CVE-2009-0836

Foxit Reader 2.3 before Build 3902 and 3.0 before Build 1506, including 1120 and 1301, does not require user confirmation before performing dangerous actions defined in a PDF file, which allows remote attackers to execute arbitrary programs and have unspecified other impact via a crafted file, as...

CVE-2009-0654

CVE-2009-0654 affects Tor 0.2.0.28 and likely earlier 0.2.0.34, where remote attackers who control both an entry and exit router can verify that a sender and receiver are communicating by replaying, modifying, inserting, or deleting a single cell and observing cell recognition errors at the exit....

CVE-2009-0654

Tor 0.2.0.28, and probably 0.2.0.34 and earlier, allows remote attackers, with control of an entry router and an exit router, to confirm that a sender and receiver are communicating via vectors involving 1 replaying, 2 modifying, 3 inserting, or 4 deleting a single cell, and then observing cell...

CVE-2009-0104

creationtimestamp| type| source ---|---|--- 2009-01-06 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/7680...

CVE-2008-5972

creationtimestamp| type| source ---|---|--- 2008-11-30 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/7302...

CVE-2008-5938

creationtimestamp| type| source ---|---|--- 2008-11-23 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/7204...

Opera 9.52 - Window Object Suppressing Remote Denial of Service

Opera Window Object Suppressing Remote Denial of Service. Version Affected: Opera 9.52 Severity: High Description: The opera browser is vulnerable to window object based denial of service attack. The opera fails to sanitize a check when window.close function is called in number of dynamically...

CVE-2008-4708

creationtimestamp| type| source ---|---|--- 2008-09-28 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/6621...

Parallels Plesk Shortnames功能邮件中继漏洞

BUGTRAQ ID: 30956 Plesk是用于管理站点的综合控制面板解决方案。 在Plesk中如果为邮件登录启用了SHORTNAMES=1功能的话，QMAIL就会在AUTH LOGIN认证期间接受任何以有效shortname开始的base64编码用户名。这允许攻击者登录到plesk认证模块所保护的邮件或其他服务，通过获得的smtp认证权限中继垃圾邮件。 必须要从smtpspsa删除SHORTNAMES=1才可以修复这个问题，仅仅将其设置为0无法解决。 Parallels Plesk 8.6 Parallels ---------...

Ruby <= 1.9 (regex engine) Remote Socket Memory Leak Exploit

No description provided by source. ------------------------------------------------------- Language : Ruby Web Site: www.ruby-lang.org Platform: All Bug: Remote Socket Memory Leak Products Affected: 1.8 series: - 1.8.5 and all prior versions - 1.8.6-p286 and all prior versions - 1.8.7-p71 and all...

CVE-2008-3301

creationtimestamp| type| source ---|---|--- 2008-07-14 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/6073...

Unauthorized reading confirmation from Outlook

I've just got an interesting idea about how a malicious e-mail sender could try to get a unseen by the recipient reading confirmation, including the IP address of the recipient. I was working on S/MIME messages and I thought about the signature validation process, where some of the steps could...

DUC NO-IP Local Password Information Disclosure Vulnerability

/ DUC NO-IP Local Password Information Disclosure Authors: Charalambous Glafkos George Nicolaou Date: March 11, 2008 Site: http://www.astalavista.com Mail: [email protected] [email protected] Synopsis: DUC NO-IP is prone to an information disclosure vulnerability due to a design error...

CVE-2008-2421

creationtimestamp| type| source ---|---|--- 2008-05-21 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/31816...

minibloggie-delete.txt

MiniBloggie Arbitrary Delete Post Vulnerability Author: Cod3rZ Site: http://cod3rz.helloweb.eu PoC: if isset$GET'postid' $postid = $GET'postid'; if isset$GET'confirm' $confirm = $GET'confirm'; ... elseif $confirm=="yes" ... $sql = "DELETE FROM blogdata WHERE postid=$postid"; $query = mysqlquery$s...

CVE-2008-6596

creationtimestamp| type| source ---|---|--- 2008-04-24 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/31704...

CVE-2008-1915

creationtimestamp| type| source ---|---|--- 2008-04-21 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/5480...

CVE-2008-0591

Mozilla Firefox before 2.0.0.12 and Thunderbird before 2.0.0.12 does not properly manage a delay timer used in confirmation dialogs, which might allow remote attackers to trick users into confirming an unsafe action, such as remote file execution, by using a timer to change the window focus, aka...

Design/Logic Flaw

Mozilla Firefox before 2.0.0.12 and Thunderbird before 2.0.0.12 does not properly manage a delay timer used in confirmation dialogs, which might allow remote attackers to trick users into confirming an unsafe action, such as remote file execution, by using a timer to change the window focus, aka...

CVE-2008-0591

Mozilla Firefox before 2.0.0.12 and Thunderbird before 2.0.0.12 does not properly manage a delay timer used in confirmation dialogs, which might allow remote attackers to trick users into confirming an unsafe action, such as remote file execution, by using a timer to change the window focus, aka...