Conceptronic Grab'n'Go and Sitecom Storage Center - Password Disclosure

Updated to include Sitecom MD-253 and MD254 Minor textual changes == Conceptronic Grab’n’Go and Sitecom Storage Center - Password disclosure Vulnerability - Security Advisory AA-002 Severity Rating: High Discovery Date: May 5, 2012 Vendor Notification: May 31, 2012 =Impact - System Access -...

Scientific Linux Security Update : eclipse on SL6.x i386/x86_64

The Eclipse software development environment provides a set of tools for C/C++ and Java development. A cross-site scripting XSS flaw was found in the Eclipse Help Contents web application. An attacker could use this flaw to perform a cross-site scripting attack against victims by tricking them in...

glibc, nscd security update

CentOS Errata and Security Advisory CESA-2012:1098 Updated glibc packages that fix three security issues and one bug are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System...

Seagate BlackArmor device static administrator password reset vulnerability

Overview The Seagate BlackArmor network attached storage device contains a static administrator password reset vulnerability. Description The Seagate BlackArmor network attached storage device contain a static php file used to reset the administrator password. A remote unauthenticated attacker wi...

PJBlog 3.2.9.518 getwebshell exploit-vulnerability warning-the black bar safety net

Author: do not go to the bell Version: PJblog 3.2.9.518（2012/5/9, When is the latest version The exploit conditions: 1, Using full static mode by default is a fully static mode 2, The user can post the default regular users can not post, so a little tasteless） Vulnerability description: PJblog...

A CISO's Guide To Application Security – Part 4: Weighing AppSec Technology Options

This post is the fourth in a 5-part series on Application Security, or “AppSec”. The series will define the components of a sound AppSec program, delineate the growing threats to software, weigh the costs of a data breach, and outline the CISO’s responsibility in managing software security risk...

IBM Rational AppScan企业平台验证代码执行漏洞

Bugtraq ID: 53247 CVE ID：CVE-2012-0736 IBM Rational AppScan是一款Web应用的安全测试工具，可以在开发生命周期中进行自动化动态和静态安全漏洞扫描。 IBM Rational AppScan企业版在某些配置下创建扫描作业时存在错误，允许远程攻击者执行任意代码。诱使用户扫描恶意WEB站，可在目标用户系统上执行任意代码。 0 IBM Rational Policy Tester 8.5 IBM Rational AppScan Reporting Console 8.0.1.1 IBM Rational AppScan Reportin...

[SECURITY] Fedora 15 Update: jetty-6.1.26-7.fc15

Jetty is a 100% Java HTTP Server and Servlet Container. This means that you do not need to configure and run a separate web server like Apache in order to use java, servlets and JSPs to generate dynamic content. Jetty is a fully featured web server for static and dynamic content. Unlike separate...

[SECURITY] Fedora 16 Update: jetty-6.1.26-8.fc16

Jetty is a 100% Java HTTP Server and Servlet Container. This means that you do not need to configure and run a separate web server like Apache in order to use java, servlets and JSPs to generate dynamic content. Jetty is a fully featured web server for static and dynamic content. Unlike separate...

KingCMS ASP 5.0/5.1 vulnerability-vulnerability warning-the black bar safety net

KingCMS ASP is based on ASP+ACCESS framework of a very good CMS system, the reception is all static processing, the new generation of KingCMS provides a better interface, more development leeway, more powerful expansion capability, and now also by many webmasters welcome. But in the absence of th...

Movable Type Publishing Platform Cross Site Scripting

Trustwave's SpiderLabs Security Advisory TWSL2012-003: Cross-Site Scripting Vulnerability in Movable Type Publishing Platform https://www.trustwave.com/spiderlabs/advisories/TWSL2012-003.txt Published: 2012-02-24 Version: 1.0 Vendor: Six Apart http://movabletype.org/ Product: Movable Type Version...

MDVA-2012:005 : mysql

This is a maintenance and bugfix release that upgrades mysql to the latest 5.1 version which solves numerous upstream bugs. The updated packages have been upgraded to mysql 5.1.61. %NASLMINLEVEL 70300 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a security...

CVE-2011-4337

The CVE affects Support Incident Tracker (SiT!) versions 3.45–3.65, where translate.php contains a static code injection flaw. An attacker can supply a crafted lang parameter to inject arbitrary PHP code into an executable language file within the i18n directory. The provided documents do not spe...

CVE-2011-4337

Static code injection vulnerability in translate.php in Support Incident Tracker aka SiT! 3.45 through 3.65 allows remote attackers to inject arbitrary PHP code into an executable language file in the i18n directory via the lang variable...

CVE-2012-0392

The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method...

Code injection

Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinymce before 1.4.2, phpMyFAQ 2.6 before 2.6.19 and 2.7 before 2.7.1, and possibly other products, allows remote attackers to inject arbitrary PHP code into data.php via crafted...

CVE-2011-4825

CVE-2011-4825 describes a static code injection vulnerability in the file inc/function.base.php of the Ajax File and Image Manager (used in various products). The flaw allows remote attackers to inject arbitrary PHP code into the file data.php via crafted parameters. Affected versions include Aja...

CVE-2011-4825

Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinymce before 1.4.2, phpMyFAQ 2.6 before 2.6.19 and 2.7 before 2.7.1, and possibly other products, allows remote attackers to inject arbitrary PHP code into data.php via crafted...

SOL13219 - DHCP Client vulnerability CVE-2011-0997

Recommended action To eliminate this vulnerability, upgrade to a version that is listed in the Versions known to be not vulnerable column in the previous table. To mitigate this vulnerability, when configuring the AOM or SCCP for access over the network, you should use a static IP address and not...

FleaHttpd - Remote Denial of Service

FleaHttpd - Remote Denial of Service !/usr/bin/python """ FleaHttpd Remote Denial Of Service Exploit by condis "FleaHttpd is a http daemon written from scratch in C. When working as a static file server, data show that under certain condition, fleahttpd's speed for static file retrieving can be...