CVE-2009-0217

The design of the W3C XML Signature Syntax and Processing XMLDsig recommendation, as implemented in products including 1 the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; 2 the WebLogic Server component in BEA Product Suite 10.3, 10.0...

High security hole in NullLogic Groupware

Hi, I've identified a couple of security flaws affecting the NullLogic Groupware which may allow compromise of accounts, denial of service or even remote code execution. These issues were reported by email to the developer but no response was forthcoming. Tim -- Tim Brown...

[SECURITY] Fedora 10 Update: rb_libtorrent-0.13.1-5.fc10

rblibtorrent is a C++ library that aims to be a good alternative to all the other BitTorrent implementations around. It is a library and not a full featured client, although it comes with a few working example clients. Its main goals are to be very efficient in terms of CPU and memory usage as we...

JVN#32788272 PHP-I-BOARD from Let's PHP! vulnerable to directory traversal

PHP-I-BOARD from Let's PHP! is a bulletin board software. PHP-I-BOARD contains a directory traversal vulnerability. Impact A remote attacker could view an arbitrary file on the server. Solution Update the Software Update to the latest version according to the information provided by the developer...

JVN#86472161 Movable Type cross-site scripting vulnerability

Movable Type, a web log system from Six Apart KK, contains a cross-site scripting vulnerability. This vulnerability is a different vulnerability than past reports on JVN. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update to the latest versio...

Design/Logic Flaw

The PackageManagerService class in services/java/com/android/server/PackageManagerService.java in Android 1.5 through 1.5 CRB42 does not properly check developer certificates during processing of sharedUserId requests at an application's installation time, which allows remote user-assisted...

[oCERT-2009-006] Android improper package verification when using shared uids

2009-006 Android improper package verification when using shared uids Description: Android, an open source mobile phone platform, improperly checks developer certificates when installing packages that request the shared user identifier uid permission. Normally, Android applications will be allowe...

HP-UX Update for HP-UX Pkg HPSBUX02196

Check for the Version of HP-UX Pkg OpenVAS Vulnerability Test HP-UX Update for HP-UX Pkg HPSBUX02196 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the term...

HP-UX Update for Java JRE and JDK HPSBUX02284

Check for the Version of Java JRE and JDK OpenVAS Vulnerability Test HP-UX Update for Java JRE and JDK HPSBUX02284 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

HP-UX Update for HP-UX Pkg HPSBUX02196

Check for the Version of HP-UX Pkg OpenVAS Vulnerability Test HP-UX Update for HP-UX Pkg HPSBUX02196 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the term...

What every programmer needs to know about security

Software security expert Neil Daswani of Google discusses the key things that every Web developer, and developers in general, should know about security, including how SQL injection attacks work...

FlexCMS Calendar Blind SQL Injection

FlexCMS CalendarItemId Blind SQL Injection Vulnerability AUTHOR: MisterRichard Developer site: http://www.flexcms.dk/ Admin login site: http://target.com/flexadmin/ = Vulnerability author : Lanti-Net = Contact: lanti-netathotmaildotcom = Site : www.khg-crew.ws = Greetz: SpYrO , boom3rang, KHG,...

Flex CMS Calendar (ItemId) Blind SQL Injection Vulnerability

Exploit for unknown platform in category web applications =========================================================== FlexCMS Calendar ItemId Blind SQL Injection Vulnerability =========================================================== FlexCMS CalendarItemId Blind SQL Injection Vulnerability...

HP unveils Flash vulnerability scanner

HP has released a free static-analysis tool designed to find vulnerabilities in applications developed on the Adobe Flash platform. But HP SWFScan is no security geek plaything. It’s meant specifically for developers without much in the way of security training. The tool is the brainchild of the...

FlexCMS (catId) Remote SQL Injection Vulnerability

No description provided by source. AUTHOR: MisterRichard FlexCMS Remote SQL Injection Discovered by MisterRichard. Developer site: http://www.flexcms.dk/ Developer has not been notified. Live demo: Injection:...

FlexCMS SQL Injection

AUTHOR: MisterRichard FlexCMS Remote SQL Injection Discovered by MisterRichard. Developer site: http://www.flexcms.dk/ Developer has not been notified. Live demo: Injection: www.target.com/flx/webshop/?catId=145%20union%20all%20select%201,2,3,concatusername,char58,password+from+users--...

Flex CMS (catId) Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications ================================================== FlexCMS catId Remote SQL Injection Vulnerability ================================================== AUTHOR: MisterRichard FlexCMS Remote SQL Injection Discovered by MisterRichard. Develope...

FlexCMS 2.5 - catId SQL Injection

FlexCMS 2.5 - catId SQL Injection AUTHOR: MisterRichard FlexCMS Remote SQL Injection Discovered by MisterRichard. Developer site: http://www.flexcms.dk/ Developer has not been notified. Live demo: Injection:...

FlexCMS 2.5 - 'catId' SQL Injection

AUTHOR: MisterRichard FlexCMS Remote SQL Injection Discovered by MisterRichard. Developer site: http://www.flexcms.dk/ Developer has not been notified. Live demo: Injection: www.target.com/flx/webshop/?catId=145%20union%20all%20select%201,2,3,concatusername,char58,password+from+users--...

4Site CMS <= 2.6 Multiple Remote SQL Injection Vulnerabilities

No description provided by source. WSEC-09-002 4Site CMS = 2.6 Multiple Remote SQL Injections Developer site: http://www.4site.ru/ Discovered by D.Mortalov // wsec.ru 1. Auth Bypass Login: 1'or'1 Password: 1'or’1 2. Multiple Remote SQL Injections in 4site CMS modules "Pages" module:...