Pluggable CAPTCHA

panel:bgColor=e7f4fa NOTE: This suggestion is for JIRA Server. Using JIRA Cloud? See the corresponding suggestion|http://jira.atlassian.com/browse/JRACLOUD-21359. panel CAPTCHA should be pluggable in JIRA CAPTCHA|http://en.wikipedia.org/wiki/CAPTCHA is supposed to stop spam and other automated...

CVE-2009-4829

Cross-site scripting XSS vulnerability in the Automated Logout module 6.x-1.x before 6.x-1.7 and 6.x-2.x before 6.x-2.3 for Drupal allows remote authenticated users with administer autologout privileges to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the Automated Logout module 6.x-1.x before 6.x-1.7 and 6.x-2.x before 6.x-2.3 for Drupal allows remote authenticated users with administer autologout privileges to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-4829: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Automated Logout module 6.x-1.x before 6.x-1.7 and 6.x-2.x before 6.x-2.3 for Drupal allows remote authenticated users with administer autologout privileges to inject arbitrary web script or HTML via unspecified vectors...

MS Live CAPTCHAS Busted by PushDo Botnet

The prolific Pushdo spam botnet has found a new way to penetrate Microsoft’s Live.com by exploiting weaknesses in the audio captchas designed to prevent automated scripts from accessing the popular email service. Read the full article. The Register...

Vulnerabilities in CaptchaSecurityImages

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Insufficient Anti-automation и Denial of Service уязвимостях в веб приложении CaptchaSecurityImages. Это скрипт капчи, который используется на многих веб сайтах и движках. Insufficient Anti-automation уязвимость я нашёл 06.10.2007, во время...

[SECURITY] [DSA-2019-1] New pango1.0 packages fix denial of service

------------------------------------------------------------------------ Debian Security Advisory DSA-2019-1 [email protected] http://www.debian.org/security/ Giuseppe Iuculano March 20, 2010 http://www.debian.org/security/faq -...

Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 / 9.10 : dpkg vulnerability (USN-909-1)

William Grant discovered that dpkg-source did not safely apply diffs when unpacking source packages. If a user or an automated system were tricked into unpacking a specially crafted source package, a remote attacker could modify files outside the target unpack directory, leading to a denial of...

Cross-site scripting cookie theft

Added: 03/09/2010 Background Many web sites include scripts, which are lists of commands which, when executed in sequence, provide some enhancement to a web page. Web browsers are able to recognize scripts in web pages by the tag and handle them accordingly. Problem By sending an HTTP request...

Tod Miller Sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4

No description provided by source. !/bin/sh Tod Miller Sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4 local root exploit March 2010 automated by kingcope Full Credits to Slouching echo Tod Miller Sudo local root exploit echo by Slouching echo automated by kingcope if $ != 1 then echo "usage:...

Vulnerabilities in DataLife Engine

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Abuse of Functionality и Insufficient Anti-automation уязвимостях в DataLife Engine DLE. Abuse of Functionality: http://site/index.php?do=register На странице регистрации функция "Проверить имя" позволяет выявить логины пользователей в системе...

Todd Miller sudoedit Root Exploit

!/bin/sh Tod Miller Sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4 local root exploit March 2010 automated by kingcope Full Credits to Slouching echo Tod Miller Sudo local root exploit echo by Slouching echo automated by kingcope if $ != 1 then echo "usage: ./sudoxpl.sh " exit fi cd /tmp cat...

Vulnerabilities in vBulletin

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Abuse of Functionality и Insufficient Anti-automation уязвимостях в vBulletin. Abuse of Functionality: Логины пользователей являются их именами на форуме, что позволяет выявить логины в системе. Abuse of Functionality: На странице...

Todd Miller Sudo local root exploit discovered by Slouching

Just for the record. ---snip--- !/bin/sh Tod Miller Sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4 local root exploit March 2010 automated by kingcope Full Credits to Slouching echo Tod Miller Sudo local root exploit echo by Slouching echo automated by kingcope if $ != 1 then echo "usage:...

[SECURITY] [DSA-1990-2] New trac-git package fixes regression

------------------------------------------------------------------------ Debian Security Advisory DSA-1990-2 [email protected] http://www.debian.org/security/ Stefan Fritsch February 04, 2010 http://www.debian.org/security/faq -...

CentrifugeSystems Denial Of Service

Automated Looping in Apache/JSP AND CentrifugeSystems Exploit Title: Automated Looping in CentrifugeSystems Date: 14-Jan-10 Author: Asheesh Kumar Mani Tripathi Software Link: www.centrifugesystems.com Description :Exceptional Conditional Error This Type of Vulnerability is found mainly in apache...

SA-CONTRIB-2009-114 - Automated Logout - Cross Site Scripting

This module provides a site administrator the ability to log users out after a specified time of inactivity. The module does not sanitize some of the user-supplied data before displaying it, leading to a cross-site scripting XSS vulnerability. Users who can take advantage of this vulnerability...

[SECURITY] [DSA-1940-1] New php5 packages fix several issues

------------------------------------------------------------------------ Debian Security Advisory DSA-1940-1 [email protected] http://www.debian.org/security/ Stefan Fritsch November 25, 2009 http://www.debian.org/security/faq -...

Gumblar: New Generation of Self-Building Botnets

We’ve been looking at the infrastructure of the Gumblar malware and found some curious facts on how Gumblar operates which we would like to share to make hosting owners aware of the Gumblar threat. Analysis of some infected websites showed that the only way to inject the infection of Gumblar was ...

FBI Reports Malware on Rise in Electronic Funds Fraud

The FBI reports it has seen a rise of malware over the past few months targeting small and medium businesses and municipal government entities and school districts. Once a malicious attachment or link is opened, keylogging tactics obtain bank account info where criminals then initiate wire...