Microsoft Crypto API X.509 Certificate Validation - Remote Information Disclosure

source: https://www.securityfocus.com/bid/28548/info Microsoft's Crypto API library is prone to an information-disclosure vulnerability because HTTP requests to arbitrary hosts and ports may be automatically triggered when validating X.509 certificates. Successful exploits allow attackers to...

CVE-2008-1240

LiveConnect in Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9 does not properly parse the content origin for jar: URIs before sending them to the Java plugin, which allows remote attackers to access arbitrary ports on the local machine. NOTE: this is closely related to CVE-2008-1195...

Design/Logic Flaw

LiveConnect in Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9 does not properly parse the content origin for jar: URIs before sending them to the Java plugin, which allows remote attackers to access arbitrary ports on the local machine. NOTE: this is closely related to CVE-2008-1195...

CVE-2008-1240

LiveConnect in Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9 does not properly parse the content origin for jar: URIs before sending them to the Java plugin, which allows remote attackers to access arbitrary ports on the local machine. NOTE: this is closely related to CVE-2008-1195...

CVE-2008-1240

Technical details for CVE-2008-1240 are not present in the connected documents. The initial description notes a jar URI content-origin parsing issue in LiveConnect affecting Firefox/SeaMonkey, but there are no accompanying technical specifics (affected product versions, root cause, or fixes) in t...

Mozilla Firefox / Seamonkey multiple security vulnerabilities

Javascript privilege esccalation and code execution, crossite scripting, multiple DoS conditions, URI and dialogs spoofing, local ports access from Java, privacy problems on SSL authentication...

ZyXEL ZyWALL Quagga/Zebra (default pass) Remote Root Vulnerability

No description provided by source. Name: ZyXEL ZyWALL Quagga/Zebra Remote Root Vulnerability Release Date: 10 March 2008 Discover: Pranav Joshi [email protected] Vendor: ZyXEL Products Affected: ZyWALL Status on other affected products & firmwares pending from vendor’s end CVE-2008-1160 BID...

UltraVNC buffer overflow vulnerability

Overview UltraVNC viewer contains a buffer overflow vulnerability. If exploited, this vulnerability may allow an attacker to execute arbitrary code. Description UltraVNC viewer is a remote desktop application that allows a user to control compatible VNC servers. The UltraVNC viewer includes a...

EMC RepliStor远程堆溢出漏洞

BUGTRAQ ID: 27915 CVECAN ID: CVE-2008-6426 EMC RepliStor是实时容灾备份解决方案。 EMC RepliStor处理畸形请求数据时存在漏洞，远程攻击者可能利用此漏洞控制服务器。 EMC RepliStor中负责执行压缩的代码未经考虑目标缓冲区的大小便解压了数据，这可能触发堆溢出，导致以RepliStor Server或Control Server的权限（通常为SYSTEM）执行任意指令。攻击者无需认证便可以触发这些漏洞，但必须要能够连接到目标服务器的TCP 7144或7145端口。 EMC RepliStor 6.2 SP2 厂商补丁：...

CVE-2008-0834

Cross-site scripting XSS vulnerability in Lotus Quickr for i5/OS before 8.0.0.2 Hotfix 11, when anonymous access is disabled on HTTP ports, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

iDefense Security Advisory 02.12.08: Adobe Flash Media Server 2 Memory Corruption Vulnerability

iDefense Security Advisory 02.12.08 http://labs.idefense.com/intelligence/vulnerabilities/ Feb 12, 2008 I. BACKGROUND Adobe Flash Media Server is an application server for Flash based applications. It provides an environment to run interactive media applications, as well as audio and video...

PT-2008-2007 · Oki · Oki C5510Mfp Printer

Name of the Vulnerable Software and Affected Versions: OKI C5510MFP Printer CU H2.15, PU 01.03.01, System F/W 1.01, and Web Page 1.00 Description: The issue allows remote attackers to obtain the administrative password by connecting to TCP port 5548 or 7777, as the printer sends its configuration...

[CSNC] OKI C5510MFP Printer Password Disclosure

COMPASS SECURITY ADVISORY http://www.csnc.ch/ Product: OKI C5510MFP Printer Vendor: OKI Printing Solutions http://www.okiprintingsolutions.com/ Subject: Printer Reveals Password / Password and the configuration can be altered without authentication Risk: High Effect: Remotely exploitable Author:...

Solaris SPARC / x86 Local Socket Hijack Exploit

No description provided by source. / $ An open security advisory 7 - SUN Solaris SOREUSEADDR Local Socket Hijack Bug 1: Bug Researcher: c0ntex - c0ntexbatgmail.com 2: Bug Released: July 06 2005 3: Bug Impact Rate: Medium / Hi 4: Bug Scope Rate: Local / Remote ...

Adobe Flash Player sandbox protection bypass

SecurityErrorEvent can be used for client ports scanning...

[EXPL] Socket Connection Timing Can Reveal Information About Network Configuration (Exploit)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

[EXPL] Socket Connection Timing Can Reveal Information About Network Configuration (Exploit)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

Microsoft Windows Server 2000 SP4 (Advanced Server) - Message Queue (MS07-065)

merry christmas Sysadmins Microsoft Message Queue POC exploit MS07-065 Mario Ballano - mballanogmail.com - http://www.48bits.com Andres Tarasco - atarascogmail.com - http://www.tarasco.org Original Advisory: http://www.zerodayinitiative.com/advisories/ZDI-07-076.html Microsoft Bulletin :...

NSFOCUS SA2007-02 : Cisco Security Agent Remote Buffer Overflow Vulnerability

NSFOCUS Security Advisory SA2007-02 Cisco Security Agent Remote Buffer Overflow Vulnerability Release Date: 2007-12-06 CVE ID: CVE-2007-5580 http://www.nsfocus.com/english/homepage/research/0702.htm Affected systems & software =================== Cisco Security Agent for Windows 4.5.1.672 Cisco...

JBoss HSQLDB component remote command injection

Unknown vulnerability in the HSQLDB component in JBoss 3.2.1 and 3.0.8 on Java 1.4.x platforms, when running in the default configuration, allows remote attackers to conduct unauthorized activities and possibly execute arbitrary code via certain SQL statements to 1 TCP port 1701 in JBoss 3.2.1, a...