browser-overflows.txt

Multiple Browsers Stack overflow in javascript with infinite array original article:http://lostmon.blogspot.com/ 2008/11/multiple-browsers-stack-overflow-in.html Description Multiple Browsers are prone vulnerables to a stack overflow or crash via infinite array in Javascript engine. This is a...

CVE-2008-4616

The SpamBam plugin for WordPress allows remote attackers to bypass restrictions and add blog comments by using server-supplied values to calculate a shared key...

Gentoo Security Advisory GLSA 200410-22 (MySQL)

The remote host is missing updates announced in advisory GLSA 200410-22. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Gentoo Security Advisory GLSA 200410-22 (MySQL)

The remote host is missing updates announced in advisory GLSA 200410-22. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Abuse of Functionality vulnerability in WP-ContactForm for WordPress

Здравствуйте 3APA3A! Сообщаю вам о найденной мною Abuse of Functionality уязвимости в плагине WP-ContactForm для WordPress. Abuse of Functionality: На странице контактов есть функция “Copy yourself on the form submission”. Она включается в настройках Copy Option и приводит к тому, что через сайт...

Vulnerabilities in Contact Form ][ for WordPress

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Insufficient Anti-automation, Abuse of Functionality и Cross-Site Scripting уязвимостях в плагине Contact Form для WordPress. Insufficient Anti-automation: Отсутствие капчи позволяет слать автоматические сообщения в частности спам админам сайта...

kernel: ptrace: Crash on PTRACE_{ATTACH,DETACH} race

Race condition in the ptrace and utrace support in the Linux kernel 2.6.9 through 2.6.25, as used in Red Hat Enterprise Linux RHEL 4, allows local users to cause a denial of service oops via a long series of PTRACEATTACH ptrace calls to another user's process that trigger a conflict between...

Vulnerabilities in WordPress

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Abuse of Functionality и Weak Password уязвимостях в WordPress. Abuse of Functionality: В WordPress имеется возможность определения логинов в системе. Уязвимость заключается в том, что при введении верного и неверного логина при неверном пароле...

Acrobat Reader Universal CSRF and session riding

Adobe Acrobat Reader Plugin before 8.0.0 for the Firefox, Internet Explorer, and Opera web browsers allows remote attackers to force the browser to make unauthorized requests to other web sites via a URL in the 1 FDF, 2 xml, and 3 xfdf AJAX request parameters, following the hash character, aka...

Debian: Security Advisory (DSA-691-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 691-1 (abuse)

The remote host is missing an update to abuse announced via advisory DSA 691-1. OpenVAS Vulnerability Test $Id: deb6911.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 691-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Re: [Full-disclosure] Mozilla protocol abuse

Since I published this report it has come to my attention that Thunderbird 1.5, unlike Thunderbird 2.0, has not been patched with the "osint" security flag. As such all Thunderbird 1.5 users are vulnerable against this attack and those exploits. Now would be a good time to upgrade to Thunderbird...

Mozilla protocol abuse

The Mozilla application platform currently has an unpatched input validation flaw which allows you to specify arbitrary command line arguments to any registered URL protocol handler process. Jesper Johansson already detailed parts of this on his blog on July 20,...

CVE-2007-1362

Mozilla Firefox 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4, and SeaMonkey 1.0.9 and 1.1.2, allows remote attackers to cause a denial of service via 1 a large cookie path parameter, which triggers memory consumption, or 2 an internal delimiter within cookie path or name values, which could trigg...

Mozilla Foundation Security Advisory 2007-14

Title: Path Abuse in Cookies Impact: Low Announced: May 30, 2007 Reporter: Nicolas Derouet Products: Firefox, SeaMonkey Fixed in: Firefox 2.0.0.4 Firefox 1.5.0.12 SeaMonkey 1.0.9 SeaMonkey 1.1.2 Description Nicolas Derouet reported two problems with cookie handling in Mozilla clients. The first w...

Multiple Firefox flaws (CVE-2007-1562, CVE-2007-2867, CVE-2007-2868, CVE-2007-2869, CVE-2007-2870, CVE-2007-2871)

Mozilla Firefox 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4, and SeaMonkey 1.0.9 and 1.1.2, allows remote attackers to cause a denial of service via 1 a large cookie path parameter, which triggers memory consumption, or 2 an internal delimiter within cookie path or name values, which could trigg...

[Full-disclosure] Teamspeak Server 2.0.20.1 Vulnerabilities

Hi everyone, several months ago I discovered some vulnerabilities in TeamSpeak Server WebAdmin interface. I sent the advisory and exploit to the developers about two months ago 11 03 2007, but the server is still vulnerable, today. Affected software: Teamspeak Server 2.0.20.1 Looks like the beta...

Debian DSA-1284-1 : qemu - several vulnerabilities

Several vulnerabilities have been discovered in the QEMU processor emulator, which may lead to the execution of arbitrary code or denial of service. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-1320 Tavis Ormandy discovered that a memory manageme...

Firefox < 1.5.0.11 / 2.0.0.3 Multiple Vulnerabilities

The FTP client support in the installed version of Firefox has a flaw that could allow a remote attacker with control of an FTP server to perform a rudimentary port scan of, for example, the user's internal network. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid2487...

CVE-2007-1189

Integer overflow in the envwrite function in the Alcatel-Lucent Bell Labs Plan 9 kernel allows local users to overwrite certain memory addresses with kernel memory via a large n argument, as demonstrated by 1 modifying the iseve function to gain privileges and 2 making the devpermcheck function...