Web File Browser 0.4b14 File Download

Exploit Title: Web File Browser 0.4b14 File Download Vulnerability Date: 2011/11/03 Author: Sangyun YOO Email: yoosy0302 at naver dot com Software Link: http://downloads.sourceforge.net/project/webfilebrowser/webfilebrowser/0.4b14/webfilebrowser-0.4b14.zip Version: Web File Browser 0.4b14 Tested...

kernel: net: improve sequence number generation

The 1 IPv4 and 2 IPv6 implementations in the Linux kernel before 3.1 use a modified MD4 algorithm to generate sequence numbers and Fragment Identification values, which makes it easier for remote attackers to cause a denial of service disrupted networking or hijack network sessions by predicting...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Simple Machines Forum SMF 2.x before 2.0.1 allows remote attackers to hijack the authentication of administrators or moderators via vectors involving image files, a different vulnerability than CVE-2011-3615. NOTE: some of these details are obtaine...

Researchers To Demonstrate Tor Network Hijack Method

Researchers at the Hackers To Hackers Conference in Brazil will detail a method of hijacking the TOR anonymity network, potentially putting its users at risk, while The Tor Project accuses one of the researchers of irresponsible disclosure. The presentation combines work done by Eric Filiol of th...

Microsoft YouTube Channel Hijacked

Microsoft joined Sesame Street as the latest high profile organization to have its official Youtube channel hacked and hijacked, according to a report from GeekWire. Microsoft videos that had been posted in the channel were removed and replaced with solicitations for sponsorship fme before...

OCS Inventory NG 2.0.1 - Persistent Cross-Site Scripting

OCS Inventory NG 2.0.1 - Persistent XSS CVE-2011-4024 ------------------------------------------------------- Software : Open Computer and Software OCS Inventory NG Download : http://www.ocsinventory-ng.org/ Discovered by : Nicolas DEROUET nicolas.derouetgmailcom Discover : 2011-10-04 Published :...

OCS Inventory NG 2.0.1 Persistent XSS

Exploit for windows platform in category web applications OCS Inventory NG 2.0.1 - Persistent XSS CVE-2011-4024 ------------------------------------------------------- Software : Open Computer and Software OCS Inventory NG Download : http://www.ocsinventory-ng.org/ Discovered by : Nicolas DEROUET...

DEDECMS full version gotopage variable XSS ROOTKITS, 0DAY-vulnerability warning-the black bar safety net

Affected versions: DEDECMS full version The vulnerability described in: DEDECMS background landing template gotopage variable is not tested incoming data, leading toXSSvulnerabilities. \dede\templets\login.htm 6 5 the left and right input type="hidden" name="gotopage" value="? php if!...

CVE-2010-4881

Multiple cross-site request forgery CSRF vulnerabilities in calendar.class.php in ApPHP Calendar ApPHP CAL allow remote attackers to hijack the authentication of unspecified victims for requests that use the 1 categoryname, 2 categorydescription, 3 eventname, or 4 eventdescription parameter...

CVE-2011-2191

Cross-site request forgery CSRF vulnerability in Cherokee-admin in Cherokee before 1.2.99 allows remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting XSS sequences, as demonstrated by a crafted nickname field to vserver/apply...

7-Technologies Interactive Graphical SCADA

Overview ICS-CERT originally released Advisory ICSA-11-353-01P on the US-CERT secure portal on December 19, 2011. This web page release was delayed to allow users time to download and install the update. Researcher Kuang-Chun Hung of Security Research and Service Institute--Information and...

FBC Market CMS v1.1 - Multiple Web Vulnerabilities

Document Title: =============== FBC Market CMS v1.1 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=281 Release Date: ============= 2011-09-21 Vulnerability Laboratory ID VL-ID: ==================================== 281...

FBC Market CMS v1.1 - Multiple Web Vulnerabilities

Document Title: =============== FBC Market CMS v1.1 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=281 Release Date: ============= 2011-09-21 Vulnerability Laboratory ID VL-ID: ==================================== 281...

CVE-2011-3424

Session fixation vulnerability in the Managed File Transfer server in TIBCO Managed File Transfer Internet Server before 7.1.1 and Managed File Transfer Command Center before 7.1.1, and the server in TIBCO Slingshot before 1.8.1, allows remote attackers to hijack web sessions via unspecified...

Argus Surveillance DVR v2.3 & 4.x - Multiple Vulnerabilities

Document Title: =============== Argus Surveillance DVR v2.3 & 4.x - Multiple Vulnerabilities Release Date: ============= 2011-09-12 Vulnerability Laboratory ID VL-ID: ==================================== 227 Abstract Advisory Information: ============================== Vulnerability Lab Team...

BarackObama Online Service - Persistent Web Vulnerability

Document Title: =============== BarackObama Online Service - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=270 http://www.acunetix.com/blog/news/obama-email-servers-hacked-xss/ Release Date: ============= 2011-09-11...

URGE (Universal Rapid Gamma Emitter) Hijacking Twitter Trends Released by Anonymous

URGE Universal Rapid Gamma Emitter Hijacking Twitter Trends Released by Anonymous Anonymous have created something called Universal Rapid Gamma Emitter, or more simply URGE, which hijacks Twitter trending topics, allowing Anonymous members and supporters to subvert the topic with their own embedd...

Session fixation

Session fixation vulnerability in TIBCO Spotfire Server 3.0.x before 3.0.2, 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.1, and Spotfire Analytics Server before 10.1.1, allows remote attackers to hijack web sessions via unspecified vectors...

CVE-2011-3133

The CVE affects TIBCO Spotfire Server 3.0.x before 3.0.2, 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.1, and Spotfire Analytics Server before 10.1.1. It is a session-fixation vulnerability that allows remote attackers to hijack web sessions via unspecified vectors. Remediation pe...

(SWAT): Absent CSRF protection in various Samba web configuration formulars

Multiple cross-site request forgery CSRF vulnerabilities in the Samba Web Administration Tool SWAT in Samba 3.x before 3.5.10 allow remote attackers to hijack the authentication of administrators for requests that 1 shut down daemons, 2 start daemons, 3 add shares, 4 remove shares, 5 add printers...