PT-2011-1716

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 2.3.6 Description The issue arises from improper handling of e-mail messages with UTF-8 characters associated with diacritical marks and an invalid charset in the From line. This allows remote...

PT-2011-1698

Name of the Vulnerable Software and Affected Versions PmWiki version 2.2.20 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the from parameter to the "Main/WikiSandbox" page. Recommendations For PmWiki...

CVE-2010-4748: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in pmwiki.php in PmWiki 2.2.20 allows remote attackers to inject arbitrary web script or HTML via the from parameter to Main/WikiSandbox. NOTE: some of these details are obtained from third party information...

Cross site scripting

Cross-site scripting XSS vulnerability in Hypermail 2.2.0 allows remote attackers to inject arbitrary web script or HTML via a crafted From address, which is not properly handled when indexing messages...

CVE-2010-4339

Cross-site scripting XSS vulnerability in Hypermail 2.2.0 allows remote attackers to inject arbitrary web script or HTML via a crafted From address, which is not properly handled when indexing messages...

CVE-2010-4339

Cross-site scripting XSS vulnerability in Hypermail 2.2.0 allows remote attackers to inject arbitrary web script or HTML via a crafted From address, which is not properly handled when indexing messages...

PT-2011-1508

Name of the Vulnerable Software and Affected Versions Hypermail version 2.2.0 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via a crafted From address. This occurs because the From address is not properly handled when indexing messages...

CVE-2010-4339: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Hypermail 2.2.0 allows remote attackers to inject arbitrary web script or HTML via a crafted From address, which is not properly handled when indexing messages...

WinZip 15.0 - WZFLDVW.OCX Text Property Denial of Service

Exploit Title: Winzip WZFLDVW.OCX text property access violation Author: fady mohamed osman Software Link : http://www.winzip.com/downwz.htm Version: 15.0 Build 9334 Tested on: Win XP Sp2 CVE : N/A Website : http://www.darkmasters.co.cc/ Twitter : http://twitter.com/FadyOsman 'Wscript.echo...

SuSE 11 Security Update : Xen (SAT Patch Number 2230)

Collective Xen/201004 Update, containing fixes for the following issues : - pygrub, reiserfs: Fix on-disk structure definition bnc537370 - Xen on SLES 11 does not boot - endless loop in ATA detection bnc561912 - xend leaks memory bnc564750 - Keyboard Caps Lock key works abnormal under SLES11 xen...

Free CD to MP3 Converter 3.1 - Local Buffer Overflow

!usr/bin/perl Exploit Title: Exploit 0day Buffer Overflow Free CD to MP3 Converter 3.1 Date: 09\11\2010 Author: C4SS!0 G0M3S Software Link: http://www.eusing.com/Download/cdtomp3freeware.exe Version: 3.1 Tested on: WIN-XP SP3 Exploit Writted by C4SS!0 G0M3S Home: http://www.invasao.com.br E-mail:...

Fraud Advisory for Consumers Released: Involvement in Criminal Activity Through Work from Home Scams

As part of a joint effort, the United States Secret Service, the Federal Bureau of Investigation, the Internet Crime Complaint Center IC3 and the Financial Services Information Sharing and Analysis Center FS-ISAC have released Fraud Advisory for Consumers: Involvement in Criminal Activity through...

iworkstation 9.3.2.1.4 - Local Overflow (SEH)

iworkstation Version 9.3.2.1.4 seh exploit Author Sanjeev Gupta san.gupta86atgmail.com Download Vulnerable application from http://www.sharewareplaza.com/iworkstation-downloads68989.html Vulnerable version iworkstation Version 9.3.2.1.4 Tested on XP SP2 Greets Puneet Jain my $head =...

CVE-2010-2851: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the BookLibrary From Same Author combooklibrary module 1.5 and possibly earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action to index.php...

CVE-2009-4939

Multiple cross-site scripting XSS vulnerabilities in index.php in AdPeeps 8.5d1 allow remote attackers to inject arbitrary web script or HTML via the 1 uid parameter, 2 uid parameter in a loginlookup action, 3 uid parameter in an adminlogin action, 4 campaignid parameter in a createcampaign actio...

Google Chrome 5.0.375.99更新修复多个安全漏洞

BUGTRAQ ID: 41334 CVE ID: CVE-2010-2645,CVE-2010-2646,CVE-2010-2647,CVE-2010-2648,CVE-2010-2649,CVE-2010-2650,CVE-2010-2651,CVE-2010-2652 Google Chrome是Google发布的开源WEB浏览器。 Chrome的5.0.375.99版本更新修复了多个安全漏洞，用户受骗访问恶意网页就可能导致拒绝服务或完全入侵用户系统。 1 在使用WebGL时Chrome中可能出现越界读访问错误。 2 Chrome没有正确地隔离沙盒中的IFRAME元素。 3...

SQL inj: вывод данных, без указания имён столбцов

SQL inj: вывод данных, без указания имён столбцов Необходимые условия: MySQL = 4.0 нужно наличие оператора union SQL инъекция должна быть с выводом слепые инъекции не подходят Кол-во столбцов в уязвимом запросе = чем кол-во столбцов в таблице, данные из которой нужно вывести Достаточно большое...

SAP's web module OLK SQL Injection vulnerability

SAP's web module OLK: SQL Injection $ Author: salcho - [email protected] $ Home : CSL Labs $ Date : 27/06/2010 $ + Vendor : http://www.topmanage.com.pa/ + Product : http://www.topmanage.com.pa/products/1/ + Version : 1.91.30 Prior versions might be vulnerable too. + Dork : inurl: /olk/cp...

GoodiWare GoodReader iPhone - '.XLS' Denial of Service

I wrote a fuzzer "dumb fuzzer" and used a sample from http://www.ccp14.ac.uk/ccp/web-mirrors/bca-spreadsheets/scanplot101.xls which I randomly found on the internet. I mutated the data and tested roughly 1000 cases on several Document Reader Applications for iPhone...

MacOS X EvoCam HTTP GET Buffer Overflow

This module exploits a stack buffer overflow in the web server provided with the EvoCam program for Mac OS X. We use Dino Dai Zovi's exec-from-heap technique to copy the payload from the non-executable stack segment to heap memory. Vulnerable versions include 3.6.6, 3.6.7, and possibly earlier...