PT-2011-13: Privilege Gaining in ManageEngine ServiceDesk Plus 8.0.0

The specialists of the Positive Research center have revealed privilege gaining vulnerability in ManageEngine ServiceDesk Plus. Insufficient privilege validation allows attackers with guest privileges account guest/guest to create a user with servicedesk administrator privileges via HTTP GET...

Electronic JukeBox - Hardware Hacking Part 1 & 2

Document Title: =============== Electronic JukeBox - Hardware Hacking Part 1 & 2 References: =========== View Part1: http://www.youtube.com/watch?v=0rTiXldgeW4 View Part2: http://www.youtube.com/watch?v=dAX4p1oMTtw Release Date: ============= 2011-06-21 Vulnerability Laboratory ID VL-ID:...

Electronic JukeBox - Hardware Hacking Part 1 & 2

Document Title: =============== Electronic JukeBox - Hardware Hacking Part 1 & 2 References: =========== View Part1: http://www.youtube.com/watch?v=0rTiXldgeW4 View Part2: http://www.youtube.com/watch?v=dAX4p1oMTtw Release Date: ============= 2011-06-21 Vulnerability Laboratory ID VL-ID:...

Winamp 5.61 'in_midi' component heap overflow (crash only)

Exploit for windows platform in category dos / poc Exploit Title: Winamp 'inmidi' component heap overflow Date: 05/14/2011 Author: Alexander Gavrun http://0x1byte.blogspot.com/ Software Link: http://www.winamp.com/ Version: 5.61 Tested on: Windows 7 Vulnerability occur while parsing midi file wit...

Parnian Opendata CMS SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title : Parnian Opendata CMS SQL Injection Vulnerability Date : 2011-04-15 Author : Alexander Software Link : http://www.parniansoft.com/ Test On : php CVE : Web Applications Google Dork : inurl:mpfn=pdview Exploit :...

Parnian Opendata CMS - SQL Injection

Parnian Opendata CMS - SQL Injection Exploit Title : Parnian Opendata CMS SQL Injection Vulnerability Date : 2011-04-15 Author : Alexander Software Link : http://www.parniansoft.com/ Test On : php CVE : Web Applications Google Dork : inurl:mpfn=pdview Exploit : mpfn=pdview&id=-1+union+select...

Parnian Opendata CMS SQL Injection

Exploit Title : Parnian Opendata CMS SQL Injection Vulnerability Date : 2011-04-15 Author : Alexander Software Link : http://www.parniansoft.com/ Test On : php CVE : Web Applications Google Dork : inurl:mpfn=pdview Exploit : mpfn=pdview&id=-1+union+select...

RuubikCMS Shell Upload

Exploit Title : RuubikCMS v1.0.3 Shell Upload Vulnerability Google Dork : Powered by RuubikCMS Date : 2011-03-06 Author : Alexander Software Link : http://www.ruubikcms.com Version : v1.0.3 Test On : Linux/php CVE : Web Applications === Exploit === http://server/patch...

Mozilla Foundation Security Advisory 2010-65

Mozilla Foundation Security Advisory 2010-65 Title: Buffer overflow and memory corruption using document.write Impact: Critical Announced: October 19, 2010 Reporter: Alexander Miller Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 3.6.11 Firefox 3.5.14 Thunderbird 3.1.5 Thunderbird...

Buffer overflow and memory corruption using document.write — Mozilla

Security researcher Alexander Miller reported that passing an excessively long string to document.write could cause text rendering routines to end up in an inconsistent state with sections of stack memory being overwritten with the string data. An attacker could use this flaw to crash a victim's...

SAP NetWeaver Workflow Modeler - Multiple XSS

Application: SAP NetWeaver Workflow Modeler Versions Affected: SAP NetWeaver NW2004s SP6 Workflow Modeler Vendor URL: http://www.sap.com Bugs: XSS Exploits: YES Reported: 06.08.2010 Vendor response: 07.08.2010 Date of Public Advisory: 12.02.2014 Reference: SAP Security Note 1860923 Author:...

NSA Director to Head U.S. Cyber Command

The U.S. Senate has approved Lt. Gen. Keith Alexander, director of the National Security Agency, to also head the military’s recently created U.S. Cyber Command. Read the full article. Computerworld...

CVE-2010-1101

The CVE-2010-1101 entry concerns the iCab browser by Alexander Clauss. The vulnerability is an integer overflow in the handling of TCP port numbers, allowing remote attackers to bypass outbound port restrictions by using a port value outside the range of an unsigned short (demonstrated with 65561...

CVE-2010-1101: Undefined Security Weakness

Integer overflow in Alexander Clauss iCab allows remote attackers to bypass intended port restrictions on outbound TCP connections via a port number outside the range of the unsigned short data type, as demonstrated by a value of 65561 for TCP port 25...

Symantec Antivirus Client Proxy 10 Buffer Overflow

Exploit for unknown platform in category local exploits ================================================== Symantec Antivirus Client Proxy 10 Buffer Overflow ================================================== Application: Symantec Antivirus Client Proxy Versions Affected: Version 10 Vendor URL:...

SA-CONTRIB-2009-112 - Sections - Cross Site Scripting

The Sections module allows the creation of sections within a site. Each section has an installed template, theme or style attached to it. The module does not sanitize some of the user-supplied data before displaying it, leading to a Cross Site Scripting XSS vulnerability. Users who can take...

SAP NetWaver SLD — Multiple XSS

Application: SAP NetWeaver SLD Versions Affected: 6.4-7.02 Vendor URL: Bugs: XSS Exploits: YES Reported: 14.12.2009 Vendor response: 15.12.2009 Last response: 06.05.2010 Date of Public Advisory: 13.07.2010 Author: Alexander Polyakov and Alexey Troshichev Description SAP NetWeaver System has...

Internet Explorer Daxctle.OCX KeyFrame Method Heap Buffer Overflow Vulnerability

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3...

[DSECRG-09-022] Adobe Coldfusion 8 Multiple Linked XSS Vulnerabilies

http://www.dsecrg.com/pages/vul/show.php?id=122 Digital Security Research Group DSecRG Advisory DSECRG-09-022 Application: Adobe Coldfusion 8 Versions Affected: Adobe Coldfusion 8 Vendor URL: http://adobe.com Bugs: Multiple Linked XSS,XSRF Exploits: YES Reported: 12.01.2009 Vendor response:...

Cross-Site Scripting vulnerability in extension Modern Guestbook / Commenting System (ve_guestbook)

It has been discovered that the extension Modern Guestbook / Commenting system veguestbook is vulnerable to Cross-Site Scripting. Release Date: June 16, 2009 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 2.7.1 and...