2343 matches found
SuSE 11.2 Security Update : PHP5 (SAT Patch Number 5958)
This update of PHP5 fixes multiple security flaws : - missing checks of return values could allow remote attackers to cause a denial of service NULL pointer dereference. CVE-2011-4153 - specially crafted XSLT stylesheets could allow remote attackers to create arbitrary files with arbitrary conten...
Debian DSA-2445-1 : typo3-src - several vulnerabilities
Several remote vulnerabilities have been discovered in the TYPO3 web content management framework : - CVE-2012-1606 Failing to properly HTML-encode user input in several places, the TYPO3 backend is susceptible to Cross-Site Scripting. A valid backend user is required to exploit these...
DSA-2445-1 typo3-src - several
Bulletin has no description...
Tivoli Provisioning Manager Express for Software Distribution Multiple SQL Injections
The remote web application fails to properly sanitize user-supplied input to the following servlets : - Printer.getPrinterAgentKey in the SoapServlet servlet - User.updateUserValue in the register.do servlet - User.isExistingUser in the logon.do servlet - Asset.getHWKey in the CallHomeExec servle...
SuSE 10 Security Update : PHP5 (ZYPP Patch Number 8009)
This update of php5 fixes multiple security flaws : - missing checks of return values could allow remote attackers to cause a denial of service NULL pointer dereference. CVE-2011-4153 - denial of service via hash collisions. CVE-2011-4885 - specially crafted XSLT stylesheets could allow remote...
IBM Report: Mobile Attacks, Phishing Attacks Mount in 2011
Spam volume is down, there are fewer unpatched software holes and oftware application developers did a better job of writing secure code over the last year. But IBM’s X-Force Trend and Risk Report still found plenty to worry about in 2011, according to a copy of the report released this week...
D-Link DIR-605 Cross Site Request Forgery
Exploit Title: D-Link DIR-605 CSRF Vulnerability Date: 20-03-2012 Author: iqzer0++ Version: Firmware Version : 2.00 Tested on: DIR-605 This allows unauthroized access to the device and post injections document.bypass.submit;...
D-Link DIR-605 - Cross-Site Request Forgery
D-Link DIR-605 - Cross-Site Request Forgery Exploit Title: D-Link DIR-605 CSRF Vulnerability Date: 20-03-2012 Author: iqzer0++ Version: Firmware Version : 2.00 Tested on: DIR-605 This allows unauthroized access to the device and post injections document.bypass.submit;...
D-Link DIR-605 CSRF Vulnerability
Exploit for hardware platform in category web applications Exploit Title: D-Link DIR-605 CSRF Vulnerability Date: 20-03-2012 Author: iqzer0++ Version: Firmware Version : 2.00 Tested on: DIR-605 This allows unauthroized access to the device and post injections document.bypass.submit; 0day.today...
D-Link DIR-605 - Cross-Site Request Forgery
Exploit Title: D-Link DIR-605 CSRF Vulnerability Date: 20-03-2012 Author: iqzer0++ Version: Firmware Version : 2.00 Tested on: DIR-605 This allows unauthroized access to the device and post injections document.bypass.submit;...
Multiple SQL injections in rivettracker <=1.03
Exploit Title: Multiple SQL injections in rivettracker =1.03 Date: 2/3/2012 Author: Ali Raheem Software Link: http://www.rivetcode.com/software/rivettracker/ Version: =1.03 Tested on: Linux guruplug-debian 3.1.7 2 PREEMPT Tue Jan 3 20:19:54 MST 2012 armv5tel GNU/Linux Greets: spyware, dividead...
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
YVS Image Gallery Sql injection
-=--------------------ADVISORY-------------------=- YVS Image Gallery Author: Corrado Liotta Aka CorryL [email protected] -=-----------------------------------------------=- -=+ Application: YVS Image Gallery -=+ Version: 0.0.0.1 -=+ Vendor's URL: http://yvs.vacau.com/gallery.html -=+ Platform:...
Fake Antivirus Lives On, Now Infecting 200K WordPress Pages
A new series of mass-injections have been targeting WordPress sites as of late and appear to have already infected more than 200,000 web pages according to a report on Websense’s Security Labs blog earlier this week. The injections lead unsuspecting users to a bogus AV site that appears to perfor...
Rogue Antivirus advertised on 200000 hacked Web pages
Rogue Antivirus advertised on 200000 hacked Web pages The Websense has detected a new wave of mass-injections of a well-known rogue antivirus campaign, a new mass injection attack has infected over 200,000 Web pages, amounting to close to 30,000 unique Web hosts. The attack uses SQL injection...
Rivettracker 1.03 - Multiple SQL Injections
Exploit Title: Multiple SQL injections in rivettracker =5.3.4 and backports we still have arbitary SQL queries but no config.php. config.php contains passwords and usernames for admin, user and mysql database. Other fil...
Rivettracker 1.03 - Multiple SQL Injections
Rivettracker 1.03 - Multiple SQL Injections Exploit Title: Multiple SQL injections in rivettracker =5.3.4 and backports we still have arbitary SQL queries but no config.php. config.php contains passwords and usernames fo...
Fake Chat Screen Malware Hijacks Banking Customers
A new attack against online banking customers uses a malware platform to trick its victims into verifying bogus transactions. The attack, first described by Trusteer CTO Amit Klein, waits for an unsuspecting business banking customer to log online before telling them that “security checks” need t...
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...