Debian Security Advisory DSA 2882-1 (extplorer - security update)

Multiple cross-site scripting XSS vulnerabilities have been discovered in extplorer, a web file explorer and manager using Ext JS. A remote attacker can inject arbitrary web script or HTML code via a crafted string in the URL to application.js.php, admin.php, copymove.php, functions.php, header.p...

SVNManager多个SQL注入漏洞

SVNManager是一个基于Web的SVN资料库的管理工具。 SVNManager存在多个SQL注入漏洞，允许远程攻击者利用漏洞提交特制的SQL查询，操作或获取数据库数据。 0 SVNManager 1.x SVNManager 1.10已经修复该漏洞，建议用户下载更新： http://freecode.com/projects/svnmanager...

Fedora Update for mantis FEDORA-2014-3421

Check for the Version of mantis OpenVAS Vulnerability Test Fedora Update for mantis FEDORA-2014-3421 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the term...

FrontAccounting 'attachments.php'任意文件上传漏洞

Bugtraq ID:66217 FrontAccounting FA是一个针对企业ERP供应链的网页会计系统。 FrontAccounting /admin/attachments.php脚本存在安全漏洞，允许攻击者上传使用恶意扩展名的文件，并以WEB权限执行。 0 FrontAccounting 2.x FrontAccounting 2.3.20已经修复该漏洞，建议用户下载更新： http://frontaccounting.com...

Fedora Update for ReviewBoard FEDORA-2014-3446

Check for the Version of ReviewBoard OpenVAS Vulnerability Test Fedora Update for ReviewBoard FEDORA-2014-3446 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...

[SECURITY] Fedora 20 Update: ReviewBoard-1.7.22-2.fc20

Review Board is a powerful web-based code review tool that offers developers an easy way to handle code reviews. It scales well from small projects to large companies and offers a variety of tools to take much of the stress and time out of the code review process...

[SECURITY] Fedora 19 Update: ReviewBoard-1.7.22-1.fc19

Review Board is a powerful web-based code review tool that offers developers an easy way to handle code reviews. It scales well from small projects to large companies and offers a variety of tools to take much of the stress and time out of the code review process...

[SECURITY] Fedora 19 Update: mantis-1.2.17-1.fc19

Mantis is a free popular web-based issue tracking system. It is written in the PHP scripting language and works with MySQL, MS SQL, and PostgreSQL databases and a web server. Almost any web browser should be able to function as a client. Documentation can be found in: /usr/share/doc/mantis-1.2.17...

Palo Alto Networks PAN-OS < 5.0.10 / 5.1.x < 5.1.5 XSS

The remote host is running a version of Palo Alto Networks PAN-OS prior to 5.0.10 / 5.1.x prior to 5.1.5. It is, therefore, affected by a cross-site scripting vulnerability due to a failure to sanitize user-supplied input to the web-based device management interface. C Tenable Network Security,...

synetics i-doit pro API跨站脚本漏洞

BUGTRAQ ID：65957 CVE ID：CVE-2014-2231 Synetics i-doit是德国Synetics公司的一个基于Web的开源IT文档和CMDB（配置管理数据库），它能够记录IT系统及其变化的信息，同时针对系统变化制定应急方案，最终确保IT网络稳定、高效的运作。 synetics i-doit 1.2.5之前版本的的API存在跨站脚本漏洞，允许远程攻击者通过产权注入任意的web脚本或HTML。 0 synetics GmbH i-doit 1.2.4 synetics GmbH i-doit 1.1.1 synetics GmbH i-doit 1.1.2...

IBM Rational Quality Manager Jazz Team Server未明远程代码执行漏洞

Bugtraq ID:65900 CVE ID:CVE-2014-0862 IBM Rational Quality Manager是一款为完整的软件开发生命周期提供集成的测试计划和测试资产的协作的，基于Web的质量管理软件。 IBM Rational Quality Manager所包含的Jazz Team服务器存在未明错误，允许远程攻击者利用漏洞执行任意代码。 0 IBM Rational Quality Manager 2.x IBM Rational Quality Manager 3.x IBM Rational Quality Manager 4.x 厂商补丁： IBM...

CVE-2013-7032

Multiple cross-site scripting XSS vulnerabilities in the web based operator client in LiveZilla before 5.1.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 name of an uploaded file or 2 customer name in a resource created from an uploaded file, a different vulnerability...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the web based operator client in LiveZilla before 5.1.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 name of an uploaded file or 2 customer name in a resource created from an uploaded file, a different vulnerability...

Cisco WLC Web-Based Management Interface XSS Vulnerability (CSCuf77810)

A vulnerability in the web-based management interface of the Cisco Wireless LAN Controller WLC could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface of the affected system. The vulnerability is due to insufficient input...

Shadowbox Local File Inclusion

Author: TUNISIAN CYBER + Exploit Title: Shadowbox LFI Vulnerability + Date: 03-02-2014 + Category: WebApp + Google Dork: : + Tested on: KaliLinux + Vendor: http://shadowbox-js.com/ + Friendly Sites: na3il.com,th3-creative.com +Description: Shadowbox is a web-based media viewer application that...

Cross-site Scripting Vulnerability

A cross-site scripting vulnerability exists in the web-based device management interface whereby data provided by the user is echoed back to the user without sanitization. Ref 59010...

Patched Microsoft Office 365 XSS Vulnerability Disclosed

A researcher in the UK disclosed the details of a serious cross-site scripting vulnerability in Office 365 that would allow an attacker with a mailbox on Office 365 to gain administrator rights over the Microsoft Web-based application in an organization. An exploit in an enterprise environment...

Google Blocks Malicious File Downloads Automatically in Chome

Google has fixed five vulnerabilities in its Chrome browser and also has activated a feature that will block malicious file downloads automatically. The change is a major security upgrade for Chrome and will help prevent users from unwittingly downloading harmful files, an attack vector that...

Novell Client NetIdentity Agent Remote Pointer Dereference Code Execution - Ver2 (CVE-2009-1350)

The Novell NetIdentity agent works with eDirectory authentication to provide background authentication to Windows Web-based applications that require eDirectory authentication, such as iPrint, Novell Portal Services, eGuide, Novell NetIdentity, ZENworks, NetStorage, and iManager. NetIdentity...

Movable Type Rich Text Editor脚本注入漏洞

Movable Type是一款基于WEB的网络博客系统。 由于通过网页键入的输入在富文本编辑器显示之前缺少过滤。在恶意数据被查看时，攻击者可以利用漏洞在受影响站点上下文的用户浏览器会话中执行任意HTML和脚本代码。 下列产品和版本存在漏洞： Movable Type Pro version 6.0 Movable Type Pro versions 5.2.x, 5.1x, and 5.0x Movable Type Open Source MTOS versions 5.2.x, 5.1x, and 5.0x Movable Type Advanced / Movable Type...