Q&A: CanSecWest hacker Charlie Miller

At the CanSecWest security conference in Vancouver BC, I got a chance to sit down with Charlie Miller, the researcher who won the Pwn2Own hacking contest by exploiting a fully patched MacBook Air machine using a Safari code execution vulnerability. We discuss the state of Web browser security, th...

Pixie CMS SQL Injection and Cross Site Scripting Vulnerabilities

Pixie CMS is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modif...

Pwn2Own trifecta: Hacker exploits IE8, Firefox, Safari

All three major Web browsers — Microsoft’s Internet Explorer 8, Mozilla Firefox and Apple’s Safari — failed to survive the hacker onslaught at this year’s CanSecWest Pwn2Own contest. A security researcher named “Nils” he declined to provide his full name performed a clean drive-by download attack...

Oracle Application Server — Linked XSS vulnerability

Application: Oracle BPEL Console version 10.1.3.3.0 Versions Affected: Oracle BPEL Console version 10.1.3.3.0 Vendor URL: Bugs: XSS Exploits: YES Reported: 18.03.2009 Vendor response: 19.03.2009 Date of Public Advisory: 20.10.2010 CVE: CVE-2010-3581 Author: Alexandr Polyakov Description XSS in...

CVE-2009-1071

creationtimestamp| type| source ---|---|--- 2009-03-18 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/8236 2009-09-10 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/9628...

Port reuse shellcode-exploit warning-the black bar safety net

Port reuse shellcode Author: thorn The hard disk has a lot of use a variety of techniques to achieve the port reuse shellcode, are based on the previous write. Turned out a relatively dwarfish, patch to the here. Want to expand your friends can own change. This shellcode can also be easily extend...

CVE-2009-1038

creationtimestamp| type| source ---|---|--- 2009-03-13 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/8207 2009-03-16 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/8217...

CMS WEBjump! - Multiple SQL Injections

CMS WEBjump! - Multiple SQL Injections +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Powered by Content Management System WEBjump! SQL Injection Vulnerability +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Author : M3NW5 contach :...

CVE-2009-4883

creationtimestamp| type| source ---|---|--- 2009-03-09 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/8182 2009-03-31 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/8330...

Oracle BI Publisher — Response Splitting

Application: Oracle Business Intelligence Enterprise Edition 10.1.3.4.0 Versions Affected: Oracle Business Intelligence Enterprise Edition 10.1.3.4.0 Vendor URL: Bugs: Response Splitting, XSS, Phishing credentials Exploits: YES Reported: 03.03.2009 Vendor response: 04.03.2009 Last response:...

CVE-2009-0037

creationtimestamp| type| source ---|---|--- 2009-03-03 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/32834...

Graugon PHP Article Publisher 1.0 - SQL Injection Cookie Handling

Graugon PHP Article Publisher 1.0 - SQL Injection Cookie Handling 0x01 Informations: Name : Graugon PHP Article Publisher 1.0 Download : http://www.hotscripts.com/listings/jump/download/88458/ Vulnerability : Multiple Sql Injections / Insecure Cookie Handling Author : x0r Contact :...

CVE-2009-0885

creationtimestamp| type| source ---|---|--- 2009-03-02 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/8135 2009-03-02 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/8137...

Solaris/x86 - add services and execve inetd - 201 bytes

No description provided by source. / Solaris/x86 Just execve's the following: "echo "ingreslock stream tcp nowait root /bin/sh sh -i"/tmp/x;" "/usr/sbin/inetd -s /tmp/x; /bin/rm -f /tmp/x"; for a trivial remote bd. Used in a few old Solaris/x86 remote exploits. / char c0de =...

Graugon PHP Article Publisher 1.0 SQL Injection

0x01 Informations: Name : Graugon PHP Article Publisher 1.0 Download : http://www.hotscripts.com/listings/jump/download/88458/ Vulnerability : Multiple Sql Injections / Insecure Cookie Handling Author : x0r Contact : [email protected] Notes : Proud to be Italian 0x02 Bug: Bugged Page: index.ph...

Graugon PHP Article Publisher 1.0 - SQL Injection / Cookie Handling

0x01 Informations: Name : Graugon PHP Article Publisher 1.0 Download : http://www.hotscripts.com/listings/jump/download/88458/ Vulnerability : Multiple Sql Injections / Insecure Cookie Handling Author : x0r Contact : [email protected] Notes : Proud to be Italian 0x02 Bug: Bugged Page: index.ph...

[DSECRG-09-008] JOnAS(4.10.3) - Linked XSS Vulnerability

Digital Security Research Group DSecRG Advisory DSECRG-09-008 ------------------link to original advisory -------------------------- http://www.dsecrg.com/pages/vul/show.php?id=81 Application: JOnAS Java Open Application Server Versions Affected: JOnAS4.10.3 / Apache Tomcat 5.5.26 Vendor URL:...

Adobe under fire for poor security response

In the wake of the zero-day attacks against Adobe’s Acrobat and Reader product lines, the company is taking a lot of flack for its poor response to handling the issue — specifically around communicating the risks and providing migitation guidance for end users. Over on the ZDNet Zero Day blog, I...

Pwn2Own 2009: Browsers and smart phones are targets

TippingPoint’s Zero Day Initiative has released the rules for this year’s CanSecWest PWN2OWN contest, which will target unpatched flaws in Web browsers and mobile devices. Among the target list this year: Microsoft’s Internet Explorer 8, Apple’s Safari, Google’s Chrome, Windows Mobile, Google...

MS Internet Explorer 7 Memory Corruption Exploit (MS09-002) (xp sp2)

Exploit for unknown platform in category remote exploits ==================================================================== MS Internet Explorer 7 Memory Corruption Exploit MS09-002 xp sp2 ==================================================================== // Skyland win32 bindshell 28876/tcp...