SCADA DNP3 freeze clear no ack function code

...

CVE-2012-3754

Use-after-free vulnerability in the Clear method in the ActiveX control in Apple QuickTime before 7.7.3 allows remote attackers to execute arbitrary code or cause a denial of service application crash via unspecified vectors...

VeriCentre web application SQL injection vulnerability

Overview The VeriCentre web application contains a SQL injection vulnerability. Description CWE-89: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection'The VeriCentre web application contains a SQL injection vulnerability within the TerminalId, ModelName, and...

Campaign Enterprise 11 SQL Injection / Unauthorized Access

Campaign Enterprise 11 suffers from multiple remote SQL injection, unauthorized access, clear text password storage, and direct access bypass vulnerabilities. CVE-2012-3820, CVE-2012-3821, CVE-2012-3822, CVE-2012-3823, CVE-2012-3824 Overview =============== Campaign Enterprise 11, by ArialSoftwar...

Session expiry pages may echo password in clear text

The "session expiry" and "XSRF token missing" pages will echo any submitted values. This may result in echoing the submitted password to the page in plain text if triggered on the WebSudo authentication page. Modify the error pages sessionexpired.jsp and xsrfmissing.jsp so they don't echo...

Conceptronic Grab'n'Go and Sitecom Storage Center - Password Disclosure

Updated to include Sitecom MD-253 and MD254 Minor textual changes == Conceptronic Grab’n’Go and Sitecom Storage Center - Password disclosure Vulnerability - Security Advisory AA-002 Severity Rating: High Discovery Date: May 5, 2012 Vendor Notification: May 31, 2012 =Impact - System Access -...

meetOne Insecure Transport / Information Disclosure

Exploit for php platform in category web applications SUMMARY meetOne, currently in Germany in the Top 50 social apps of the iTunes Store, has multiple vulnerabilities and has been found guilty of stealing Apple iPhone address books and abusing the e-mail addresses there for spam. Apple Inc. is...

meetOne Insecure Transport / Information Disclosure

SUMMARY meetOne, currently in Germany in the Top 50 social apps of the iTunes Store, has multiple vulnerabilities and has been found guilty of stealing Apple iPhone address books and abusing the e-mail addresses there for spam. Apple Inc. is ignoring the data theft and it seems even supressing...

Unbreakable Enterprise kernel Security update

2.6.39-200.29.2 - epoll: clear the tfilechecklist on -ELOOP Joe Jin CVE-2012-3375 - Don't limit non-nested epoll paths Jason Baron - epoll: kabi fixups for epoll limit wakeup paths Joe Jin CVE-2011-1083 - epoll: limit paths Jason Baron CVE-2011-1083 - cred: copyprocess should clear...

Emesene 2.12.5 - Password Disclosure

Exploit Title: Emesene Password Disclosure Category: Local Date: 29/06/2012 Author: Daniel Godoy Author Mail: DanielGodoyatGobiernoFederaldotcom Author Web: www.delincuentedigital.com.ar Sofware web: http://blog.emesene.org/p/downloads.html Tested on: Linux The only requirement to run the script ...

PHP Money Books 1.03 Stored Cross Site Scripting

Exploit Title: phpmoneybooks 1.03 Stored XSS Date: Jun 28, 2012 Exploit Author: chap0 - chap0.blogspot.com - @chap0 Vendor Homepage: http://phpmoneybooks.com/ Software Link: http://sourceforge.net/projects/phpmoneybooks/files/phpMoneyBooks103.zip/download Version: 1.03 Patch: Upgrade to 1.04 Vend...

phpmoneybooks 1.03 - Persistent Cross-Site Scripting

phpmoneybooks 1.03 - Persistent Cross-Site Scripting Exploit Title: phpmoneybooks 1.03 Stored XSS Date: Jun 28, 2012 Exploit Author: chap0 - chap0.blogspot.com - @chap0 Vendor Homepage: http://phpmoneybooks.com/ Software Link:...

389-ds-base security update

1.2.10.2-18 - Resolves: Bug 830001 - unhasheduserpassword visible after changing password -- patch 0020 disallows users' direct modify on unhasheduserpassword 1.2.10.2-17 - Resolves: Bug 830001 - unhasheduserpassword visible after changing password -- patch 0019 fixes deref issue. 1.2.10.2-16 -...

phpmoneybooks 1.03 Stored XSS

Exploit for php platform in category web applications Exploit Title: phpmoneybooks 1.03 Stored XSS Date: Jun 28, 2012 Exploit Author: chap0 - chap0.blogspot.com - @chap0 Vendor Homepage: http://phpmoneybooks.com/ Software Link:...

Symantec Endpoint Protection network threat protection module Microsoft IIS denial of service vulnerability

Overview Symantec Endpoint Protection SEP Network Threat Protection module running on a Microsoft Internet Information Services IIS webserver contains a denial of service vulnerability when probed by an audit tool. Description Symantec Security Advisory SYM12-007 states:Overview Versions of...

Symantec Endpoint Protection Manager 11.x Denial of Service

SUMMARY Versions of Symantec Endpoint Protection Manager 11.0 running the Network Threat Protection module on Windows Server 2003 are susceptible to a Denial of ServiceDoS. Successful exploitation could potentially result in the system hosting Symantec Endpoint Protection Manager becoming...

Owncloud 3.0.3 Clear Text Password Storage

Owncloud App "Ldap user backend" stored password in clear text Author: francesco.tornieri "At" verona-wireless.net Summary: store domain admin password in clear text Discovery date: 09/05/2012 Developer date contact : 09/05/2012 Where: From local Release Date: 11/05/2012 Criticality level: High...

LDAP Passwords Logged in Clear Text

An issue exists whereby LDAP bind passwords are logged to authd.log in clear text when using the default logging level of 'debug'. Ref 35493 This issue results in administrator passwords being logged and stored in clear text. Inappropriate access to this information can lead to unauthorized...

Secunia Research: RealNetworks Helix Server Credentials Disclosure Security Issue

====================================================================== Secunia Research 09/04/2012 - RealNetworks Helix Server Credentials Disclosure Security Issue - ====================================================================== Table of Contents Affected...

US Army's CECOM Data leaked by Hacker

US Army's CECOM Data leaked by Hacker Hacker Black Jester recently published contract information from a Web site connected to the U.S. Army Communications and Electronics Command CECOM. "30 record sets that include names, user IDs, physical addresses, email addresses, telephone numbers, and...