VUPEN Security Research - RealPlayer RA5 Data Handling Heap Overflow Vulnerability (VUPEN-SR-2010-31)

VUPEN Security Research - RealPlayer RA5 Data Handling Heap Overflow Vulnerability VUPEN-SR-2010-31 http://www.vupen.com/english/research.php I. BACKGROUND --------------------- "RealPlayer is a media player available to play, manage and download all your mp3, flash and video files" from real.com...

Spree e-commerce JSON Hijacking Vulnerabilities - CVE-2010-3978

Dear List, I'm writing on behalf of the Check Point Vulnerability Discovery Team to publish the following vulnerability. Check Point Software Technologies - Vulnerability Discovery Team VDT http://www.checkpoint.com/defense/ Spree e-commerce JSON Hijacking Vulnerabilities CVE-2010-3978 INTRODUCTI...

cforms WordPress Plugin Cross Site Scripting

Check Point Software Technologies - Vulnerability Discovery Team VDT http://www.checkpoint.com/defense/ cforms WordPress Plugin Cross Site Scripting Vulnerability CVE-2010-3977 INTRODUCTION According to Delicious Days, "cforms is a powerful and feature rich form plugin for WordPress, offering...

Moroccan Hacktivists Target Foreign Sites, Sparking International Cyber Conflicts

Hacktivists are militant hackers attacking sites in Egypt, Morocco, Spain, and Israel. Their screen messages resemble banners used in protests, supporting various political, social, or religious ideologies. Active in Morocco, they often hack sensitive security systems. Behind their computer...

FreeBSD : horde-base -- XSS and CSRF vulnerabilities (8fc55043-cb1e-11df-9c1b-0011098ad87f)

The Horde team reports : Thanks to Naumann IT Security Consulting for reporting the XSS vulnerability. Thanks to Secunia for releasing an advisory for the new CSRF protection in the preference interface The major changes compared to Horde version 3.3.8 are : Fixed XSS vulnerability in...

SecTor

Toronto, Ontario, Canada Billed as “Canada’s Premiere IT Security Conference” they might want to ask the CanSecWest folks about that, SecTor is an annual security confab that draws some of the top security researchers and IT professionals from the Great White North and the U.S. to Toronto for...

Notacon

Cleveland, Ohio A hacker con in the truest sense, this Cleveland, Ohio, based conference takes place in April and combines sessions on traditional IT security with craftier fare like the convergence of clothes, fashion and hacking, biomimicry and mimetic engineering. Now in its eighth year, Notac...

Day-Con

Dayton, Ohio When I say “Dayton,Ohio,” what image comes to mind? Hacking, right? If not, then you’ve never been to Day-Con, the annual Ohio-based hacker con now in its fourth year. This year’s Day-Con is scheduled for October 22nd and 23rd, with three days of training preceding the main conferenc...

Quick Player 1.3 Unicode SEH Exploit

Quick Player 1.3 Unicode SEH Exploit Author Abhishek Lyall and Puneet Jain [email protected] , abhilyallatgmaildotcom, infoataslitsecuritydotcom Web - http://www.aslitsecurity.com/ Blog - http://www.aslitsecurity.blogspot.com/ Download Vulnerable application from...

Quick Player 1.3 - Unicode (SEH)

Quick Player 1.3 - Unicode SEH Quick Player 1.3 Unicode SEH Exploit Author Abhishek Lyall and Puneet Jain [email protected] , abhilyallatgmaildotcom, infoataslitsecuritydotcom Web - http://www.aslitsecurity.com/ Blog - http://www.aslitsecurity.blogspot.com/ Download Vulnerable applicatio...

Quick Player 1.3 - Unicode (SEH)

Quick Player 1.3 Unicode SEH Exploit Author Abhishek Lyall and Puneet Jain [email protected] , abhilyallatgmaildotcom, infoataslitsecuritydotcom Web - http://www.aslitsecurity.com/ Blog - http://www.aslitsecurity.blogspot.com/ Download Vulnerable application from...

XSS in Horde IMP <=4.3.7, fetchmailprefs.php

Hi, Horde IMP v4.3.7 and lower are subject to a cross site scripting XSS vulnerability: The fetchmailprefs.php script fails to properly sanitize user supplied input to the 'fmid' URL parameter. If exploited, injected code will be persistent persistent XSS and will execute once the user manually...

Preventing Data Breaches: Lessons From Higher Education

Since 2008, higher education institutions have experienced a staggering 158 data breaches resulting in over 2.3 million reported records compromised. In 2009 alone there were 57 reported data breaches, and year to date through July of 2010, there have already been 32 breaches. Considering that mo...

DJ Studio Pro Version 8.1.3.2.1 SEH Exploit

Exploit for windows platform in category local exploits =========================================== DJ Studio Pro Version 8.1.3.2.1 SEH Exploit =========================================== DJ Studio Pro Version 8.1.3.2.1 SEH 0 day Author Abhishek Lyall - abhilyallatgmaildotcom,...

DJ Studio Pro 8.1.3.2.1 - Local Overflow (SEH)

DJ Studio Pro 8.1.3.2.1 - Local Overflow SEH DJ Studio Pro Version 8.1.3.2.1 SEH 0 day Author Abhishek Lyall - abhilyallatgmaildotcom, infoataslitsecuritydotcom Web - http://www.aslitsecurity.com/ Blog - http://www.aslitsecurity.blogspot.com/ Download Vulnerable application from...

XSS in Horde Application Framework <=3.3.8, icon_browser.php

Hi, Horde Application Framework v3.3.8 and lower are subject to a cross site scripting XSS vulnerability. The iconbrowser.php script fails to properly sanitize user supplied input to the 'subdir' URL parameter before printing it out as part of a HTML formatted error message. The following URL can...

Audiotran 1.4.2.4 SEH Overflow

Audiotran 1.4.2.4 SEH Overflow Exploit 0 day Author Abhishek Lyall - abhilyallatgmaildotcom, infoataslitsecuritydotcom Web - http://www.aslitsecurity.com/ Blog - http://www.aslitsecurity.blogspot.com/ Download Vulnerable application from http://www.e-soft.co.uk/Audiotran.htm Vulnerable version...

Audiotran 1.4.2.4 SEH Overflow Exploit

Exploit for windows platform in category local exploits ====================================== Audiotran 1.4.2.4 SEH Overflow Exploit ====================================== Audiotran 1.4.2.4 SEH Overflow Exploit 0 day Author Abhishek Lyall - abhilyallatgmaildotcom, infoataslitsecuritydotcom Web -...

Horde Application Framework 3.3.8 Cross Site Scripting

Hi, Horde Application Framework v3.3.8 and lower are subject to a cross site scripting XSS vulnerability. The iconbrowser.php script fails to properly sanitize user supplied input to the 'subdir' URL parameter before printing it out as part of a HTML formatted error message. The following URL can...

Microsoft Excel Featheader Buffer Overflow

MS Excel Malformed FEATHEADER Record Exploit CVE-2009-3129, MS09-067, OSVDB-59860 Author Abhishek Lyall - abhilyallatgmaildotcom, infoataslitsecuritydotcom Web - http://www.aslitsecurity.com/ Blog - http://www.aslitsecurity.blogspot.com/ Vulnerble application MS office 2003/2007 Tested on XP SP2 ...