CentOS 5 : libwpd (CESA-2012:1043)

Updated libwpd packages that fix one security issue are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Experts Say Attack on Crypto Tokens is Serious, But Not Catastrophic

A group of international academic researchers has made a major advance in the efficiency of a known cryptographic attack on some kinds of crypto hardware, enabling them to extract sensitive keys from tokens such as RSA SecurID and Aladdin eToken devices within 20 minutes. However, experts say tha...

SQL injection vulnerability in Active Record

Due to the way Active Record handles nested query parameters, an attacker can use a specially crafted request to inject some forms of SQL into your application's SQL queries...

Security Veterans Score Funding for New Startup Bluebox

Many people would consider themselves lucky to be a part of one successful start-up company, but for a select group of entrepreneurs, engineers and executives, that’s just the beginning. Such is the case for the team behind new mobile security firm Bluebox, a stealth-mode company that counts SPI...

VANA CMS - index.php Script SQL Injection

VANA CMS - index.php Script SQL Injection source: https://www.securityfocus.com/bid/54066/info VANA CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. A successful exploit may allow an attacker to compromise...

Funeral Script PHP - Cross-Site Scripting SQL Injection

Funeral Script PHP - Cross-Site Scripting SQL Injection source: https://www.securityfocus.com/bid/54402/info Funeral Script PHP is prone to multiple cross-site scripting vulnerabilities and multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied...

IBM Rational AppScan 8.x/7.x 多个安全漏洞

CVE ID:...

XOOPS Cube PROJECT FileManager - xupload.php Arbitrary File Upload

XOOPS Cube PROJECT FileManager - xupload.php Arbitrary File Upload source: https://www.securityfocus.com/bid/53945/info FileManager is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input. An...

AyMSite CMS 3.0.2 SQL Injection

Exploit Title: AyMSite V 3.0.2 sqli Vendor: http://www.aymsoft.com/ Date: 08/06/2012 Author: xDarkSton3x Dork: inurl:aymindex.php?option= E-mail : [email protected] Category: webapps Example Sites : http://www.satena.gov.co/aymindex.php?option=ciudadano&pagcatid=3&pagid=%27...

CVE-2012-0441

The ASN.1 decoder in the QuickDER decoder in Mozilla Network Security Services NSS before 3.13.4, as used in Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10, allows remote attackers to cause a...

rubygem-activerecord -- multiple vulnerabilities

rubygem-activerecord -- multiple vulernabilities Due to the way Active Record interprets parameters in combination with the way that Rack parses query parameters, it is possible for an attacker to issue unexpected database queries with "IS NULL" where clauses. This issue does not let an attacker...

A CISO's Guide To Application Security – Part 5: Justifying an Investment in AppSec

This post is the last in a 5-part series on Application Security, or “AppSec”. This blog post series has examined the growing threats to software, defined the components of a sound AppSec program, described an evolutionary path to AppSec maturity, and considered a number of tools and technologies...

CLscript CMS v3.0 - SQL Injection Vulnerability

Exploit for php platform in category web applications Title: ====== CLscript CMS v3.0 - Multiple Web Vulnerabilities Common Vulnerability Scoring System: ==================================== 8.6 Introduction: ============= With the professionally developed Classified-Portal CLscript 3.0 can...

WordPress Plugin Sharebar 1.2.1 - SQL Injection / Cross-Site Scripting

source: https://www.securityfocus.com/bid/53532/info Sharebar plugin for WordPress is prone to multiple cross-site scripting and SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input. Successful exploits will allow an attacker to steal cookie-based authentication...

Web ellasan Design - SQL injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Web ellasan Design SQL injection Vulnerability Author: Becax Home : CrimeIRCD ---------------------------------------------------------------------! Email : email protected Category: webapps Version: n/a Google dork: "powered by...

NTDS - SQL Injection Vulnerability

Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 x...

Vallarta - SQL Injection Vulnerability

Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 x...

Chevereto Upload Script Cross Site Scripting / User Enumeration

Exploit for php platform in category web applications ======================================================================================== Vulnerable Software: Chevereto upload script Downloaded from: http://code.google.com/p/chevereto/downloads/list...

'The Hackers Conference 2012' to be held in New Delhi

'The Hackers Conference 2012' to be held in New Delhi The Biggest Hacking Mania has arrived. The Hackers Conference 2012 will be held in New Delhi on July 29. THC 2012 is expected to be the first open gathering of Blackhat hackers in India who will debate latest security issues with the top...

A CISO's Guide To Application Security – Part 4: Weighing AppSec Technology Options

This post is the fourth in a 5-part series on Application Security, or “AppSec”. The series will define the components of a sound AppSec program, delineate the growing threats to software, weigh the costs of a data breach, and outline the CISO’s responsibility in managing software security risk...