CVE-2012-4470

The vulnerability CVE-2012-4470 affects the Listhandler module for Drupal (versions 6.x-1.x prior to 6.x-1.1). The root cause is an improper permissions check when importing emails, allowing remote comment authors to bypass access restrictions. This could enable unintended access or other unspeci...

CVE-2012-1468

Incomplete blacklist vulnerability in Open Journal Systems before 2.3.7 allows remote authenticated users with the Author Role permission to execute arbitrary code by uploading a file with an executable extension that is not ".php", then accessing it via a direct request to the file in...

CVE-2011-5134

Unrestricted file upload vulnerability in editor/extensions/browser/file.php in the JCE component before 2.0.18 for Joomla! allows remote authenticated users with the author privileges to execute arbitrary PHP code by uploading a file with a double extension, as demonstrated by .php.gif. NOTE: so...

CVE-2011-5110

Multiple SQL injection vulnerabilities in Blogs Manager 1.101 and earlier allow remote attackers to execute arbitrary SQL commands via the SearchField parameter in a search action to 1 authorslist.php, 2 blogslist.php, 3 categorylist.php, 4 commentslist.php, 5 policylist.php, 6 ratelist.php, 7...

CVE-2012-3385

WordPress before 3.4.1 does not properly restrict access to post contents such as private or draft posts, which allows remote authors or contributors to obtain sensitive information via unknown vectors...

DEBIAN-CVE-2012-3385

WordPress before 3.4.1 does not properly restrict access to post contents such as private or draft posts, which allows remote authors or contributors to obtain sensitive information via unknown vectors...

Design/Logic Flaw

WordPress before 3.4.1 does not properly restrict access to post contents such as private or draft posts, which allows remote authors or contributors to obtain sensitive information via unknown vectors...

CVE-2012-3385

WordPress before 3.4.1 does not properly restrict access to post contents such as private or draft posts, which allows remote authors or contributors to obtain sensitive information via unknown vectors...

CVE-2012-3385

WordPress before 3.4.1 does not properly restrict access to post contents such as private or draft posts, which allows remote authors or contributors to obtain sensitive information via unknown vectors...

Malware Magazine [THN] - eZine Issue 012

Document Title: =============== Malware Magazine THN - eZine Issue 012 References: =========== Download: http://www.vulnerability-lab.com/resources/documents/618.pdf Original: http://news.thehackernews.com/THN-June2012.pdf Article: http://www.vulnerability-lab.com/getcontent.php?id=618 Release...

CVE-2012-2156

Multiple cross-site scripting XSS vulnerabilities in Plume CMS 1.2.4 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the uemail parameter aka Authors Email field to manager/users.php, 2 the urealname parameter aka Authors Name field to manager/users.php, or 3 the...

Plume CMS 1.2.4 - Multiple Persistent Cross-Site Scripting Vulnerabilities

Plume CMS 1.2.4 - Multiple Persistent Cross-Site Scripting Vulnerabilities +--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : PlumeCMS = 1.2.4 Multiple Persistent XSS Date : 04-04-2012 Author : Ivano...

Skype 5.8 & 5.5 - Corruption & Persistent Vulnerability

Document Title: =============== Skype 5.8 & 5.5 - Corruption & Persistent Vulnerability References: =========== Download: http://www.vulnerability-lab.com/resources/videos/447.wmv View: http://www.youtube.com/watch?v=zQWgD-YzN-4 Release Date: ============= 2012-03-28 Vulnerability Laboratory ID...

CVE-2012-0976

Cross-site scripting XSS vulnerability in admin/EditForm in SilverStripe 2.4.6 allows remote authenticated users with Content Authors privileges to inject arbitrary web script or HTML via the Title parameter. NOTE: some of these details are obtained from third party information...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/EditForm in SilverStripe 2.4.6 allows remote authenticated users with Content Authors privileges to inject arbitrary web script or HTML via the Title parameter. NOTE: some of these details are obtained from third party information...

sudo 1.8.3p1 Format String

Phenoelit Advisory Authors joernchen Phenoelit Group http://www.phenoelit.de Affected Products sudo 1.8.0 - 1.8.3p1 http://sudo.ws Vendor communication 2012-01-24 Send vulnerability details to sudo maintainer 2012-01-24 Maintainer is embarrased 2012-01-27 Asking maintainer how the fixing goes...

The Cloud Security Rules Book - Technology is your friends & Enemy

The Cloud Security Rules Book - Technology is your friends & Enemy Well-known security experts decipher the most challenging aspect of cloud computing-security. The Cloud Security Rules book is available on Amazon.com and selected book stores from October 2011. According to Description available...

How the Duqu Authors May Have Erred

Duqu has been called the spawn of Stuxnet, or maybe some sort of stepchild or second cousin. That initial analysis came from some similarities in the code of the two attack tools, and now that researchers have had more time to pull Duqu apart and see how it works, it seems more and more likely th...

Costin Raiu on Duqu, Stuxnet and Targeted Attacks

Dennis Fisher talks with malware researcher Costin Raiu about the investigation into Duqu, the likelihood that it was written by the same team as Stuxnet, whether a government is behind its development and what mistakes the authors made. Podcast audio courtesy of sykboy65 Subscribe to the Digital...

phpWebSite 1.7.1 - mod.php SQL Injection

phpWebSite 1.7.1 - mod.php SQL Injection source: https://www.securityfocus.com/bid/49354/info phpWebSite is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. A successful exploit may allow an attacker to compromis...