php: LCG entropy weakness

The Linear Congruential Generator LCG in PHP before 5.2.13 does not provide the expected entropy, which makes it easier for context-dependent attackers to guess values that were intended to be unpredictable, as demonstrated by session cookies generated by using the uniqid function...

MemHT Portal 4.0.1 - 'User Agent' Persistent Cross-Site Scripting

!/usr/bin/perl MemHT Portal 4.0.1 Persistent Cross Site Scripting Vulnerability user agent by ZonTa - zontahackersatgmaildotcom After successful inject wait for the admin to view statistic page. Fix is available : http://www.memht.com/news149MemHT-Portal-4-0-2.html use Getopt::Std; use...

MemHT Portal 4.0.1 - User Agent Persistent Cross-Site Scripting

MemHT Portal 4.0.1 - User Agent Persistent Cross-Site Scripting !/usr/bin/perl MemHT Portal 4.0.1 Persistent Cross Site Scripting Vulnerability user agent by ZonTa - zontahackersatgmaildotcom After successful inject wait for the admin to view statistic page. Fix is available :...

CVE-2010-4305

Cisco Unified Videoconferencing UVC System 3545, 5110, 5115, and 5230; Unified Videoconferencing 3527 Primary Rate Interface PRI Gateway; Unified Videoconferencing 3522 Basic Rate Interfaces BRI Gateway; and Unified Videoconferencing 3515 Multipoint Control Unit MCU improperly use cookies for...

IBM OmniFind - several vulnerabilities

============================================ ||| Security Advisory ||| ||| CVE-2010-3890 CVE candidate ||| ||| CVE-2010-3891 CVE candidate ||| ||| CVE-2010-3892 CVE candidate ||| ||| CVE-2010-3893 CVE candidate ||| ||| CVE-2010-3894 CVE candidate ||| ||| CVE-2010-3895 CVE candidate ||| |||...

CVE-2010-1834

CFNetwork in Apple Mac OS X 10.6.x before 10.6.5 does not properly validate the domains of cookies, which makes it easier for remote web servers to track users by setting a cookie that is associated with a partial IP address...

CVE-2010-1834

The CVE-2010-1834 issue affects Apple Mac OS X 10.6.x prior to 10.6.5 where CFNetwork does not properly validate cookie domains, allowing a cookie set for a partial IP address to be sent to third-party sites. Root cause: an implementation flaw in CFNetwork’s handling of domain specifications in c...

Web Site Crawler

Crawl a web site and store information about what was found This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Web Site Crawler', 'Description' = 'Crawl a web site and store information about what...

Watcher 1.4.1 - latest version download

"Watcher is a runtime passive-analysis tool for HTTP-based Web applications. Being passive means it won't damage production systems, it's completely safe to use in Cloud computing, shared hosting, and dedicated hosting environments. Watcher detects Web-application security issues as well as...

CVE-2010-3852

The default configuration of Luci 0.22.4 and earlier in Red Hat Conga uses "INSERT SECRET HERE" as its secret key for cookies, which makes it easier for remote attackers to bypass repoze.who authentication via a forged ticket cookie...

CVE-2010-3852

The default configuration of Luci 0.22.4 and earlier in Red Hat Conga uses "INSERT SECRET HERE" as its secret key for cookies, which makes it easier for remote attackers to bypass repoze.who authentication via a forged ticket cookie...

SQL injection in eoCMS

Vulnerability ID: HTB22675 Reference: http://www.htbridge.ch/advisory/sqlinjectionineocms.html Product: eoCMS Vendor: eocms.com http://eocms.com Vulnerable Version: 0.9.04 Vendor Notification: 21 October 2010 Vulnerability Type: SQL Injection Status: Not Fixed, Vendor Alerted, Awaiting Vendor...

Webmedia Explorer 6.13.1 - Persistent Cross-Site Scripting

Webmedia Explorer 6.13.1 - Persistent Cross-Site Scripting Vulnerability ID: HTB22661 Reference: http://www.htbridge.ch/advisory/storedxssvulnerabilityinwebmediaexplorer.html Product: Webmedia Explorer Vendor: Marc Salmurri http://www.webmediaexplorer.com/ Vulnerable Version: 6.13.1 and probably...

Joovili 3.1.8 CRLF injection/HTTP response splitting Vulnerability

Exploit for php platform in category web applications ================================================================== Joovili 3.1.8 CRLF injection/HTTP response splitting Vulnerability ==================================================================...

New Firefox add-on "Firesheep" - hijacks Facebook, Twitter sessions

A new Firefox add-on called "Firesheep," developed by Seattle-based freelance Web application developer Eric Butler, enables almost anyone to scan a Wi-Fi network and hijack others' access to popular services like Facebook, Twitter, and others. Butler unveiled Firesheep at the ToorCon security...

1 6 2 1 0 0 Site Navigation 1. 9 local file inclusion vulnerability-vulnerability warning-the black bar safety net

Breaking app breaking vulnerability, but in order to encourage everyone to learn, or sent to. Reject malicious destruction! Program official: http://download.162100.com admin directory run.php the file part of the code is as follows: I find the Upload Directory editor/index.html Use the upload...

Alstrasoft e-Friends 4.96 - Multiple Vulnerabilities

AlstraSoft E-Friends 4.96 Multiple Remote Vulnerabilities Name AlstraSoft E-Friends Vendor http://www.alstrasoft.com Versions Affected 4.96 Author Salvatore Fresta aka Drosophila Website http://www.salvatorefresta.net Contact salvatorefresta at gmail dot com Date 2010-10-27 X. INDEX I. ABOUT THE...

Intermittent Session Lost During Add/Edit Page in Firefox

We customized Seraph to integrate with our SSO Server. Seraph will perform session validation through cookies. When using firefox, we found that in 1 out of 5 to 8 times when we edit a page or add a new page, we will lose our session and be directed back to the login page. This does not happen in...

Intermittent Session Lost During Add/Edit Page in Firefox

We customized Seraph to integrate with our SSO Server. Seraph will perform session validation through cookies. When using firefox, we found that in 1 out of 5 to 8 times when we edit a page or add a new page, we will lose our session and be directed back to the login page. This does not happen in...

Wiccle Web Builder CMS / iWiccle CMS Community Builder Cross Site Scripting

Wiccle Web Builder CMS and iWiccle CMS Community Builder Multiple Cross-Site Scripting Vulnerability. SecPod Technologies www.secpod.com Author Veerendra G.G SecPod ID: 1005 09/07/2010 Issue Discovered 09/10/2010 Vendor Notified 09/13/2010 Vendor Confirmed 09/14/2010 Fix Available Class: Cross-Si...