SAP Netweaver SQL Monitors — Multiple XSS

Application: SAP Netweaver Administrator panel Versions Affected: SAP Netweaver Administrator panel from ECC 6.0 Vendor URL: Bugs: XSS Exploits: YES Reported: 07.09.2009 Vendor response: 08.09.2009 Date of Public Advisory: 09.11.2010 Author: Alexandr Polyakov and Alexey Troshichev Description Ope...

Dowd, Hawkes Win Google Native Client Attack Contest

Mark Dowd and Ben Hawkes, two well-known security researchers, have won a contest put on by Google to find exploitable security flaws in the company’s Native Client system. The pair discovered 12 exploitable issues, seven more than the next most successful team. Dowd, a researcher in IBM ISS’s...

CVE-2009-2428

creationtimestamp| type| source ---|---|--- 2009-07-07 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/34809 2009-07-07 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/34810...

MS09-032: Cumulative Security Update of ActiveX Kill Bits (973346)

The remote host is missing a list of kill bits for ActiveX controls that are known to contain vulnerabilities. If these ActiveX controls are ever installed on the remote host, either now or in the future, they would expose it to various security issues. %NASLMINLEVEL 70300 C Tenable Network...

CVE-2009-2341

creationtimestamp| type| source ---|---|--- 2009-07-02 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/9080...

CMS Chainuk 1.2 LFI / XSS

CMS Chainuk = v.1.2 Vulns Home: Cms.tut.su Dork: "Cms.tut.su, 2009 g." eLwauxc 14.06.2 LFI /index.php --------------------------------------------------------------------------- 6: if isset$GET 'id' 7: 8: color=white$id = $GET 'id';/color 9: 10: else 11: 12: $id = $index; 13: 14: if fileexists...

CVE-2009-2362

creationtimestamp| type| source ---|---|--- 2009-07-01 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/9064 2009-07-01 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/9070 2009-07-15 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/9152...

CVE-2009-2363

creationtimestamp| type| source ---|---|--- 2009-07-01 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/9070 2009-07-01 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/9064 2009-07-15 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/9152...

CVE-2009-2364

creationtimestamp| type| source ---|---|--- 2009-07-01 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/9060 2010-11-11 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/15489 2010-11-18 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/15569...

FreeBSD : nagios -- Command Injection Vulnerability (3ebd4cb5-657f-11de-883a-00e0815b8da8)

Secunia reports : A vulnerability has been reported in Nagios, which can be exploited by malicious users to potentially compromise a vulnerable system. Input passed to the 'ping' parameter in statuswml.cgi is not properly sanitised before being used to invoke the ping command. This can be exploit...

CVE-2009-3225

creationtimestamp| type| source ---|---|--- 2009-06-27 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/33117 2009-06-27 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/33116...

Password Stealers Riding Along with DirectShow Exploits

On May 28, our colleagues at The Microsoft Security Response Center released advisory 971778 which elaborated on a new vulnerability in Microsoft DirectShow effecting Windows 2000, Windows XP and Windows Server 2003. You can obtain more details on how to protect your environment from this...

PHP Address Book 4.0.x SQL Injection

-------------------------------------------------------------------- MULTIPLE SQL INJECTION VULNERABILITIES --PHP-AddressBook v-4.0.X-- -------------------------------------------------------------------- CMS INFORMATION: --WEB: http://sourceforge.net/projects/php-addressbook/ --DOWNLOAD:...

Oracle BI help page - XSS

Application: Oracle Business Intelligence Versions Affected: Oracle Business Intelligence Enterprise Edition 10.1.3.4.0 Vendor URL: http://www.oracle.com Bugs: XSS/phishing credentials Exploits: YES Reported: 26.06.2009 Vendor response: 27.06.2009 Last response: 30.06.2009 Patched: 16.10.2012 Dat...

AlumniServer 1.0.1 - Authentication Bypass

AlumniServer 1.0.1 - Authentication Bypass || || || -----------------------------------------\ == -- ----------- ---------------------------- ------------------/ VIVA SPAIN!...GANAREMOS EL MUNDIAL!...o.O PROUD TO BE SPANISH!...

AlumniServer 1.0.1 SQL Injection

--------------------------------------------------------- SQL INJECTION VULNERABILITY --AlumniServer v-1.0.1-- --------------------------------------------------------- CMS INFORMATION: --WEB: http://www.alumniserver.net/ --DOWNLOAD: http://www.alumniserver.net/ --DEMO: N/A --CATEGORY:...

CVE-2009-2882

creationtimestamp| type| source ---|---|--- 2009-06-24 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/33106 2009-06-24 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/33108 2009-06-24 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/33107 2009-06-24...

CVE-2009-3513

creationtimestamp| type| source ---|---|--- 2009-06-24 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/33121 2009-06-24 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/33120 2009-06-24 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/33119...

CVE-2009-0714

creationtimestamp| type| source ---|---|--- 2009-06-23 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/9007 2009-06-23 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/9006...

CVE-2009-4690

creationtimestamp| type| source ---|---|--- 2009-06-20 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/33098 2009-06-20 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/33097...