Sql injection

One Click Orgs before 1.2.3 allows remote authenticated users to trigger crafted SMTP traffic via 1 " double quote and newline characters in an org name or 2 " double quote characters in an e-mail address, related to a "2nd Order SMTP Injection" issue...

CVE-2011-4555

CVE-2011-4555 affects One Click Orgs prior to version 1.2.3. The issue is that user accounts do not require unique e-mail addresses, enabling remote authenticated users to cause login disruption (denial of service) or to spoof votes/comments by selecting a conflicting e-mail address. Root cause: ...

CVE-2011-4555: Undefined Security Weakness

One Click Orgs before 1.2.3 does not require unique e-mail addresses for user accounts, which allows remote authenticated users to cause a denial of service login disruption or spoof votes or comments by selecting a conflicting e-mail address...

Linux Foundation & Linux.com multiple server compromised

Linux Foundation & Linux.com multiple server compromised The Linux Foundation has pulled its websites from the web to clean up from a "security breach". A notice posted on the Linux Foundation said the entire infrastructure including LinuxFoundation.org, Linux.com, and their subdomains are down f...

WordPress Plugin SendIt 1.5.9 - Blind SQL Injection

Exploit Title: WordPress SendIt plugin getvar"SELECT COUNT FROM $tableemail where email ='$POSTemailadd' and idlista = '$POSTlista';"; As you can see, $POSTlista parameter is nor validated neither escaped, so you can blind sql inject it using $usercount for the boolean condition checking :...

WordPress Plugin SendIt 1.5.9 - Blind SQL Injection

WordPress Plugin SendIt 1.5.9 - Blind SQL Injection Exploit Title: WordPress SendIt plugin getvar"SELECT COUNT FROM $tableemail where email ='$POSTemailadd' and idlista = '$POSTlista';"; As you can see, $POSTlista parameter is nor validated neither escaped, so you can blind sql inject it using...

bugzilla -- multiple vulnerabilities

A Bugzilla Security Advisory reports: The following security issues have been discovered in Bugzilla: Internet Explorer 8 and older, and Safari before 5.0.6 do content sniffing when viewing a patch in "Raw Unified" mode, which could trigger a cross-site scripting attack due to the execution of...

PayPal vulnerability : Hack any Paypal account within 30 seconds

PayPal vulnerability : Hack any Paypal account within 30 seconds UPDATE : This has been debunked, Paypal accounts are safe. https://thenextweb.com have spoken in depth to Matt Langley, the person who discovered the supposed issue, and it's clear why he assumed there was a serious security breach...

JVN#40382909: Microsoft Outlook read receipt function vulnerability

Microsoft Outlook contains a vulnerability in the read receipt function. A read receipt may be sent unintentionally, notifying the sender that the email was received. Impact A spam distributor may use this information to determine whether an email address is valid or not. Solution Upgrade the...

IBM Lotus Domino iCalendar Email Address ORGANIZER:mailto Header Remote Overflow

According to its self-reported version, the remote SMTP service is an instance of IBM Lotus Domino that is is affected by a remote stack-based buffer overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input. Successfully exploiting this issue may allow...

Design/Logic Flaw

Open Ticket Request System OTRS before 2.2.7 sends e-mail containing a Bcc header field that lists the Blind Carbon Copy recipients, which allows remote attackers to obtain potentially sensitive e-mail address information by reading this field...

Facebook new Vulnerability, Lots of Accounts misused for spamming !

Facebook new Vulnerability, Lots of Accounts misused for Spamming ! Facebook New Vulnerability, This time Facebook Groups are Vulnerable , One by one we getting more on more bugs in Facebook. Last days their was lots of bugs in Facebook page, because of that lots of big pages got hacked, Now 1000...

Code injection

The deliver function in the sendmail delivery agent lib/mail/network/deliverymethods/sendmail.rb in Ruby Mail gem 2.2.14 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an e-mail address...

rubygem-mail -- Remote Arbitrary Shell Command Injection Vulnerability

Secunia reports: Input passed via an email from address is not properly sanitised in the "deliver" function lib/mail/network/deliverymethods/sendmail.rb before being used as a command line argument. This can be exploited to inject arbitrary shell commands...

FreeBSD : php-filter -- Denial of Service (c623f058-10e7-11e0-becc-0022156e8794)

The following DoS condition in filter extension was fixed in PHP 5.3.4 and PHP 5.2.15 : Stack consumption vulnerability in the filtervar function in PHP 5.2.x through 5.2.14 and 5.3.x through 5.3.3, when FILTERVALIDATEEMAIL mode is used, allows remote attackers to cause a denial of service memory...

Account protection status warning scares Facebook Users !

Over the last few weeks we have been contacted by a number of members of the our Facebook page, concerned by a message they saw on Facebook, warning them that their account protection was "very low". With fake anti-virus also known as scareware attacks becoming an ever-growing problem they attemp...

CVE-2010-3717

The t3libdiv::validEmail function in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 does not properly restrict input to filtervar FILTERVALIDATEEMAIL operations in PHP, which allows remote attackers to cause a denial of service memory consumption and application crash via a...

Quick Player 1.3 - Unicode (SEH)

Quick Player 1.3 - Unicode SEH Quick Player 1.3 Unicode SEH Exploit Author Abhishek Lyall and Puneet Jain [email protected] , abhilyallatgmaildotcom, infoataslitsecuritydotcom Web - http://www.aslitsecurity.com/ Blog - http://www.aslitsecurity.blogspot.com/ Download Vulnerable applicatio...

BPJewelry Store SQL Injection

----------------------------------------------------------------------------------------- BPJewelry Store SQL-i Vulnerability ----------------------------------------------------------------------------------------- 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /'...

Windows Mobile 6.5 TR WinCE 5.2 MessageBox Shellcode ARM

Windows Mobile 6.5 TR WinCE 5.2 MessageBox Shellcode ARM. Shellcode exploit for windows platform / Device: HTC Touch2 System: Windows Mobile 6.5 TR WinCE 5.0.2 Addresses of functions can be different on different devices so , you can edit the functions addresses. Coded by Celil Ünüver from...