory DSA 1405-1. OpenVAS Vulnerability Test $Id: deb14051.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1405-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Debian Security Advisory DSA 948-1 (kdelibs)

The remote host is missing an update to kdelibs announced via advisory DSA 948-1. Maksim Orlovich discovered that the kjs Javascript interpreter, used in the Konqueror web browser and in other parts of KDE, performs insufficient bounds checking when parsing UTF-8 encoded Uniform Resource...

Debian Security Advisory DSA 1405-2 (zope-cmfplone)

The remote host is missing an update to zope-cmfplone announced via advisory DSA 1405-2. OpenVAS Vulnerability Test $Id: deb14052.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1405-2 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Debian Security Advisory DSA 1396-1 (icedove)

The remote host is missing an update to icedove announced via advisory DSA 1396-1. OpenVAS Vulnerability Test $Id: deb13961.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1396-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Debian: Security Advisory (DSA-1228-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-1344-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 1226-1 (links)

The remote host is missing an update to links announced via advisory DSA 1226-1. Teemu Salmela discovered that the links character mode web browser performs insufficient sanitising of smb:// URIs, which might lead to the execution of arbitrary shell commands. OpenVAS Vulnerability Test $Id:...

Debian Security Advisory DSA 518-1 (kdelibs)

The remote host is missing an update to kdelibs announced via advisory DSA 518-1. OpenVAS Vulnerability Test $Id: deb5181.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 518-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Debian Security Advisory DSA 1405-3 (zope-cmfplone)

The remote host is missing an update to zope-cmfplone announced via advisory DSA 1405-3. OpenVAS Vulnerability Test $Id: deb14053.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1405-3 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Debian Security Advisory DSA 210-1 (lynx, lynx-ssl)

The remote host is missing an update to lynx, lynx-ssl announced via advisory DSA 210-1. OpenVAS Vulnerability Test $Id: deb2101.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 210-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

US-CERT Technical Cyber Security Alert TA08-016A -- Apple QuickTime Updates for Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA08-016A Apple QuickTime Updates for Multiple Vulnerabilities Original release date: January 16, 2008 Last revised: -- Source: US-CERT Systems Affected Apple Mac OS X running versions of...

Debian: Security Advisory (DSA-1405-2)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Apple QuickTime RTSP Response message Reason-Phrase buffer overflow vulnerability

Overview Apple QuickTime contains a buffer overflow vulnerability that may allow a remote, unauthenticated attacker to cause a denial-of-service condition and possibly execute arbitrary code. Description Real Time Streaming Protocol RTSP is a protocol that is used by streaming media systems. Appl...

Firefox “Basic Realm”基础认证头欺骗漏洞

BUGTRAQ ID: 27111 Firefox是一款开源的WEB浏览器。 Firefox会在所访问的Web服务器返回401状态代码时显示认证对话和WWW-Authenticate头。如果要指定基础认证，WWW-Authenticate头必须设置了Basic realm="XXX"值，然后会在认证对话窗口中显示Realm的值（也就是XXX）。 尽管Firefox不会显示双引号（"）后WWW-Authenticate头Realm值中的字符，但没有过滤单引号（'）和空格，因此攻击者就可以创建特制的Realm值，使认证对话看起来好像来自于可信任的站点，这样就可以执行网络钓鱼攻击。 Mozil...

Adobe Flash Player ActionScript launch command execution

Added: 01/07/2008 CVE: CVE-2008-5499 BID: 32896 OSVDB: 50796 Background Adobe Flash Player is a cross-platform browser plug-in providing visual enhancements for web pages. Problem An input validation vulnerability allows command execution when the browser loads an SWF file which contains shell...

CVE-2007-6652

cpie.php in XCMS 1.83 and earlier sends a redirect to the web browser but does not exit, which allows remote attackers to conduct direct static code injection attacks and execute arbitrary code via the testo0 parameter in a cpie admin action to index.php, which writes to dati/generali/footer.dtb...

Opera: Multiple vulnerabilities

Background Opera is a fast Web browser that is available free of charge. Description David Bloom reported two vulnerabilities where plug-ins CVE-2007-6520 and Rich text editing CVE-2007-6522 could be used to allow cross domain scripting. Alexander Klink Cynops GmbH discovered an issue with TLS...

CVE-2007-6550

form.php in PMOS Help Desk 2.4 and earlier sends a redirect to the web browser but does not exit, which allows remote attackers to conduct eval injection attacks and execute arbitrary PHP code via the options array parameter...

Microsoft IE navcancl.htm跨站脚本执行漏洞（MS07-033）

BUGTRAQ ID: 22966 CVECAN ID: CVE-2007-1499 Internet Explorer是微软发布的非常流行的WEB浏览器。 IE在处理页面导航的操作上存在漏洞，远程攻击者可能利用此漏洞实现跨站脚本执行。 如果由于某种原因取消了到特定页面的导航的话，IE 7浏览器会使用navcancl.htm本地资源，在取消导航时特定页面的URL在“”符号后提供给了navcancl.htm，如res://ieframe.dll/navcancl.htmhttp://www.site.com...