PT-2013-2127

Name of the Vulnerable Software and Affected Versions McAfee ePolicy Orchestrator ePO versions prior to 4.5.7 McAfee ePolicy Orchestrator ePO versions 4.6.x prior to 4.6.6 Description A directory traversal issue allows remote attackers to upload arbitrary files via a crafted request over the...

PT-2013-2126

Name of the Vulnerable Software and Affected Versions McAfee ePolicy Orchestrator ePO versions prior to 4.5.7 McAfee ePolicy Orchestrator ePO versions 4.6.x prior to 4.6.6 Description A SQL injection issue exists in the Agent-Handler component, allowing remote attackers to execute arbitrary SQL...

CVE-2013-0141: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in McAfee ePolicy Orchestrator ePO before 4.5.7 and 4.6.x before 4.6.6 allows remote attackers to upload arbitrary files via a crafted request over the Agent-Server communication channel, as demonstrated by writing to the Software/ directory...

CVE-2013-0140: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Agent-Handler component in McAfee ePolicy Orchestrator ePO before 4.5.7 and 4.6.x before 4.6.6 allows remote attackers to execute arbitrary SQL commands via a crafted request over the Agent-Server communication channel...

Hewlett-Packard Intelligent Management Center JavaService Information Disclosure Vulnerability

This vulnerability allows remote attackers to obtain sensitive information on vulnerable installations of HP Intelligent Management Center. Authentication is not required to exploit this vulnerability. The specific flaw exists within the communication channel between the JavaService server and th...

[XSSF v.3.0] Cross-Site Scripting Framework

The Cross-Site Scripting Framework XSSF is a security tool designed to turn the XSS vulnerability exploitation task into a much easier work. The XSSF project aims to demonstrate the real dangers of XSS vulnerabilities, vulgarizing their exploitation. This project is created solely for education,...

Red Hat Satellite Server Communication Channel Detection - Server-Side

Binary data 6662.prm...

SIEMENS Sipass Integrated 2.6 Ethernet Bus - Arbitrary Pointer Dereference

SIEMENS Sipass Integrated 2.6 Ethernet Bus - Arbitrary Pointer Dereference IOActive Security Advisory Title: SIEMENS Sipass Integrated 2.6 Ethernet Bus Arbitrary Pointer Dereference Severity: Critical Discovered by: Lucas Apa Date Reported: 09/11/12 CVE: TBD Siemens Advisory: SSA-938777...

PT-2012-3929

Name of the Vulnerable Software and Affected Versions EMC NetWorker Module for Microsoft Applications NMM versions 2.2.1, 2.3 before build 122, 2.4 before build 375 Description The issue allows remote attackers to execute arbitrary code by sending a crafted message over a TCP communication channe...

CVE-2012-2290: Improper Control of Generation of Code

The client in EMC NetWorker Module for Microsoft Applications NMM 2.2.1, 2.3 before build 122, and 2.4 before build 375 allows remote attackers to execute arbitrary code by sending a crafted message over a TCP communication channel...

Scientific Linux Security Update : squirrelmail on SL3.x, SL4.x, SL5.x i386/x86_64

Ivan Markovic discovered a cross-site scripting XSS flaw in SquirrelMail caused by insufficient HTML mail sanitization. A remote attacker could send a specially crafted HTML mail or attachment that could cause a user's Web browser to execute a malicious script in the context of the SquirrelMail...

Windows Meterpreter (Reflective Injection), Windows Reverse HTTP Stager (wininet)

Inject the Meterpreter server DLL via the Reflective Dll Injection payload staged. Requires Windows XP SP2 or newer. Tunnel communication over HTTP Windows wininet This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework modul...

windows Driver vulnerability discovery and use-vulnerability and early warning-the black bar safety net

Information source: evil octal information security teamwww.eviloctal.com to Article author: Anibal Sacco Translation author: r! usksk（springs brother: http://riusksk.blogbus.com to Note: this article starting the hackers Defense of, after the translation the original author of friendship submitt...

CVE-2008-3875

The kernel in Sun Solaris 8 through 10 and OpenSolaris before snv90 allows local users to bypass chroot, zones, and the Solaris Trusted Extensions multi-level security policy, and establish a covert communication channel, via unspecified vectors involving system calls...

Re: The Weakness of Windows Impersonation Model

Hi Brian, I wrote a paper on this subject last year, "Snagging Security Tokens to Elevate Privileges" http://www.databasesecurity.com/dbsec-briefs.htm after Tim Mullen and thrashed out a few details at Blackhat last year over a few White Russians. The paper discusses the problem in the context of...