Уязвимости в PHPShop

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Insufficient Anti-automation, Cross-Site Scripting, Denial of Service и Full path disclosure уязвимостях в PHPShop. Это движок для онлайн магазинов. Insufficient Anti-automation WASC-21: http://site/users/register.html На данной странице...

proftpd -- remote code execution vulnerability

Tippingpoint reports: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ProFTPD. Authentication is not required to exploit this vulnerability. The flaw exists within the proftpd server component which listens by default on TCP port 21. When readin...

Unfixed XSS vulnerability at mp3.malikaro.tk

Security researcher Th3 RDX, has submitted on 21/10/2010 a cross-site-scripting XSS vulnerability affecting mp3.malikaro.tk, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 18/12/2011. It is currently...

Unfixed XSS vulnerability at www.lankaholidays.com

Security researcher Th3 RDX, has submitted on 21/10/2010 a cross-site-scripting XSS vulnerability affecting www.lankaholidays.com, which at the time of submission ranked 286150 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 11/12/2011. It is...

CVE-2010-3563

Unspecified vulnerability in the Deployment component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not...

CVE-2010-3555

Unspecified vulnerability in the Deployment component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not...

CVE-2010-3570

Unspecified vulnerability in the Deployment Toolkit component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors...

CVE-2010-3555

Unspecified vulnerability in the Deployment component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not...

CVE-2010-3558

CVE-2010-3558 is linked to Oracle Java SE/Java for Business 6 Update 21, keyed to a Java Web Start component vulnerability. Red Hat advisories enumerate CVE-2010-3558 among multiple OpenJDK/Java Web Start issues (Java Web Start component vulnerability) and reference affected suites and required p...

CVE-2010-3557

The CVE-2010-3557 entry concerns a Swing component vulnerability in Oracle Java SE/Java for Business. Affected products/versions are Oracle Java SE 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28. Root cause and concrete vectors are not publicly detailed in the provided documents; however, the...

CVE-2010-3573

Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21 and 5.0 Update 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU...

CVE-2010-3572

CVE-2010-3572 is described as an unspecified vulnerability in the Sound component of Oracle Java SE and Java for Business across several versions (6 Update 21; 5.0 Update 25; 1.4.2_27; 1.3.1_28) that could allow remote attackers to affect confidentiality, integrity, and availability via unknown v...

CVE-2010-3555

Unspecified vulnerability in the Deployment component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not...

CVE-2010-3563

Unspecified vulnerability in the Deployment component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not...

CVE-2010-3549

Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.227, and 1.3.128 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the...

CVE-2010-3570

Unspecified vulnerability in the Deployment Toolkit component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors...

Adobe Reader Image Parsing Input Validation Code Execution (APSB10-21; CVE-2010-3620)

Portable Document Format PDF is an open file format created by Adobe Systems. It is used for representing two-dimensional documents in a device and resolution independent fixed-layout document format. The vulnerability is due to an error in Adobe Reader and Acrobat that fails to properly parse...

CVE-2010-3565

Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.227 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU...

CVE-2010-3548

Unspecified vulnerability in the Java Naming and Directory Interface JNDI component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.227 allows remote attackers to affect confidentiality via unknown vectors. NOTE: the previous information was obtained from the October...

CVE-2010-3568

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.227 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from...