PT-2010-4261 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions prior to the fixed version Description: A remote code execution issue exists in the way the Windows common control library renders specially crafted Web sites when using a third-party scalable vector graphics SVG...

CVE-2010-3887

The Limit Mail feature in the Parental Controls functionality in Mail on Apple Mac OS X does not properly enforce the correspondence whitelist, which allows remote attackers to bypass intended access restrictions and conduct e-mail communication by leveraging knowledge of a child's e-mail address...

Design/Logic Flaw

The Limit Mail feature in the Parental Controls functionality in Mail on Apple Mac OS X does not properly enforce the correspondence whitelist, which allows remote attackers to bypass intended access restrictions and conduct e-mail communication by leveraging knowledge of a child's e-mail address...

CVE-2010-3887

The CVE-2010-3887 issue affects the Limit Mail feature in the Parental Controls of Mail on Apple Mac OS X. Root cause: the correspondence whitelist is not properly enforced. Impact: remote attackers could bypass access restrictions and conduct e-mail communication by knowing a child’s and a paren...

CVE-2010-3887

The Limit Mail feature in the Parental Controls functionality in Mail on Apple Mac OS X does not properly enforce the correspondence whitelist, which allows remote attackers to bypass intended access restrictions and conduct e-mail communication by leveraging knowledge of a child's e-mail address...

Adobe Details Reader Protected Mode Sandbox

Adobe officials have said that the next version of Reader, one of the more popular and oft-targeted applications on the Internet right now, will have a sandboxing feature, and now the company is providing a detailed description of the new Protected Mode addition. Adobe’s Brad Arkin, the director ...

msnshell remote code execution vulnerability-vulnerability warning-the black bar safety net

Author: mad Dog Source: Tick Brief description: msnshell is a versatile msn auxiliary tool that has a convenient and powerful chat encryption functions, so that its user base is very broad, but the application has some has been in existence for many years of remote code execution vulnerabilities...

Microsoft Internet Explorer - Unsafe Scripting Misconfiguration (Metasploit)

$Id: ieunsafescripting.rb 10394 2010-09-20 08:06:27Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

SonicWALL SSL VPN End Point Interrogator Installer ActiveX Control

SonicWALL SSL VPN provides secure remote access to mission-critical resources from any endpoint including desktops, laptops, PDAs and smartphones. SonicWALL SSL VPN is bundled with a number of ActiveX controls such as, EPInstaller End Point Installer and EPInterrogator End Point Interrogator, tha...

Do You Know What Your Database Users Are Doing?

In our last column, we focused on privilege escalation attacks, and the impact that this category of SQL injection attacks can have on the database – particularly where specific database vulnerabilities exist, and can be exploited through the manipulation of privileges. Let’s look more deeply at...

VWar Cross Site Scripting / SQL Injection / Broken Access Controls

Back in April 2008 I found a bunch of vulnerabilities in PHP clan management system, however the project had just changed hands. Since then the new project leader has been assuring me that new secure release which fixed all the found issues was just around the corner. Over two years later I...

This Week in Security: Phantom Firefox Menace, Mass Domain Ownage and The Curious Case of IE6

There’s old, and there’s old. Internet Explorer 6 clearly falls into the latter category, but despite its advancing age, IE6 still holds a lot of sway in the enterprise, as new data that came to light this week. That’s not the only weirdness that reared its head this week, though. There was the...

DEBIAN-CVE-2010-2242

Red Hat libvirt 0.2.0 through 0.8.2 creates iptables rules with improper mappings of privileged source ports, which allows guest OS users to bypass intended access restrictions by leveraging IP address and source-port values, as demonstrated by copying and deleting an NFS directory tree...

Security Settings for ActiveX controls and OLE objects in Office 2003 and in the 2007 Office suite

Resolves the issue on how users can have the ability to control if and how ActiveX controls and OLE objects load with an Office kill-bit list.Important This article contains information that shows you how to help lower security settings or how to turn off security features on a computer. You can...

httpd: mod_proxy_ftp FTP command injection via Authorization HTTP header

The modproxyftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server via vectors related to the embedding of these commands in the Authorization HTTP header, as demonstrated by a certain module in VulnDisco Pa...

Invensys Wonderware Archestra ConfigurationAccessComponent ActiveX control stack buffer overflow

Overview The Invensys Wonderware Archestra ConfigurationAccessComponent ActiveX control contains a stack buffer overflow that could allow a remote attacker to execute arbitrary code on an affected system Description The Invensys Wonderware Archestra ConfigurationAccessComponent ActiveX control,...

CVE-2010-0814

The Microsoft Access Wizard Controls in ACCWIZ.dll in Microsoft Office Access 2003 SP3 and 2007 SP1 and SP2 do not properly interact with the memory-allocation approach used by Internet Explorer during instantiation, which allows remote attackers to execute arbitrary code via a web site that...

Design/Logic Flaw

The Microsoft Access Wizard Controls in ACCWIZ.dll in Microsoft Office Access 2003 SP3 and 2007 SP1 and SP2 do not properly interact with the memory-allocation approach used by Internet Explorer during instantiation, which allows remote attackers to execute arbitrary code via a web site that...

Microsoft Security Bulletin MS10-044 - Critical Vulnerabilities in Microsoft Office Access ActiveX Controls Could Allow Remote Code Execution (982335)

Microsoft Security Bulletin MS10-044 - Critical Vulnerabilities in Microsoft Office Access ActiveX Controls Could Allow Remote Code Execution 982335 Published: July 13, 2010 Version: 1.0 General Information Executive Summary This security update resolves two privately reported vulnerabilities in...

Microsoft Office Access ActiveX Controls Remote Code Execution Vulnerabilities (982335)

This host is missing a critical security update according to Microsoft Bulletin MS10-044. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...