Firefox arbitrary JavaScript code execution

Mozilla Firefox before 2.0.0.15, Thunderbird 2.0.0.14 and earlier, and SeaMonkey before 1.1.10 allow remote attackers to execute arbitrary code via an XUL document that includes a script from a chrome: URI that points to a fastload file, related to this file's "privilege level."...

Java Web Start arbitrary file creation/deletion file with user permissions (6704077)

Unspecified vulnerability in Sun Java Web Start in JDK and JRE 5.0 before Update 16 and SDK and JRE 1.4.x before 1.4.218 allows remote attackers to create or delete arbitrary files via an untrusted application, aka CR 6704077...

CVE-2008-3111

Multiple buffer overflows in Sun Java Web Start in JDK and JRE 6 before Update 4, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.218 allow context-dependent attackers to gain privileges via an untrusted application, as demonstrated by a an application that grants itself...

Firefox block reflow flaw

The block reflow implementation in Mozilla Firefox before 2.0.0.15, Thunderbird 2.0.0.14 and earlier, and SeaMonkey before 1.1.10 allows remote attackers to execute arbitrary code or cause a denial of service application crash via an image whose display requires more pixels than nscoordMAX, relat...

tomcat manager example DoS

Multiple cross-site scripting XSS vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 el/functions.jsp, 2 el/implicit-objects.jsp, and 3 jspx/textRotate.jspx in examples/jsp2/, as demonstrated via...

[SECURITY] Fedora 8 Update: fedora-ds-admin-1.1.4-1.fc8

Fedora Administration Server is an HTTP agent that provides management feat ures for Fedora Directory Server. It provides some management web apps that can be used through a web browser. It provides the authentication, access cont rol, and CGI utilities used by the console...

Attack Technique: File Download Injection

File Download Injection ======================= Affects most web application platforms, including Java, .NET, PHP, Cold Fusion. This attack involves the use of header injection, particularly the Content-Disposition header, to subvert HTTP responses from trusted domains. Attackers can use this...

AIX 520009 : U807850

The remote host is missing AIX PTF U807850 which is related to the security of the package X11.apps.clients You should install this PTF for your system to be up-to-date. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if ! definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc';...

AIX 530005 : U807684

The remote host is missing AIX PTF U807684 which is related to the security of the package X11.samples.apps.aixclients You should install this PTF for your system to be up-to-date. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if ! definedfunc"bnrandom" exit0;...

jetAudio 7.0.5 COWON Media Center MP4 Stack Overflow Exploit

Exploit for unknown platform in category local exploits ============================================================ jetAudio 7.0.5 COWON Media Center MP4 Stack Overflow Exploit ============================================================ !/bin/perl jetAudio 7.0.5 COWON Media Center MP4 Stack...

jetAudio 7.0.5 COWON Media Center MP4 - Local Stack Overflow

!/bin/perl jetAudio 7.0.5 COWON Media Center MP4 Stack Overflow 0-day discovered and exploited by SYS 49152 Tested on win XP SP2 ENG Shell on port 49152 usage: - download the latest 3ivx codec from here: hxxp://www.3ivx.com/codec/3ivxMPEG-4501trialwin.exe - play the AVI file with COWON Media Cent...

SuSE 10 Security Update : krb5-apps-servers (ZYPP Patch Number 3022)

When using the krb5 telnet daemon it was possible for remote attackers to override authentication mechanisms and gain root access to the machine by supplying a special username. This is tracked by the Mitre CVE ID CVE-2007-0956. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text...

SuSE 10 Security Update : krb5-apps-servers and krb5-apps-clients (ZYPP Patch Number 1938)

Various return checks of setuid and seteuid calls have been fixed in kerberos client and server applications. If these applications are setuid, it might have been possible for local attackers to gain root access. CVE-2006-3083 We are not affected by the seteuid problems, tracked by CVE-2006-3084...

Oracle E-Business Suite SQL Injection Vulnerability

This vulnerability allows remote attackers to inject arbitrary SQL on vulnerable installations of Oracle E-Business Suite. Authentication is not required to exploit this vulnerability. The specific flaw exists in the okxLOV.jsp page in the Administration console. This page allows an attacker to...

visolfi.txt

Title : VISO apps Local File Inclusion Vulnerability Description : VISO apps is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. Software: : http://www.viventus.no/visoapps/ Author : d3hydr8 Homepage : http://www.darkc0de.com Original Post :...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

openSUSE 10 Security Update : krb5-apps-clients (krb5-apps-clients-1937)

Various return checks of setuid and seteuid calls have been fixed in kerberos client and server applications. If these applications are setuid, it might have been possible for local attackers to gain root access CVE-2006-3083. We are not affected by the seteuid problems, tracked by CVE-2006-3084...

openSUSE 10 Security Update : krb5-apps-servers (krb5-apps-servers-3021)

When using the krb5 telnet daemon it was possible for remote attackers to override authentication mechanisms and gain root access to the machine by supplying a special username. This is tracked by the Mitre CVE ID CVE-2007-0956. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

CVE-2007-5388: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in WebDesktop 0.1 allow remote attackers to execute arbitrary PHP code via a URL in the 1 app parameter to apps/apps.php and the 2 wsk parameter to wsk/wsk.php...

WebDesktop 0.1 Remote File Inclusion Vulnerabilities

No description provided by source. \|/// \ - - // Xmors Underground Group @ @ ----oOOo---oOOo-------------------------------------------------- Portal : WebDesktop 0.1 Download : http://downloads.sourceforge.net/pns-webdesktop/webDesktop-0.1-linux.tar.gz Author : S.W.A.T. HomePage :...