Memory corruption

Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service memory corruption via a Director movie with a crafted 3D Assets 0xFFFFFF88 type record that triggers an incorrect memory allocation, a different vulnerability than CVE-2011-0555,...

CVE-2010-4192: Improper Restriction of Operations within the Bounds of a Memory Buffer

Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service memory corruption via a Director movie with a crafted 3D Assets 0xFFFFFF88 type record that triggers an incorrect memory allocation, a different vulnerability than CVE-2011-0555,...

Adobe Shockwave Player 0xFFFFFF45 Record Count Element Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Adobe Shockwave Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Adobe Shockwave Player FFFFFF88 Record Count Element Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Adobe Shockwave Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Security Worth Buying

I’m a dirty vendor. That may not be the best way to start a serious dialogue about security product effectiveness, but I hate to read a post on security theory by some insincere tie-wearing wonk only to discover afterwards that he or she is Lord High Poobah of Marketing at “Scaring You For Profit...

CVE-2010-4208

Cross-site scripting XSS vulnerability in the Flash component infrastructure in YUI 2.5.0 through 2.8.1, as used in Bugzilla, Moodle, and other products, allows remote attackers to inject arbitrary web script or HTML via vectors related to uploader/assets/uploader.swf...

CVE-2010-4207: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Flash component infrastructure in YUI 2.4.0 through 2.8.1, as used in Bugzilla, Moodle, and other products, allows remote attackers to inject arbitrary web script or HTML via vectors related to charts/assets/charts.swf...

Akamai Download Manager arbitrary file download & execution

------------------------------------------------------------------------ Akamai Download Manager arbitrary file download & execution ------------------------------------------------------------------------ Yorick Koster, April 2009...

CVE-2010-2848: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in assets/captcha/includes/alikon/playcode.php in the InterJoomla ArtForms comartforms component 2.1b7.2 RC2 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the l parameter...

Microsoft to Share Vulnerability Details with Governments

Microsoft today announced plans to share pre-patch details on software vulnerabilities with governments around the world under a new program aimed at securing critical infrastructure and government assets from hacker attacks. The program, codenamed Omega, features a Defensive Information Sharing...

OCS Inventory NG Server Administration Console Detection

The remote web server is hosting the OCS Inventory NG Server Administration console, a PHP application for managing computing assets. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include"compat.inc"; if description scriptid44392; scriptversion"1.11";...

CVE-2009-4085

CVE-2009-4085 describes a remote file inclusion (RFI) in PHP Traverser 0.8.0. The vulnerability affects the file assets/plugins/mp3_id/mp3_id.php, where an attacker can supply a URL via the GLOBALS[BASE] parameter to execute arbitrary PHP code on the server. The CVSSv2 base score is 7.5 (HIGH) wi...

CVE-2009-3342: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in frontend/assets/ajax/checkusername.php in the AlphaUserPoints comalphauserpoints component 1.5.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the username2points parameter...

How Can We Win a Cyberwar?

Cyberwar is no longer an urban legend. From Estonia to Georgia to Israel, cyberwar has become a regular part of geopolitical struggles around the globe, and it promises to become a growing factor in future international conflicts. Even skeptics have to admit that the economics behind cyber warfar...

CVE-2009-2238: Undefined Security Weakness

Unrestricted file upload vulnerability in includes/sharedscripts/wysiwygeditor/assetmanager/assetmanager.asp in DMXReady Registration Manager 1.1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file ...

CVE-2008-2885

PHP remote file inclusion vulnerability in src/browser/resource/categories/resourcecategoriesview.php in Open Digital Assets Repository System ODARS 1.0.2, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the CLASSESROOT parameter...

Remote file inclusion

PHP remote file inclusion vulnerability in src/browser/resource/categories/resourcecategoriesview.php in Open Digital Assets Repository System ODARS 1.0.2, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the CLASSESROOT parameter...

CVE-2008-2885

PHP remote file inclusion vulnerability in src/browser/resource/categories/resourcecategoriesview.php in Open Digital Assets Repository System ODARS 1.0.2, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the CLASSESROOT parameter...

CVE-2008-2885: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in src/browser/resource/categories/resourcecategoriesview.php in Open Digital Assets Repository System ODARS 1.0.2, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the CLASSESROOT parameter...

CVE-2008-0094: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in MODx Content Management System 0.9.6.1 allow remote attackers to 1 include and execute arbitrary local files via a .. dot dot in the aslanguage parameter to assets/snippets/AjaxSearch/AjaxSearch.php, reached through index-ajax.php; and 2 read...