WebGUI lib/WebGUI/Storage.pm远程脚本代码执行漏洞

BUGTRAQ ID: 32602 WebGUI是一个CMS（内容管理系统）软件，主要用来方便网站内容的发布与维护。 WebGUI没有正确地过滤某些邮件附件。如果用户在使用协作系统的邮件功能的话，就可以向协作系统发送包含有可执行程序（如perl程序、shell脚本或php页面）的附件；如果Web服务器设置可可执行上述类型文件，从协作系统的web视图点击文件就会执行程序。 Plain Black Software WebGUI 7.x 临时解决方法： 编辑lib/WebGUI/Storage.pm并用以下代码替换addFileFromScalar方式： sub...

Altiris Deployment Solution Server < 6.9.355 Password Disclosure (SYM08-020)

The version of the Altiris Deployment Solution installed on the remote host reportedly is affected by a password disclosure vulnerability. Altiris Deployment Solution Server reportedly stores 'Application Identity Account password' in the system memory in plain-text. It may be possible for an...

Symantec Altiris Deployment Solution明文口令漏洞

BUGTRAQ ID: 31767 Symantec Altiris Deployment Solution是自动化的操作系统部署解决方案，用于从统一的位置部署和管理服务器、桌面和笔记本等。 Symantec Altiris Deployment Solution代理在系统内存中以明文存储了安装期间所设置的Application Identity Account口令，授权访问Deployment Solution Server系统的非特权用户可以从系统内存检索这个口令，然后利用这个口令对客户端执行各种操作。 Symantec Altiris Deployment Solution 6.x...

pNews 2.03 (newsid) Remote SQL Injection Vulnerability

No description provided by source. . . | / | | \ \ | / / |\ \ \ |/ // / /\ \ / |/ \ / // | / | | / \ \ / / // \ / \ |/| || \\ /|\ / / / / \ / \ / / / \ | | /\ /\ / \ | \ // est.2007 / / forum.darkc0de.com --d3hydr8 -rsauron-baltazar -sinner01 -C1c4Tr1Z - beenu...

pNews 2.03 - newsid SQL Injection

pNews 2.03 - newsid SQL Injection . . | / | | \ \ | / / |\ \ \ |/ // / /\ \ / |/ \ / // | / | | / \ /|\ / / / / \ / \ / / / \ | | /\ /\ / \ | \ // est.2007 / / forum.darkc0de.com --d3hydr8 -rsauron-baltazar -sinner01 -C1c4Tr1Z - beenu ---QKrun1x-P47tr1ck - FeDeReR -MAGE -JeTFyrE...

pNews 2.03 (newsid) Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications ====================================================== pNews 2.03 newsid Remote SQL Injection Vulnerability ====================================================== Title: Powie's pNews v2.03 newskom.php?newsid= Remote SQL Injection Exploit...

[IVIZ-08-007] DriveCrypt Security Model bypass exploiting wrong BIOS API usage

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ----------------------------------------------------------------------- iViZ Security Advisory 08-007 25/08/2008 - ----------------------------------------------------------------------- iViZ Techno Solutions Pvt. Ltd. http://www.ivizsecurity.com -...

[IVIZ-08-008] LILO Security Model bypass exploiting wrong BIOS API usage

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ----------------------------------------------------------------------- iViZ Security Advisory 08-008 25/08/2008 - ----------------------------------------------------------------------- iViZ Techno Solutions Pvt. Ltd. http://www.ivizsecurity.com -...

[IVIZ-08-003] TrueCrypt Security Model bypass exploiting wrong BIOS API usage

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ----------------------------------------------------------------------- iViZ Security Advisory 08-003 25/08/2008 - ----------------------------------------------------------------------- iViZ Techno Solutions Pvt. Ltd. http://www.ivizsecurity.com -...

[IVIZ-08-002] Hewlett-Packard BIOS Plain Text Password Disclosure

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ----------------------------------------------------------------------- iViZ Security Advisory 08-002 25/08/2008 - ----------------------------------------------------------------------- iViZ Techno Solutions Pvt. Ltd. http://www.ivizsecurity.com -...

[IVIZ-08-005] IBM Lenovo BIOS Plain Text Password Disclosure

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ----------------------------------------------------------------------- iViZ Security Advisory 08-005 25/08/2008 - ----------------------------------------------------------------------- iViZ Techno Solutions Pvt. Ltd. http://www.ivizsecurity.com -...

[IVIZ-08-004] Intel BIOS Plain Text Password Disclosure

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ----------------------------------------------------------------------- iViZ Security Advisory 08-004 25/08/2008 - ----------------------------------------------------------------------- iViZ Techno Solutions Pvt. Ltd. http://www.ivizsecurity.com -...

[IVIZ-08-006] DiskCryptor Security Model bypass exploiting wrong BIOS API usage

----------------------------------------------------------------------- iViZ Security Advisory 08-006 25/08/2008 ----------------------------------------------------------------------- iViZ Techno Solutions Pvt. Ltd. http://www.ivizsecurity.com...

Intrinsic Swimage Encore does not securely manage login credentials

Overview Intrinsic Swimage Encore has an unencrypted, hardcoded, default password that could allow an attacker access to protected data. Description Intrinsic Swimage Encore automates remote desktop, server, and device deployment. This product includes both a server and a client solution. The...

CVE-2008-3503

RSSFromParent in Plain Black WebGUI before 7.5.13 does not restrict view access to Collaboration System CS RSS feeds, which allows remote attackers to obtain sensitive information CS data...

Information disclosure

RSSFromParent in Plain Black WebGUI before 7.5.13 does not restrict view access to Collaboration System CS RSS feeds, which allows remote attackers to obtain sensitive information CS data...

CVE-2008-3503

Plain Black WebGUI prior to 7.5.13 has an RSSFromParent flaw that does not restrict CS RSS feed view access, enabling remote disclosure of Collaboration System data. A fix is available in 7.5.13 (beta released) and later versions; upgrade to mitigate. Technical details: affected product/component...

CVE-2008-3503

RSSFromParent in Plain Black WebGUI before 7.5.13 does not restrict view access to Collaboration System CS RSS feeds, which allows remote attackers to obtain sensitive information CS data...

viart-sql.txt

GulfTech Security Research July 28, 2008 Vendor : ViArt, Ltd URL : http://www.viart.com/ Version : ViArt Shop = 3.5 Risk : SQL Injection Description: ViArt Shop is a full featured online ecommerce solution written in php. There is a high risk SQL Injection in ViArt that allows for an attacker to...

ViArt Shop 3.5 - 'category_id' SQL Injection

GulfTech Security Research July 28, 2008 Vendor : ViArt, Ltd URL : http://www.viart.com/ Version : ViArt Shop = 3.5 Risk : SQL Injection Description: ViArt Shop is a full featured online ecommerce solution written in php. There is a high risk SQL Injection in ViArt that allows for an attacker to...