9121 matches found
CentOS 3 / 5 : pidgin (CESA-2009:1218)
Updated pidgin packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Pidgin is an instant messaging program which can log in to multiple accounts on multip...
Adobe Patches 'Critical' ColdFusion, JRun Flaws
Adobe’s never-ending run on the security treadmill hit a new gear this week with the release of patches to cover serious vulnerabilities in the ColdFusion and JRun web design and development platforms. The patches, rated critical, cover a total of 7 vulnerabilities, some of which “could lead to t...
Perl$hop E-Commerce Input Injection
A while back I was playing around with Perl$hop, which if you are not aware, is an e-commerce script developed by Waverider Systems. XSS Cross Site Scripting, Directory Traversal, Code Execution, and more! Wow, that sure is a lot of vulnerabilities for one product. It would seem as if the...
Perl$hop E-Commerce Script - Trust Boundary Input Parameter Injection
A while back I was playing around with Perl$hop, which if you are not aware, is an e-commerce script developed by Waverider Systems. XSS Cross Site Scripting, Directory Traversal, Code Execution, and more! Wow, that sure is a lot of vulnerabilities for one product. It would seem as if the...
Design/Logic Flaw
The localhandlercallback function in server/responder/pam/pamLOCALdomain.c in sssd 0.4.1 does not properly handle blank-password accounts in the SSSD BE database, which allows context-dependent attackers to obtain access by sending the account's username, in conjunction with an arbitrary password...
CVE-2009-2410
The localhandlercallback function in server/responder/pam/pamLOCALdomain.c in sssd 0.4.1 does not properly handle blank-password accounts in the SSSD BE database, which allows context-dependent attackers to obtain access by sending the account's username, in conjunction with an arbitrary password...
CVE-2009-2410
The localhandlercallback function in server/responder/pam/pamLOCALdomain.c in sssd 0.4.1 does not properly handle blank-password accounts in the SSSD BE database, which allows context-dependent attackers to obtain access by sending the account's username, in conjunction with an arbitrary password...
Deserialization of untrusted data
index.php in MiniTwitter 0.2 beta allows remote authenticated users to modify certain options of arbitrary accounts via an opt action...
CVE-2009-2574
index.php in MiniTwitter 0.2 beta allows remote authenticated users to modify certain options of arbitrary accounts via an opt action...
CVE-2009-2574
CVE-2009-2574 affects MiniTwitter 0.2 beta. The flaw in index.php lets remote authenticated users modify certain options of arbitrary accounts via an opt action. Exploitation is documented (Exploit-DB) and related references link to insecure parameter handling; CVSS from NVD indicates a medium ri...
Clone the admin is! CA. EXE to make the hack become a super user-vulnerability warning-the black bar safety net
利用 SA.exe the Iusrvictim clone as Administrator. C:\ca \\192.168.0.1 test test iusrvictim password Clone the Administrator, by netXeyes 2002/04/06 Written by netXeyes 2 0 0 2, [email protected] Connect 192.168.0.1.... OK Get the SID of iusrvictim.... OK Prepairing.... OK Processing.... OK Clean...
Password Strength and Keeping Online Accounts Safe
From Google Online Security Blog Macduff Hughes There’s been some discussion today about the security of online accounts, so we wanted to share our perspective. These are topics that we take very seriously because we know how important they are to our users. We run our own business on Google Apps...
Twitter Suspends Accounts of Users With Infected Computers
From IDG News Service Jeremy Kirk Twitter is suspending the accounts of some users whose computers have fallen victim to a well-known piece of malicious software that has targeted other sites such as Facebook and MySpace. The malware, Koobface, is designed to spread itself by checking to see if...
High security hole in NullLogic Groupware
Hi, I've identified a couple of security flaws affecting the NullLogic Groupware which may allow compromise of accounts, denial of service or even remote code execution. These issues were reported by email to the developer but no response was forthcoming. Tim -- Tim Brown...
Authentication flaw
admin/options.php in Grestul 1.2 does not properly restrict access, which allows remote attackers to bypass authentication and create administrative accounts via a manageadmin action in a direct request...
CVE-2009-2040
admin/options.php in Grestul 1.2 does not properly restrict access, which allows remote attackers to bypass authentication and create administrative accounts via a manageadmin action in a direct request...
CVE-2009-2040
admin/options.php in Grestul 1.2 does not properly restrict access, which allows remote attackers to bypass authentication and create administrative accounts via a manageadmin action in a direct request...
CVE-2009-2040
CVE-2009-2040 affects Grestul 1.2. admin/options.php fails to restrict access, enabling remote attackers to bypass authentication and create administrative accounts via a manage_admin action in a direct request. This yields unauthorized privilege elevation (admin) and potential full control of th...
Design/Logic Flaw
modules/admuser.php in myGesuad 0.9.14 aka 0.9 does not require administrative authentication, which allows remote authenticated users to list user accounts via a Find action...