Mozilla Firefox 3.0.10 / SeaMonkey 1.1.16 - Address Bar URI Spoofing

source: https://www.securityfocus.com/bid/35388/info Mozilla Firefox and SeaMonkey are affected by a URI-spoofing vulnerability because they fail to adequately handle user-supplied data. An attacker may leverage this issue by inserting arbitrary content to spoof a URI presented to an unsuspecting...

Criminals surfing the Conficker hype

By Georg Wicherski As already reported by F-Secure, criminals are using the Conficker hype to push rogue anti-virus software to computer users. Their solution will sometimes display false alerts on clean systems and try to lure their victims into buying a fake cleaning program for $39.95 from the...

APC PowerChute Network Shutdown - HTTP Response Splitting / Cross-Site Scripting

source: https://www.securityfocus.com/bid/33924/info APC PowerChute Network Shutdown is prone to an HTTP-response-splitting vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary...

Bluo CMS 1.2 (index.php id) Blind SQL Injection Vulnerability

Exploit for unknown platform in category web applications ============================================================= Bluo CMS 1.2 index.php id Blind SQL Injection Vulnerability =============================================================...

webstudiocms-sql.txt

submitted: 09/01/2008 10:01 AM ----------------------------------------------------------------------------------- Scr!pt : WebStudio CMS V3rs!0n : ! S!t3 : http://www.bdigital.biz/?pageid=214 Dork : Powered by WebStudio Auth0r : BorN To K!LL...

cnn-xss.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear CNN, I recently discovered a security vulnerability on the www.cnn.com website. I believe the vulnerability can be used by a remote user to alter content on www.cnn.com. On 10 Nov 2008, I wrote to...

SaturnCMS (view) Blind SQL Injection Vulnerability

Exploit for unknown platform in category web applications ================================================== SaturnCMS view Blind SQL Injection Vulnerability ================================================== SaturnCMS view Blind SQL Injection Vulnerability Author: Hussin X script :...

Microsoft iExplorer ' ' Address Bar URI Spoofing Vulnerability

This host is installed with Microsoft Internet Explorer and is prone to an URI spoofing vulnerability. OpenVAS Vulnerability Test $Id: secpodmsiexplorerurispoofvuln900170.nasl 8957 2018-02-26 14:41:13Z asteins $ Description: Microsoft iExplorer '' Address Bar URI Spoofing Vulnerability Authors:...

Diesel Job Site - job_id Blind SQL Injection

Diesel Job Site - jobid Blind SQL Injection Diesel Job Site Blind Sql Injection P0c Author : Stack Home Script : http://www.dieselscripts.com Desc : look the select Job Viewed: in real id+and+1=1 true the times change each time but in real id+and+1=0 false it remains stable go to url exploit or p...

false vulnerability report

Hi As the author, I would like to request a removal of one of my vulnerability articles. http://securityvulns.com/Udocument99.html The reason for this is because I've recently tested the "exploit" on other palm centro phones, and the exploit would not work for them. It seems to only work on my...

Invision Power Board 2.x - Signature iFrame Security

Invision Power Board 2.x - Signature iFrame Security source: https://www.securityfocus.com/bid/28466/info Invision Power Board IP.Board is prone to a security vulnerability that can aid attackers in social-engineering attacks. Attacker-supplied script code could exploit vulnerabilities in the...

Invision Power Board 2.x - 'Signature' iFrame Security

source: https://www.securityfocus.com/bid/28466/info Invision Power Board IP.Board is prone to a security vulnerability that can aid attackers in social-engineering attacks. Attacker-supplied script code could exploit vulnerabilities in the user's browser or give the user a false sense of securit...

Debian Security Advisory DSA 010-1 (gnupg)

The remote host is missing an update to gnupg announced via advisory DSA 010-1. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Blakord Portal <= Beta 1.3.A (all modules) SQL Injection Vulnerability

No description provided by source. --==+=================== Spanish Hackers Team www.spanish-hackers.com =================+==-- --==+ Blakord Portal = Beta 1.3.A all modules Blind Sql Injection +==-- --==+===================================================================================+==-- +...

CVE-2003-1398

CVE-2003-1398 affects Cisco IOS 12.0–12.2 when IP routing is disabled. The vulnerability allows remote attackers to cause a denial of service by sending false ICMP redirect messages, which can modify network routing. Connected sources corroborate the issue as a router-directed DoS via ICMP redire...

CVE-2007-0004

The NFS client implementation in the kernel in Red Hat Enterprise Linux RHEL 3, when a filesystem is mounted with the noacl option, checks permissions for the open system call via vfspermission mode bits data rather than an NFS ACCESS call to the server, which allows local client processes to...

CVE-2007-0004: Undefined Security Weakness

The NFS client implementation in the kernel in Red Hat Enterprise Linux RHEL 3, when a filesystem is mounted with the noacl option, checks permissions for the open system call via vfspermission mode bits data rather than an NFS ACCESS call to the server, which allows local client processes to...

Security Best Practice: Protect Yourself against DNS Cache Poisoning

DNS cache poisoning occurs when false DNS records are injected into a DNS server's cache tables. Once the cache tables have been altered, a remote attacker may inspect, capture or corrupt any information exchanged between hosts on the network. By poisoning a DNS server, a remote attacker could, f...

Design/Logic Flaw

ageet AGEphone before 1.6.2, running on Windows Mobile 5 on the HTC HyTN Pocket PC device, allows remote attackers to 1 cause a denial of service call disruption and device hang via a SIP message with a malformed header and 2 cause a denial of service call disruption, false ring indication, and...

Nessus Windows Scan Not Performed with Admin Privileges

The Nessus scanner testing the remote host has been given SMB credentials to log into the remote host, however these credentials do not have administrative privileges. Typically, when Nessus performs a patch audit, it logs into the remote host and reads the version of the DLLs on the remote host ...