phpList 2.10.18 - unconfirmed Cross-Site Scripting

phpList 2.10.18 - unconfirmed Cross-Site Scripting source: https://www.securityfocus.com/bid/54887/info PHPList is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the...

AraDown - 'id' SQL Injection

source: https://www.securityfocus.com/bid/54891/info AraDown is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. A successful exploit may allow an attacker to compromise the application, access or modify data, or...

Microsoft Releases Attack Surface Analyzer Tool

Microsoft has released a public version of its internal Attack Surface Analyzer tool, which helps organizations identify changes to a system’s attack surface as new applications are added. The tool has been in beta for a few months, but this is the first official release. The Attack Surface...

Scientific Linux Security Update : libpng on SL5.x, SL6.x i386/x86_64 (20120320)

The libpng packages contain a library of functions for creating and manipulating PNG Portable Network Graphics image format files. A heap-based buffer overflow flaw was found in the way libpng processed compressed chunks in PNG image files. An attacker could create a specially crafted PNG image...

ManageEngine Applications Manager - Multiple Cross-Site Scripting / SQL Injections

source: https://www.securityfocus.com/bid/54759/info ManageEngine Applications Manager is prone to multiple SQL-injection and multiple cross-site scripting vulnerabilities. Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the...

Limny - index.php Multiple SQL Injections

Limny - index.php Multiple SQL Injections source: https://www.securityfocus.com/bid/54753/info Limny is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. A successful exploit may allow an attacker to...

CentOS Update for freetype CESA-2012:0467 centos5

Check for the Version of freetype OpenVAS Vulnerability Test CentOS Update for freetype CESA-2012:0467 centos5 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...

Scrutinizer 9.0.1.19899 - Arbitrary File Upload

source: https://www.securityfocus.com/bid/54726/info Scrutinizer is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input. An attacker may leverage this issue to upload arbitrary files to the...

Nwahy Articles v2.2 CSRF Add Admin

Exploit for php platform in category web applications Exploit Title: Nwahy Articles V2.2 CSRF Add Admin Author: DaOne Category: webapps Software Link: http://www.nwahy.com/upload/article-v2.2.rar Google dork: intext:"Powered by Nwahy Articles V2.2" Exploit 0day.today 2018-03-19...

ManageEngine Application Manager 10 Multiple Vulnerabilities

Exploit for php platform in category web applications ME Application Manager 10 - Multiple Web Vulnerabilities Introduction: ============= ManageEngine Applications Manager is a server and application performance monitoring software that helps businesses ensure high availability and performance f...

AVA VoIP - Multiple Vulnerabilities

source: https://www.securityfocus.com/bid/54591/info AVA VoIP is prone to multiple security vulnerabilities because the application fails to sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context o...

EmbryoCore CMS 1.03 - 'loadcss.php' Multiple Directory Traversal Vulnerabilities

source: https://www.securityfocus.com/bid/54470/info EmbryoCore CMS is prone to multiple directory-traversal vulnerabilities because it fails to properly sanitize user-supplied input. Remote attackers can use specially crafted requests with directory-traversal sequences '../' to retrieve arbitrar...

EmbryoCore CMS 1.03 - loadcss.php Multiple Directory Traversal Vulnerabilities

EmbryoCore CMS 1.03 - loadcss.php Multiple Directory Traversal Vulnerabilities source: https://www.securityfocus.com/bid/54470/info EmbryoCore CMS is prone to multiple directory-traversal vulnerabilities because it fails to properly sanitize user-supplied input. Remote attackers can use specially...

[SECURITY] Fedora 16 Update: php-ZendFramework-1.11.12-1.fc16

Extending the art & spirit of PHP, Zend Framework is based on simplicity, object-oriented best practices, corporate friendly licensing, and a rigorou sly tested agile code base. Zend Framework is focused on building more secure, reliable, and modern Web 2.0 applications & web services, and...

PHP MBB - Cross-Site Scripting / SQL Injection

source: https://www.securityfocus.com/bid/54271/info php MBB is prone to multiple cross-site scripting and SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could allow an attacker to steal cookie-based authentication credentials,...

LIOOSYS CMS - SQL Injection / Information Disclosure

source: https://www.securityfocus.com/bid/54239/info LIOOSYS CMS is prone to an SQL-injection vulnerability and an information-disclosure vulnerability. Exploiting these issues could allow an attacker to obtain sensitive information, compromise the application, access or modify data, or exploit...

CentOS 5 : libwpd (CESA-2012:1043)

Updated libwpd packages that fix one security issue are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Experts Say Attack on Crypto Tokens is Serious, But Not Catastrophic

A group of international academic researchers has made a major advance in the efficiency of a known cryptographic attack on some kinds of crypto hardware, enabling them to extract sensitive keys from tokens such as RSA SecurID and Aladdin eToken devices within 20 minutes. However, experts say tha...

SQL injection vulnerability in Active Record

Due to the way Active Record handles nested query parameters, an attacker can use a specially crafted request to inject some forms of SQL into your application's SQL queries...

Security Veterans Score Funding for New Startup Bluebox

Many people would consider themselves lucky to be a part of one successful start-up company, but for a select group of entrepreneurs, engineers and executives, that’s just the beginning. Such is the case for the team behind new mobile security firm Bluebox, a stealth-mode company that counts SPI...