aquick-winosx.txt

Copyright C 2007 Subreption LLC. All rights reserved. Visit http://blog.subreption.com for exploit development notes. References: http://www.milw0rm.com/exploits/4648 original Microsoft Windows code http://www.milw0rm.com/exploits/4651 recent Microsoft Windows exploit From Metasploit:...

PR07-14: Cross-site Scripting (XSS) / HTML injection on F5 FirePass 4100 SSL VPN 'my.activation.php3' server-side script

PR07-14: Cross-site Scripting XSS / HTML injection on F5 FirePass 4100 SSL VPN 'my.activation.php3' server-side script Date Found: 19th June 2007 Successfully tested on: version 5.5.2 F5 Networks has confirmed the following versions to be vulnerable: FirePass versions 5.4.1 - 5.5.2 FirePass...

Apple QuickTime 7.2/7.3 RSTP Response Universal Exploit (win/osx)

Exploit for multiple platform in category remote exploits ================================================================= Apple QuickTime 7.2/7.3 RSTP Response Universal Exploit win/osx ================================================================= Copyright C 2007 Subreption LLC. All rights...

Apple QuickTime 7.2/7.3 (OSX/Windows) - RSTP Response Universal

Copyright C 2007 Subreption LLC. All rights reserved. Visit http://blog.subreption.com for exploit development notes. References: http://www.milw0rm.com/exploits/4648 original Microsoft Windows code http://www.milw0rm.com/exploits/4651 recent Microsoft Windows exploit From Metasploit:...

Critical: Red Hat Security Advisory: samba security update

Updated samba packages that fix several security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. Samba is a suite of programs used by machines to share files, printers, and other...

CVE-2007-5956

Directory traversal vulnerability in IBM Informix Dynamic Server IDS before 10.00.xC7W1 allows local users to gain privileges by referencing modified NLS message files through directory traversal sequences in the DBLANG environment variable...

CVE-2007-5956

CVE-2007-5956 concerns IBM Informix Dynamic Server (IDS) prior to 10.00.xC7W1. The vulnerability arises from directory traversal using modified NLS message files via the DBLANG environment variable, enabling local users to gain privileges. The description specifies a local-execution/privilege-esc...

CVE-2007-5957

IBM Informix Dynamic Server (IDS) versions 10.00.TC3TL and 11.10.TB4TL on Windows are affected by CVE-2007-5957, with a denial of service (application crash) triggered by unspecified SQ_ONASSIST requests. The available description does not specify the exact root cause, vulnerable component, or co...

Design/Logic Flaw

The DNS server in Microsoft Windows 2000 Server SP4, and Server 2003 SP1 and SP2, uses predictable transaction IDs when querying other DNS servers, which allows remote attackers to spoof DNS replies, poison the DNS cache, and facilitate further attack vectors...

[Full-disclosure] Predictable DNS transaction IDs in Microsoft DNS Server

1 Summary Affected software: Microsoft Windows 2003 SP2, Microsoft Windows 2000 SP4 Server Vendor URL: www.microsoft.com Severity: Medium References: Microsoft Security Bulletin MS07-062, CVE-2007-3898 2 Vulnerability Description Microsoft DNS server generates predictable DNS transaction IDs. If...

CVE-2007-5956: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in IBM Informix Dynamic Server IDS before 10.00.xC7W1 allows local users to gain privileges by referencing modified NLS message files through directory traversal sequences in the DBLANG environment variable...

CVE-2007-3898: Undefined Security Weakness

The DNS server in Microsoft Windows 2000 Server SP4, and Server 2003 SP1 and SP2, uses predictable transaction IDs when querying other DNS servers, which allows remote attackers to spoof DNS replies, poison the DNS cache, and facilitate further attack vectors...

Guidance EnCase Enterprise uses weak authentication to identify target machines

Overview Guidance Software's EnCase Enterprise uses IP authentication to identify target machines. An attacker may be able to provide the EnCase SAFE server with a disk image from a different machine than an investigator requested. Description Guidance Software's EnCase Enterprise allows...

Oracle 10g LT.FINDRICSET Local SQL Injection Exploit (IDS evasion)

No description provided by source. // / Oracle 10g LT.FINDRICSET SQL Injection Exploit / // / sploit grant DBA to scott / / evil cursor injection / / No "create procedure" privileg needed! / / + Funny IDS evasion vith base64 / // / tested on oracle 10.1.0.2.0 / // // / Date of Public EXPLOIT:...

Oracle 10g - LT.FINDRICSET SQL Injection (IDS Evasion)

Oracle 10g - LT.FINDRICSET SQL Injection IDS Evasion // / Oracle 10g LT.FINDRICSET SQL Injection Exploit / // / sploit grant DBA to scott / / evil cursor injection / / No "create procedure" privileg needed! / / + Funny IDS evasion vith base64 / // / tested on oracle 10.1.0.2.0 / // // / Date of...

Oracle 10g LT.FINDRICSET Local SQL Injection Exploit (IDS evasion)

Exploit for multiple platform in category local exploits ================================================================== Oracle 10g LT.FINDRICSET Local SQL Injection Exploit IDS evasion ================================================================== // / Oracle 10g LT.FINDRICSET SQL Injecti...

Oracle 10g - 'LT.FINDRICSET' SQL Injection (IDS Evasion)

// / Oracle 10g LT.FINDRICSET SQL Injection Exploit / // / sploit grant DBA to scott / / evil cursor injection / / No "create procedure" privileg needed! / / + Funny IDS evasion vith base64 / // / tested on oracle 10.1.0.2.0 / // // / Date of Public EXPLOIT: October 26, 2007 / / Written by:...

tomcat handling of cookie values

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the " character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks...

HP-UX Security Patch : PHKL_24753

sig,thd,spinlock,sched,IDS,q3p,prntf,FSS,slp %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if !definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid26351; scriptversion"1.8"; scriptsetattributeattribute:"pluginmodificationdate",...

HP-UX Security Patch : PHKL_28202

POSIX AIO;getdirentries;MVFS;rcp;mmap/IDS; %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if !definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid26386; scriptversion"1.8"; scriptsetattributeattribute:"pluginmodificationdate",...