Tembria Server Monitor Multiple Cross-site Scripting (XSS) Vulnerabilities

Tembria Server Monitor Multiple Cross-site Scripting XSS Vulnerabilities Solutionary ID: SERT-VDN-1003 Solutionary Disclosure URL: http://www.solutionary.com/index/SERT/Vuln-Disclosures/Tembria-Server-Monitor-XSS.html CVE ID: Pending Product: Tembria Server Monitor Application Vendor: Tembria...

Comcast / SMC DOCSIS 3.0 Business Gateway - SMCD3G-CCR routers vulnerability

Crossite request forgery, default account...

[MajorSecurity SA-081]Contao CMS 2.9.2 - Persistent Cross Site Scripting Issue

MajorSecurity SA-081Contao CMS 2.9.2 - Persistent Cross Site Scripting Issue Details ============= Product: Contao CMS 2.9.2 Security-Risk: moderated Remote-Exploit: yes Vendor-URL: http://www.contao.org/ Advisory-Status: published Credits ============= Discovered by: David Vieira-Kurz Affected...

PHP 5.3.3 NumberFormatter::getSymbol Integer Overflow

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 PHP 5.3.3 NumberFormatter::getSymbol Integer Overflow Author: Maksymilian Arciemowicz http://securityreason.com/ http://cxib.net/ Date: - - Dis.: 11.11.2010 - - Pub.: 10.12.2010 CERT: VU479900 CVE: CVE-2010-4409 CWE: CWE-189 Status: Fixed in PHP 5.3.4...

XSS vulnerability in Frog CMS

Vulnerability ID: HTB22682 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinfrogcms.html Product: Frog CMS Vendor: Philippe Archambault http://www.madebyfrog.com/ Vulnerable Version: 0.9.5 and probably prior versions Vendor Notification: 09 November 2010 Vulnerability Type: Stored XSS...

CVE-2010-3700: Spring Security bypass of security constraints

CVE-2010-3700 - Spring Security - Bypassing of security constraints Severity: Important Vendor: SpringSource, a division of VMware Versions affected: Spring Security 3.0.0 to 3.0.3 Spring Security 2.0.0 t0 2.0.5 Acegi Security 1.0.0 to 1.0.7 Description: Spring Security does not consider URL path...

Microsoft Security Bulletin MS10-073 - Important Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (981957)

Microsoft Security Bulletin MS10-073 - Important Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege 981957 Published: October 12, 2010 Version: 1.0 General Information Executive Summary This security update resolves several publicly disclosed vulnerabilities in the...

SQL injection vulnerability in TCMS

Vulnerability ID: HTB22577 Reference: http://www.htbridge.ch/advisory/sqlinjectionvulnerabilityintcms3.html Product: TCMS Vendor: Target CMS http://targetcms.com/ Vulnerable Version: 100728 and Probably Prior Versions Vendor Notification: 09 August 2010 Vulnerability Type: SQL Injection Status: N...

ZDI-10-133: Mozilla Firefox CSS font-face Remote Code Execution Vulnerability

ZDI-10-133: Mozilla Firefox CSS font-face Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-133 July 20, 2010 -- CVE ID: CVE-2010-2752 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: Mozilla Firefox -- Affected Products: Mozilla Firefox 3.6.x --...

Microsoft Security Bulletin MS10-041 - Important Vulnerability in Microsoft .NET Framework Could Allow Tampering (981343)

Microsoft Security Bulletin MS10-041 - Important Vulnerability in Microsoft .NET Framework Could Allow Tampering 981343 Published: June 08, 2010 Version: 1.0 General Information Executive Summary This security update resolves a publicly disclosed vulnerability in Microsoft .NET Framework. The...

[DSECRG-09-049] IBM BladeCenter Management Module - DoS vulnerability

Digital Security Research Group DSecRG Advisory DSECRG-09-049 Application: IBM BladeCenter Managmet Module Versions Affected: before BPET50G Vendor URL: http://www-03.ibm.com/systems/bladecenter/ Bug: DoS Exploits: YES Reported: 24.07.2009 Vendor response: 26.07.2009 Date of Public Advisory:...

[SECURITY] [DSA-2018-1] New php5 packages fix null pointer dereference

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-2018-1 [email protected] http://www.debian.org/security/ Raphael Geissert March 18, 2010 http://www.debian.org/security/faq -...

FWD: LedgerSMB Security Advisory: Multiple Vulnerabilities

Hi all; It has been brought to our attention that a number of security vulnerabilities have been noted in SQL-Ledger. Several of these affect earlier versions of LedgerSMB, and three hotfixes have been released for problems that continue to affect the LedgerSMB codebase. As always, we highly...

[SECURITY] [DSA 1966-1] New horde3 packages fix cross-site scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1966-1 [email protected] http://www.debian.org/security/ Steffen Joeris January 07, 2010 http://www.debian.org/security/faq -...

[DSECRG-09-010] Oracle 10g CTXSYS.DRVXTABC - plsql injection

Digital Security Research Group DSecRG Advisory DSECRG-09-010 http://dsecrg.com/pages/vul/show.php?id=110 Application: Oracle Database 10G Versions Affected: Oracle 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.4 Vendor URL: http://oracle.com Bugs: PL/SQL Injections Exploits: YES Reported: 29.01.2008 Vend...

Microsoft Security Bulletin MS09-061 - Critical Vulnerabilities in the Microsoft .NET Common Language Runtime Could Allow Remote Code Execution (974378)

Microsoft Security Bulletin MS09-061 - Critical Vulnerabilities in the Microsoft .NET Common Language Runtime Could Allow Remote Code Execution 974378 Published: October 13, 2009 Version: 1.0 General Information Executive Summary This security update resolves three privately reported...

Microsoft Security Bulletin MS09-055 - Critical Cumulative Security Update of ActiveX Kill Bits (973525)

Microsoft Security Bulletin MS09-060 - Critical Vulnerabilities in Microsoft Active Template Library ATL ActiveX Controls for Microsoft Office Could Allow Remote Code Execution 973965 Published: October 13, 2009 Version: 1.0 General Information Executive Summary This security update resolves...

Microsoft ISA Server / Forefront Threat Management Gateway DoS

DoS with TCP connections to reverse HTTP proxy, crossite scripting...

ftpdmin v. 0.96 RNFR remote buffer overflow exploit

?php / ftpdmin v. 0.96 RNFR remote buffer overflow exploit xp sp3 / case study by Nine:Situations:Group::surfista software site: http://www.sentex.net/mwandel/ftpdmin/ our site: http://retrogod.altervista.org/ bug found by rgod in 2006, RNFR sequences can trigger a simple eip overwrite. We can us...

Oracle Forms Cross site Scripting in (iFcgi60.exe / f60servlet)

Oracle Forms Cross site Scripting in iFcgi60.exe / f60servlet About: Oracle Forms is a tool somewhat like Visual Basic in appearance, but the code inside is PL/SQL which allows a developer to quickly create user-interface applications which access an Oracle database in a very efficient and...

Mozilla Foundation Security Advisory 2008-69

Mozilla Foundation Security Advisory 2008-69 Title: XSS vulnerabilities in SessionStore Impact: Critical Announced: December 16, 2008 Reporter: mozbugra4 Products: Firefox Fixed in: Firefox 3.0.5 Firefox 2.0.0.19 Description Mozilla security researcher mozbugra4 reported vulnerabilities in the...

Mozilla Foundation Security Advisory 2008-68

Mozilla Foundation Security Advisory 2008-68 Title: XSS and JavaScript privilege escalation Impact: Critical Announced: December 16, 2008 Reporter: mozbugra4 Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 3.0.5 Firefox 2.0.0.19 Thunderbird 2.0.0.19 SeaMonkey 1.1.14 Description Mozill...

CS-Cart <= 1.3.5 SQL Injection

GulfTech Security Research September 02, 2008 Vendor : CS-Cart.com URL : http://www.cs-cart.com/ Version : CS-Cart = 1.3.5 Risk : SQL Injection Description: CS-Cart Cart is a full featured online ecommerce application written in php that allows users to build, run and promote an online store. The...

Secunia Research: Calendarix Basic Two SQL Injection Vulnerabilities

====================================================================== Secunia Research 25/08/2008 - Calendarix Basic Two SQL Injection Vulnerabilities - ====================================================================== Table of Contents Affected...

Cisco Security Advisory: Multiple Cisco Products Vulnerable to DNS Cache Poisoning Attacks

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Multiple Cisco Products Vulnerable to DNS Cache Poisoning Attacks Advisory ID: cisco-sa-20080708-dns http://www.cisco.com/warp/public/707/cisco-sa-20080708-dns.shtml Revision 1.0 For Public Release 2008 July 08 1800 UTC GMT...

Multiple vulnerabilities in TietoEnator's Procapita school administration system, at least version "842 Procapita 840SP1"

Product: Procapita school administration system Vendor: TietoEnator Abp Vulnerable versions: unknown Impact: high Found: months ago The login screens of the school administration database system, "login.asp" and "inloggning.asp", as used in an unnammed school district in Finland, contain SQL...

Sun Java System Active Server Pages multiple security vulnerabilities

Information leaks, commands injection, directory traversals, buffer overflows, authentication bypass...

Microsoft Security Bulletin MS08-026 – Critical Vulnerabilities in Microsoft Word Could Allow Remote Code Execution (951207)

Microsoft Security Bulletin MS08-026 – Critical Vulnerabilities in Microsoft Word Could Allow Remote Code Execution 951207 Published: May 13, 2008 Version: 1.0 General Information Executive Summary This security update resolves several privately reported vulnerabilities in Microsoft Word that cou...

Secunia Research: HP OpenView Network Node Manager OpenView5.exe Directory Traversal

====================================================================== Secunia Research 14/04/2008 - HP OpenView Network Node Manager OpenView5.exe Directory Traversal - ====================================================================== Table of Contents Affected...

Apple QuickTime multiple security vulnerabilities

Buffer overflows and memory corruptions aon multiple file and stream formats...

Webwasher Denial of Service Vulnerability

Credit: The disclosure of this issue has been credited to National Australia Bank Security Assurance. Vulnerable: Secure Computing Webwasher 6.6.3 build 3102 and older versions running on CGLinux 4/5, RHEL 4, Debian 4, SLES10 Not vulnerable: Secure Computing Webwasher Builds 3150 and newer all...

Microsoft Security Bulletin MS08-016 – Critical Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (949030)

Microsoft Security Bulletin MS08-016 – Critical Vulnerabilities in Microsoft Office Could Allow Remote Code Execution 949030 Published: March 11, 2008 Version: 1.0 General Information Executive Summary This security update resolves two privately reported vulnerabilities in Microsoft Office that...

CVE-2008-0002: Tomcat information disclosure vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2008-0002: Tomcat information disclosure vulnerability Severity: important Vendor: The Apache Software Foundation Versions Affected: Tomcat 6.0.5 to 6.0.15 Description: If an exception occurs during the processing of parameters eg if the client...

PHP-Nuke NSN Script Depository module <= 1.0.3 Remote Source / DB Credentials Disclosure

--------------------------------------------------------------- / | | / | / |/ | | |/ | | / | | | | | |/ | | // | || | ||| /| / / | |||| /| / / --------------------------------------------------------------- Http://www.inj3ct-it.org Staffatinj3ct-itdotorg...

Black Lily 2007 (products.php class) Remote SQL Injection Vulnerability

SnIper-sa.com SSSSS nnn nn ii ppppppp eeeeeeeee rrrrr ss nn nn nn ii pp p ee rr rr s nn nn nn ii pp p ee rr r ss nn nn nn ii ppppppp ee rr rr sssss nn nn nn ii pp eeeeee rrrr ss nn nn nn ii pp ee rrrr s nn nn nn ii pp ee rr rr ss nn nnn ii pp ee rr rr sssss nn nnn ii pp eeeeeeeeee rr rr VerY-SecR...

iDefense Security Advisory 08.16.07: IBM DB2 Universal Database Multiple Untrusted Search Path Vulnerabilities

IBM DB2 Universal Database Multiple Untrusted Search Path Vulnerabilities iDefense Security Advisory 08.16.07 http://labs.idefense.com/intelligence/vulnerabilities/ Aug 16, 2007 I. BACKGROUND IBM Corp.'s DB2 Universal Database product is a large database server product commonly used for high end...

CVE-2007-3384: XSS in Tomcat cookies example

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2007-3384: XSS in Tomcat cookies example Severity: Low Cross-site scripting Vendor: The Apache Software Foundation Versions Affected: 3.3 to 3.3.2 Description: When reporting error messages, Tomcat does not filter user supplied data before display...

[scip_Advisory 3159] SiteScape forum prior 7.3 Cross Site Scripting

SiteScape forum prior 7.3 Cross Site Scripting scip AG Vulnerability ID 3159 07/13/2007 http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=3159 I. INTRODUCTION SiteScape forum is a commercial web forum. It uses presence to connect teams through phone, IM, chat, SMS and email, as well as voice- and...

Microsoft Security Bulletin MS07-023 Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (934233)

Microsoft Security Bulletin MS07-023 Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution 934233 Published: May 8, 2007 Version: 1.0 Summary Who Should Read this Document: Customers who use Microsoft Excel Impact of Vulnerability: Remote Code Execution Maximum Severity Rating:...

Net Side Content Management System

I see your future and your future is death. Sharingan ! -------------------------------------------------------------------------------------------------------------- Hi I'm sharingan and this is my vuln : script name : Net Side Content Management System 2 versions found both vulnerable | Version...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

[SA23656] b2evolution "redirect_to" HTML Attribute Cross-Site Scripting

---------------------------------------------------------------------- Secunia is proud to announce the availability of the Secunia Software Inspector. The Secunia Software Inspector is a free service that detects insecure versions of software that you may have installed in your system. When...

eClassifieds [injection sql]

vendor site: http://enthrallweb.com/ product : eClassifieds bug:injection sql risk : medium injection sql : /ad.asp?ADID='sql /ad.asp?catid='sql /dircat.asp?cid='sql /dirSub.asp?sid='sql /ad.asp?catid=35&subid='sql /ad.asp?catid=35&subid=102&adid='sql laurent gaffi & benjamin moss http://s-a-p.ca...

Multible injections and vulnerabilities in Jetbox CMS

Hello,, Multible Injections in Jetbox CMS Discovered By : HACKERS PAL & mohajali Copy rights : HACKERS PAL & mohajali Website : http://www.soqor.net Email Address : [email protected] This Contains multible injections and vulnerabilities in Jetbox CMS // sql injections if magicquotesgpc = off...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

NSFOCUS SA2006-07 : ISS RealSecure/BlackICE MailSlot Heap Overflow Detection Remote DoS Vulnerability

NSFOCUS Security Advisory SA2006-07 ISS RealSecure/BlackICE MailSlot Heap Overflow Detection Remote DoS Vulnerability Release Date: 2006-07-27 CVE ID: CVE-2006-3840 http://www.nsfocus.com/english/homepage/research/0607.htm Affected systems & software =================== RealSecure Network Sensor...

VBZooM <=V1.11 " reply.php" SQL Injection

=========================================== Discovered By: C.B.B.L CrAzY CrAcKeR ,Breeeeh ,BoNy-m ,LiNuXrOOt =========================================== Search:- POWERED BY: VBZooM V1.11 Example:- /reply.php?UserID=SQL njection...

[Full-disclosure] URL filter bypass in Fortinet

URL filter bypass in Fortinet Severity: Low Impact: Bypass Fortinet web filter Vulnerabilty type: Design error Affected products: FortiGate v2.8 CVE reference: CAN-2005-3058 Vulnerability Description: ------------------------- It is possible to bypass Fortinet URL blocker by making special HTTP...

JSE XSS vuln.

JSE XSS vuln. Vuln. dicovered by : r0t Date: 2 dec. 2005 orginal advisory:http://pridels.blogspot.com/2005/12/jse-xss-vuln.html Vendor:http://www.me.lv/jse/index.html affected version:0.9.34 Product Description: Java Search Engine is a server-side search engine program for web sites. Search engin...

Microsoft Security Bulletin MS05-042 Vulnerabilities in Kerberos Could Allow Denial of Service, Information Disclosure, and Spoofing (899587)

Microsoft Security Bulletin MS05-042 Vulnerabilities in Kerberos Could Allow Denial of Service, Information Disclosure, and Spoofing 899587 Issued: August 9, 2005 Version: 1.0 Summary Who should read this document: Customers who use Microsoft Windows Impact of Vulnerability: Denial of Service,...