Apache ActiveMQ Web Console HTML注入漏洞

BUGTRAQ ID: 34552 CNCAN ID：CNCAN-2009041702 Apache ActiveMQ是一款开源消息总线，支持JMS1.1和J2EE 1.4规范的JMS Provider实现。 Apache ActiveMQ管理接口不正确过滤多个表单信息，远程攻击者可以利用漏洞获得敏感信息。 目前没有详细漏洞细节提供。 0 Apache ActiveMQ 5.2 目前没有详细解决方案提供： a href=http://activemq.apache.org/ target=blank rel=external...

CVE-2009-0078

The Windows Management Instrumentation WMI provider in Microsoft Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 does not properly implement isolation among a set of distinct processes that 1 all run under the NetworkService account or 2 all run under the...

VulnCheck KEV: CVE-2009-0078

The Windows Management Instrumentation WMI provider in Microsoft Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 does not properly implement isolation among a set of distinct processes that 1 all run under the NetworkService account or 2 all run under the...

DEBIAN-CVE-2007-6721

The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package before 1.36, has unknown impact and remote attack vectors related to "a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes."...

PT-2009-1169 · Bouncy Castle · Crypto Provider Package +1

Name of the Vulnerable Software and Affected Versions: Bouncy Castle Java Cryptography API versions prior to 1.38 Crypto Provider Package versions prior to 1.36 Description: The issue is related to a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes, which has...

CS-Cart 2.0.0 Beta 3 (product_id) SQL Injection Vulnerability

Exploit for unknown platform in category web applications ============================================================= CS-Cart 2.0.0 Beta 3 productid SQL Injection Vulnerability ============================================================= CS-Cart 2.0.0 Beta 3 dispatch SQL Injection Vulnerabilit...

[SECURITY] Fedora 10 Update: python-fedora-0.3.9-1.fc10

Python modules that help with building Fedora Services. This includes a JS ON based auth provider for authenticating against FAS2 over the network and a client that handles communication with the servers. The client module can be used to build programs that communicate with Fedora Infrastructure'...

[SECURITY] Fedora 9 Update: python-fedora-0.3.9-1.fc9

Python modules that help with building Fedora Services. This includes a JS ON based auth provider for authenticating against FAS2 over the network and a client that handles communication with the servers. The client module can be used to build programs that communicate with Fedora Infrastructure'...

Microsoft Exchange Server EMSMDB32 Literal Processing (MS09-003; CVE-2009-0099)

The Microsoft Exchange Server is an implementation of an email server capable of handling numerous Internet protocol, including the Simple Mail Transfer Protocol SMTP. The EMSMDB32 provider refers to the Exchange Transport provider which implements both a transport and a message store provider fo...

Zoom VoIP Phone Adapater ATA1+1 1.2.5 XSRF Exploit

No description provided by source. Written By Michael Brooks Special thanks to str0ke! Zoom VoIP Phone Adapater ATA1+1 XSRF voip provider change xsrf version 1.2.5 html form action="http://10.1.1.165/callwzd.html" method=post input name=DIRTYPAGE value=3 input name=HELPPAGE value=html.html input...

Zoom VoIP Phone Adapter XSRF Exploit

Written By Michael Brooks Special thanks to str0ke! Zoom VoIP Phone Adapater ATA1+1 XSRF voip provider change xsrf version 1.2.5...

Zoom VoIP Phone Adapater ATA1+1 1.2.5 - Cross-Site Request Forgery

Zoom VoIP Phone Adapater ATA1+1 1.2.5 - Cross-Site Request Forgery Written By Michael Brooks Special thanks to str0ke! Zoom VoIP Phone Adapater ATA1+1 XSRF voip provider change xsrf version 1.2.5 milw0rm.com 2009-01-29...

Zoom VoIP Phone Adapater ATA1+1 1.2.5 XSRF Exploit

Exploit for hardware platform in category remote exploits ================================================== Zoom VoIP Phone Adapater ATA1+1 1.2.5 XSRF Exploit ================================================== Written By Michael Brooks Special thanks to str0ke! Zoom VoIP Phone Adapater ATA1+1 XS...

Zoom VoIP Phone Adapater ATA1+1 1.2.5 - Cross-Site Request Forgery

Written By Michael Brooks Special thanks to str0ke! Zoom VoIP Phone Adapater ATA1+1 XSRF voip provider change xsrf version 1.2.5 milw0rm.com 2009-01-29...

Code injection

The Native Managed Provider for .NET component in IBM DB2 8 before FP17, 9.1 before FP6, and 9.5 before FP2, when a definer cannot maintain objects, preserves views and triggers without marking them inoperative or dropping them, which has unknown impact and attack vectors...

CVE-2008-4692

CVE-2008-4692 affects IBM DB2’s Native Managed Provider for .NET. When a definer cannot maintain objects, it preserves views and triggers without marking them inoperative or dropping them, giving an unknown impact. Remediation is provided via fixes: IBM DB2 9.1 FP6 and DB2 9.5 FP2 (and related pa...

CVE-2008-4692

The Native Managed Provider for .NET component in IBM DB2 8 before FP17, 9.1 before FP6, and 9.5 before FP2, when a definer cannot maintain objects, preserves views and triggers without marking them inoperative or dropping them, which has unknown impact and attack vectors...

Telecom Italia Alice Pirelli routers Backdoor from internal LAN/WAN

No description provided by source. saxdax & drpepperONE Discovered embedded backdoor to activate telnet/ftp/tftp/web extended admin interface with Admin privileges, from internal network lan on Alice ADSL CPE Modem/Router, manufactered by Pirelli based on Broadcom platform. saxdax & drpepperONE...

PT-2008-5010 · Oracle · Java

Name of the Vulnerable Software and Affected Versions: Java versions prior to the fixed version on Mac OS X 10.4.11, 10.5.4, and 10.5.5 Description: The issue is related to an error checking problem in the Hash-based Message Authentication Code HMAC provider in Java, which uses an uninitialized...

CVE-2008-2326

CVE-2008-2326 affects Apple Bonjour for Windows (mDNSResponder) prior to 1.0.5. The vulnerability is a NULL pointer dereference when resolving a crafted .local domain name with a long label, leading to denial of service (application crash). Public docs from multiple sources confirm the issue and ...