WebSVN 2.0 - Cross-Site Scripting / File Handling / Code Execution

WebSVN alertdocument.cookie; A url like the one above would display a JavaScript alert window containing the cookie data of any set cookies for the domain. File Handling Issues: There are some file handling issues in the RSS functionality used by WebSVN. The issue is caused by the following bit o...

[SECURITY] [DSA 1643-1] New feta packages fix denial of service

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1643-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff October 05, 2008 http://www.debian.org/security/faq -...

Debian DSA-1643-1 : feta - insecure temp file handling

Dmitry E. Oboukhov discovered that the 'to-upgrade' plugin of Feta, a simpler interface to APT, dpkg, and other Debian package tools creates temporary files insecurely, which may lead to local denial of service through symlink attacks. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Gentoo Security Advisory GLSA 200501-31 (teTeX)

The remote host is missing updates announced in advisory GLSA 200501-31. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Gentoo Security Advisory GLSA 200404-01 (Portage)

The remote host is missing updates announced in advisory GLSA 200404-01. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Acoustica Beatcraft .bcproj文件处理栈溢出漏洞

BUGTRAQ ID: 30938 Beatcraft是一款简单易用的击鼓演奏软件。 Beatcraft在处理项目文件（.bcproj）时存在栈溢出漏洞，如果用户受骗打开的项目文件中包含有超长的乐器标题的话，就会触发这个溢出，导致执行任意指令 Acoustica Beatcraft 1.02 Build 19 Acoustica --------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://acoustica.com/mixcraft/index.htm...

ClamAV < 0.93.1 memcpy() .chm File Handling DoS (deprecated)

Binary data 4642.prm...

FreeBSD Security Advisory (FreeBSD-SA-06:03.cpio.asc)

The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-06:03.cpio.asc SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CUPS < 1.3.8 PNG File Handling Multiple Overflows

According to its banner, the version of CUPS installed on the remote host is affected by an integer overflow. Using a specially crafted PNG file with overly long width and height fields, a remote attacker can leverage this issue to crash the affected service and may allow execution of arbitrary...

F-PROT Antivirus Engine < 4.4.4 Multiple File Handling DoS Vulnerabilities

The version of F-PROT Anti-Virus installed on the remote Windows host contains flaws in the way it handles CHM, UPX-compressed, ASPack-compressed and certain Microsoft office files. - A malformed CHM file containing '0xffffffff' in the 'nbdir' field could crash the application. - A malformed...

VLC Media Player < 0.8.6i WAV File Handling Integer Overflow

The installed version of VLC media player is affected by an integer overflow vulnerability. By tricking a user into opening a malicious .WAV file, it may be possible to cause a denial of service condition or execute arbitrary code within the context of the affected application. C Tenable Network...

Apple QuickTime "file: URL" arbitrary code execution

Overview Apple QuickTime does not properly handle "file: URLs" which may allow an attacker to execute arbitrary code. Description Apple QuickTime is a multiplatform multimedia software architecture which provides file format converters for more than 250 common image, video, and audio file...

Hiki arbitrary file deletion vulnerability

Overview Hiki, a Wiki clone software developed by Hiki Development Team, contains a vulnerability that allows a remote attacker to delete arbitrary files. Hiki contains a vulnerability that allows an arbitrary file to be deleted on a server running Hiki. This is caused by the improper handling of...

Microsoft恶意软件保护引擎多个拒绝服务漏洞(MS08-029)

BUGTRAQ ID: 29060,29073 CVECAN ID: CVE-2008-1437,CVE-2008-1438 Microsoft恶意软件保护引擎可为防病毒和反间谍软件客户端提供扫描、监测和清除功能。 Microsoft恶意软件保护引擎处理特制文件的方式中存在拒绝服务漏洞，攻击者可以通过建立特制文件来利用此漏洞，当目标计算机系统接收或Microsoft恶意软件保护引擎扫描到此文件时，就可能导致Microsoft恶意软件保护引擎停止响应和自动重新启动，或耗尽所有磁盘空间 0 Microsoft Windows Live OneCare Microsoft Antigen fo...

CVE-2008-1688

Unspecified vulnerability in GNU m4 before 1.4.11 might allow context-dependent attackers to execute arbitrary code, related to improper handling of filenames specified with the -F option. NOTE: it is not clear when this issue crosses privilege boundaries...

MS Visual Basic Enterprise Ed. 6 SP6 DSR File Local BOF Exploit

No description provided by source. usage: exploit.py print "-----------------------------------------------------------------------" print ' PoC 2 MS Visual Basic Enterprise Ed. 6 SP6 ".dsr" File Handling BoF\n' print " author: shinnai" print " mail: shinnaiatautisticidotorg"...

msbasic-overflow.txt

usage: exploit.py print "-----------------------------------------------------------------------" print ' PoC 2 MS Visual Basic Enterprise Ed. 6 SP6 ".dsr" File Handling BoF\n' print " author: shinnai" print " mail: shinnaiatautisticidotorg" print " site: http://shinnai.altervista.org\n" print "...

Microsoft Visual Basic Enterprise Ed. 6 SP6 DSR File Local BoF Exploit

MS Visual Basic Enterprise Ed. 6 SP6 DSR File Local BOF Exploit. Local exploit for windows platform usage: exploit.py print "-----------------------------------------------------------------------" print ' PoC 2 MS Visual Basic Enterprise Ed. 6 SP6 ".dsr" File Handling BoF\n' print " author:...

FreeBSD : bzip2 -- crash with certain malformed archive files (063399fc-f6d6-11dc-bcee-001c2514716c)

SecurityFocus reports : The 'bzip2' application is prone to a remote file-handling vulnerability because the application fails to properly handle malformed files. Exploit attempts likely result in application crashes. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

CVE-2008-0052

CoreServices in Apple Mac OS X 10.4.11 treats .ief as a safe file type, which allows remote attackers to force Safari users into opening an .ief file in AppleWorks, even when the "Open 'Safe' files" preference is set...