CVSS: 4.3EPSS: 0%CPEs: 10EXPL: 0CVE-2011-2694 – (SWAT): XSS flaw in Change Password page
https://notcve.org/view.php?id=CVE-2011-2694
Cross-site scripting (XSS) vulnerability in the chg_passwd function in web/swat.c in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allows remote authenticated administrators to inject arbitrary web script or HTML via the username parameter to the passwd program (aka the user field to the Change Password page). Vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en la función chg_passwd en web/swat.c en la herramienta de administración web de Samba (SWAT) en Samba v3.x antes de v3.5.10 permite inyectar scripts web o HTML a administradores remotos autenticados a través del parámetro nombre de usuario del programa passwd (Es decir, el campo de usuario a la página Cambiar contraseña). • http://jvn.jp/en/jp/JVN63041502/index.html http://osvdb.org/74072 http://samba.org/samba/history/samba-3.5.10.html http://secunia.com/advisories/45393 http://secunia.com/advisories/45488 http://secunia.com/advisories/45496 http://securitytracker.com/id?1025852 http://ubuntu.com/usn/usn-1182-1 http://www.debian.org/security/2011/dsa-2290 http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c03008543 http://www.mandriva.com/security/advisories?name&# • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 10EXPL: 2CVE-2011-2522 – SWAT Samba Web Administration Tool - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2011-2522
Multiple cross-site request forgery (CSRF) vulnerabilities in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allow remote attackers to hijack the authentication of administrators for requests that (1) shut down daemons, (2) start daemons, (3) add shares, (4) remove shares, (5) add printers, (6) remove printers, (7) add user accounts, or (8) remove user accounts, as demonstrated by certain start, stop, and restart parameters to the status program. Varias vulnerabilidades de falsificación de petición en sitios cruzados (CSRF) en la herramienta Samba Web Administration (SWAT) en Samba v3.x antes de v3.5.10 permite a atacantes remotos secuestrar la autenticación de los administradores para las peticiones que (1) apagan los demonios, (2) inician los demonios, (3) agregan recursos compartidos, (4) quitan recursos compartidos, (5) agregan impresoras, (6) eliminan impresoras (7), agregan cuentas de usuario, o (8) quitan cuentas de usuario, como lo demuestran ciertos parámetros de inicio, parada, y reinicio del programa de estado. • https://www.exploit-db.com/exploits/17577 http://jvn.jp/en/jp/JVN29529126/index.html http://marc.info/?l=bugtraq&m=133527864025056&w=2 http://osvdb.org/74071 http://samba.org/samba/history/samba-3.5.10.html http://secunia.com/advisories/45393 http://secunia.com/advisories/45488 http://secunia.com/advisories/45496 http://securityreason.com/securityalert/8317 http://securitytracker.com/id?1025852 http://ubuntu.com/usn/usn-1182-1 http://www.debian.org/secu • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2011-2688
https://notcve.org/view.php?id=CVE-2011-2688
SQL injection vulnerability in mysql/mysql-auth.pl in the mod_authnz_external module 3.2.5 and earlier for the Apache HTTP Server allows remote attackers to execute arbitrary SQL commands via the user field. Vulnerabilidad de inyección SQL en mysql/mysql-auth.pl en el módulo de mod_authnz_external v3.2.5 y anteriores para Apache HTTP Server, permite a atacantes remotos ejecutar comandos SQL a través del campo de usuario. • http://anders.fix.no/software/#unix http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=633637 http://code.google.com/p/mod-auth-external/issues/detail?id=5 http://secunia.com/advisories/45240 http://www.debian.org/security/2011/dsa-2279 http://www.openwall.com/lists/oss-security/2011/07/12/10 http://www.openwall.com/lists/oss-security/2011/07/12/17 http://www.securityfocus.com/bid/48653 https://exchange.xforce.ibmcloud.com/vulnerabilities/68799 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 11EXPL: 0CVE-2011-2192 – curl: Improper delegation of client credentials during GSS negotiation
https://notcve.org/view.php?id=CVE-2011-2192
The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl and other products, always performs credential delegation during GSSAPI authentication, which allows remote servers to impersonate clients via GSSAPI requests. La función Curl_input_negotiate en http_negotiate.c en libcurl v7.10.6 a v7.21.6, tal y como se utiliza en curl y otras aplicaciones, siempre lleva a cabo delegación de credenciales durante la autenticación GSSAPI, lo que permite a hacerse pasar por clientes legitimos a servidores remotos a través de peticiones GSSAPI. • http://curl.haxx.se/curl-gssapi-delegation.patch http://curl.haxx.se/docs/adv_20110623.html http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062287.html http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061992.html http://secunia.com/advisories/45047 http://secunia.com/advisories/45067 http://secunia.com/advisories/45088 http://secunia.com/advisories/45144 http://secunia.com/ • CWE-255: Credentials Management Errors •
CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 0CVE-2011-1799
https://notcve.org/view.php?id=CVE-2011-1799
Google Chrome before 11.0.696.68 does not properly perform casts of variables during interaction with the WebKit engine, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. Google Chrome con anterioridad a v11.0.696.68 no realiza correctamente los conversión de las variables durante la interacción con el motor WebKit, que permite a atacantes remotos provocar una denegación de servicio o posiblemente tener un impacto no especificado a través de vectores desconocidos. • http://code.google.com/p/chromium/issues/detail?id=64046 http://googlechromereleases.blogspot.com/2011/05/stable-channel-update.html http://www.debian.org/security/2011/dsa-2245 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14029 • CWE-704: Incorrect Type Conversion or Cast •