Code injection

Apple Safari allows remote attackers to discover a redirect's target URL, for the session of a specific user of a web site, by placing the site's URL in the HREF attribute of a stylesheet LINK element, and then reading the document.styleSheets0.href property value...

CVE-2010-0314: Undefined Security Weakness

Apple Safari allows remote attackers to discover a redirect's target URL, for the session of a specific user of a web site, by placing the site's URL in the HREF attribute of a stylesheet LINK element, and then reading the document.styleSheets0.href property value...

HDWiki-V4. 0. 5 proof 0day cross site vulnerability-vulnerability warning-the black bar safety net

Effects: the HDWiki-V4. 0. 5 Degree of harm: high-risk Vulnerability description: Ann-day lab Safety research and Emergency Response Center of Antiy CERT by penetration testing found the HDWiki-V4. 0. 5 This version in the Create and edit entries, for inside the HTML element does not have very go...

Gnome Panel 2.28.0 Denial Of Service

Exploit Title: Gnome panel After executing this poc a backup file will be created You can restore it by typing ./paneldos restore Using option restart gnome-panel will restart continuously Using option totalblock you will need to remove the battery After execution click application in the panel,...

Gnome Panel <= 2.28.0 Denial of Service PoC 0-day

Exploit for unknown platform in category dos / poc ================================================= Gnome Panel include int mainint argc, char argv FILE f; unsigned long i; printf"%s","Gnome panel = 2.28.0 denial of service by Pietro Oliva poc 0-day\n\n"; if!f=fopen".gtk-bookmarks","r"...

Linux Kernel ext4_fill_flex_info函数拒绝服务漏洞

CVE ID: CVE-2009-4307 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的ext4子系统fs/ext4/super.c文件中的ext4fillflexinfo函数中存在拒绝服务漏洞。如果用户所加载的 ext4文件系统中的超级块带有超大的FLEXBG组大小（也称为sloggroupsperflex值），groupsperflex就会溢出，导致0除数错误，系统可能会崩溃。 Linux kernel 2.6.x 厂商补丁： Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Real Estate Portal X.0 SQL Injection

view source print? Real Estate Portal X.0 Auth Bypass Remote Sql Injection Author : AnTi SeCuRe Email : [email protected] TeaM : SauDi ViRuS TeaM Site : WwW.VxX9.Cc Note :Its Not Free .. Its By : $199.00 IF You Want To Buy It : http://www.netartmedia.net/enPricing.html Demo :...

Real Estate Portal X.0 (Auth Bypass) Remote Sql Injection

Exploit for unknown platform in category web applications ========================================================= Real Estate Portal X.0 Auth Bypass Remote Sql Injection ========================================================= Note :Its Not Free .. Its By : $199.00 IF You Want To Buy It :...

Real Estate Portal X.0 - Authentication Bypass

Real Estate Portal X.0 Auth Bypass Remote Sql Injection Author : AnTi SeCuRe Email : [email protected] TeaM : SauDi ViRuS TeaM Site : WwW.VxX9.Cc Note :Its Not Free .. Its By : $199.00 IF You Want To Buy It : http://www.netartmedia.net/enPricing.html Demo : http://www.site.com/realestate20/...

Real Estate Portal X.0 - Authentication Bypass

Real Estate Portal X.0 - Authentication Bypass Real Estate Portal X.0 Auth Bypass Remote Sql Injection Author : AnTi SeCuRe Email : [email protected] TeaM : SauDi ViRuS TeaM Site : WwW.VxX9.Cc Note :Its Not Free .. Its By : $199.00 IF You Want To Buy It :...

linux/x86 setuid(0) & execve("/sbin/poweroff -f") 47 bytes

Exploit for linux/x86 platform in category shellcode ========================================================== linux/x86 setuid0 & execve"/sbin/poweroff -f" 47 bytes ========================================================== include / linux/x86 ; setuid0 & execve"/sbin/poweroff -f" 47 bytes...

CVE-2009-3941

Martin Lambers mpop before 1.0.19, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the 1 subject's Common Name or 2 Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted...

CVE-2009-3942

Martin Lambers msmtp before 1.4.19, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the 1 subject's Common Name or 2 Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted...

LibTIFF 'LZWDecodeCompat()' Remote Buffer Underflow Vulnerability

No description provided by source. Bugtraq ID: 35451 Class: Boundary Condition Error Published: Jun 21 2009 12:00AM Updated: Nov 12 2009 06:46PM Credit: wololo Vulnerable: Ubuntu Ubuntu Linux 9.04 sparc Ubuntu Ubuntu Linux 9.04 powerpc Ubuntu Ubuntu Linux 9.04 lpia Ubuntu Ubuntu Linux 9.04 i386...

Unfixed XSS vulnerability at www.unfpanepal.org

Security researcher 444Team, has submitted on 11/02/2009 a cross-site-scripting XSS vulnerability affecting www.unfpanepal.org, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 05/07/2010. It is currently...

Design/Logic Flaw

muttssl.c in mutt 1.5.19 and 1.5.20, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a...

Integer overflow

Integer overflow in the createsurfacefromthumbnaildata function in glib/poppler-page.cc in Poppler 0.x allows remote attackers to cause a denial of service memory corruption or possibly execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow. NOTE: some of the...

CVE-2009-3607

Integer overflow in the createsurfacefromthumbnaildata function in glib/poppler-page.cc in Poppler 0.x allows remote attackers to cause a denial of service memory corruption or possibly execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow. NOTE: some of the...

Overland Guardian OS 5.1.041 - Local Privilege Escalation

Device: Snap Server 410 OS: GuardianOS 5.1.041 Description: When logged in to CLI via ssh as admin uid=1 you can escalate your privileges to uid 0 and get /bin/sh. In order to achieve this open 'less' which is available as default for viewing files ie. less /tmp/top.log and type in '!/bin/sh'. Th...

SLES11: Security update for glib2

The remote host is missing updates to packages that affect the security of your system. One or more of the following packages are affected: glib2 glib2-doc glib2-lang libgio-20-0 libglib-20-0 libgmodule-20-0 libgobject-20-0 libgthread-20-0 More details may also be found by searching for the SuSE...