Critical: Red Hat Security Advisory: seamonkey security update

Updated seamonkey packages that fix a security issues are now available for Red Hat Enterprise Linux 2.1, Red Hat Enterprise Linux 3 and Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open source Web...

Pooya Site Builder (PSB) 6.0 Multiple SQL Injection Vulnerabilities

Exploit for unknown platform in category web applications =================================================================== Pooya Site Builder PSB 6.0 Multiple SQL Injection Vulnerabilities =================================================================== AmnPardaz Security Research Team Titl...

Pooya Site Builder (PSB) 6.0 - Multiple SQL Injections

Pooya Site Builder PSB 6.0 - Multiple SQL Injections www.BugReport.ir AmnPardaz Security Research Team Title: Pooya Site Builder PSB SQL Injection Vulnerabilities Vendor: www.paridel.com Vulnerable Version: 6.0 Assembly Version Exploit: Available Impact: High Fix: N/A Original Advisory:...

dotCMS search-results.dot search_query Parameter XSS

The remote host is using dotCMS, an open source J2EE / Java web content management system. The version of dotCMS installed on the remote host fails to sanitize input to the 'searchquery' parameter of the 'search-results.dot' script before using it to generate dynamic HTML output. An attacker may ...

LokiCMS admin.php文件绕过安全限制漏洞

BUGTRAQ ID: 29448 LokiCMS是一款简单易用的网络内容管理系统。 LokiCMS的admin.php文件中存在逻辑错误，如果远程攻击者在所提交的HTTP POST请求中设置了LokiACTION和其他参数的话，则无需管理权限就可以设置CMS main settings。 以下是有漏洞的代码段： admin.php Lines:24-42 if isset $POST && isset $POST'LokiACTION' && strlen trim $POST'LokiACTION' 0 // we have an action to do switch trim...

OneCMS load参数本地文件包含漏洞

BUGTRAQ ID: 29374 OneCMS是为网络游戏站点设计的内容管理系统。 OneCMS实现上存在输入验证漏洞，远程攻击者可以通过提交恶意的HTTP请求包含本地资源的任意文件，导致泄露敏感信息。 当act设置为go的时候，OneCMS的installmod.php文件中没有正确过滤对load参数的输入便用于包含文件： $mod = $GET'load'; $filexp = explode".", $mod; $filetype = $filexp1; $file = $filexp0; $file2 = "mods/$mod"; if !isnumeric$mod...

Vulnerability involving security zone handling in applications using Internet Explorer components

Overview Internet Explorer IE components apply different security levels for web content processing depending on the location zone of the web content. As a result, web content on the Internet is processed in the "Internet" zone with a higher security level than that set for web content in the...

Fedora 8 : thunderbird-2.0.0.14-1.fc8 (2008-3557)

Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of some malformed HTML mail content. An HTML mail message containing such malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running...

RHEL 4 / 5 : thunderbird (RHSA-2008:0209)

Updated thunderbird packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws...

Moderate: Red Hat Security Advisory: thunderbird security update

Updated thunderbird packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws...

seamonkey security update

CentOS Errata and Security Advisory CESA-2008:0208 Updated seamonkey packages that fix several security issues are now available for Red Hat Enterprise Linux 2.1, 3, and 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open...

seamonkey security update

CentOS Errata and Security Advisory CESA-2008:0208-01 Updated seamonkey packages that fix several security issues are now available for Red Hat Enterprise Linux 2.1, 3, and 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open...

Java socket connection to any local port via LiveConnect — Mozilla

Security researcher Gregory Fleischer demonstrated that web content fetched via the jar: protocol can use Java via LiveConnect to open socket connections to arbitrary ports on the user's machine "localhost". The issue is caused by improper parsing of the content origin passed from the browser to...

Cmsez(随易)全站系统 0day

漏洞文件：comments.php viewimg.php ? //comments include "mainfile.php"; $art=new article; //设定 $confirm='yes';//yes:需要管理员认证后才能显示,no:直接显示 $member=new member; $userinfo=$member-memberauth; $ulevel=$userinfouserlevel; 设置 $action = $REQUESTaction; $page="10";// $needuser = "0";// $id = $REQUESTid;//...

PR08-02: Plone CMS Security Research - the Art of Plowning

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 PR08-02: Plone CMS Security Research: the Art of Plowning Product description: Plone is a ready-to-run content management system built on the powerful, and free, Zope application server. Plone is easy to set up, extremely flexible, and provides you wi...

Cacti 0.8.7 - graph_view.php?graph_list SQL Injection

Cacti 0.8.7 - graphview.php?graphlist SQL Injection source: https://www.securityfocus.com/bid/27749/info Cacti is prone to multiple unspecified input-validation vulnerabilities, including: - Multiple cross-site scripting vulnerabilities - Multiple SQL-injection vulnerabilities - An HTTP...

Cacti 0.8.7 - graph_view.php?filter Cross-Site Scripting

Cacti 0.8.7 - graphview.php?filter Cross-Site Scripting source: https://www.securityfocus.com/bid/27749/info Cacti is prone to multiple unspecified input-validation vulnerabilities, including: - Multiple cross-site scripting vulnerabilities - Multiple SQL-injection vulnerabilities - An HTTP...

Cacti 0.8.7 - 'graph.php?view_type' Cross-Site Scripting

source: https://www.securityfocus.com/bid/27749/info Cacti is prone to multiple unspecified input-validation vulnerabilities, including: - Multiple cross-site scripting vulnerabilities - Multiple SQL-injection vulnerabilities - An HTTP response-splitting vulnerability. Attackers may exploit these...

Cacti 0.8.7 - 'graph_view.php?filter' Cross-Site Scripting

source: https://www.securityfocus.com/bid/27749/info Cacti is prone to multiple unspecified input-validation vulnerabilities, including: - Multiple cross-site scripting vulnerabilities - Multiple SQL-injection vulnerabilities - An HTTP response-splitting vulnerability. Attackers may exploit these...

CentOS 4 / 5 : firefox (CESA-2008:0103)

Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Firefox is an open source Web browser. Several flaws were found in the way...