452 matches found
MyTickets 1 to 2.0.8 Blind SQL Injection
No description provided by source. ?php / --------------------------------------------------------------- MyTickets = Remote Blind SQL Injection Exploit by al-swisre --------------------------------------------------------------- author...............: al-swisre mail.................:...
UMN Gopherd 2.x Halidate Function Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/1591/info It is possible to either execute arbitrary code or crash a remote system running University of Minnesota's Gopher Daemon, depending on the data entered. An unchecked buffer exists in the 'halidate' function of...
David Harris Pegasus Mail 3.12 File Forwarding Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/1738/info It is possible for a malicious website operator to obtain copies of known files on a remote system if a website visitor is running Pegasus Mail client. If the following code were to be inserted into a HTML...
SunView (SunOS <= 4.1.1) selection_svc Vulnerability
No description provided by source. Source: http://www.securityfocus.com/bid/8/info On Sun3 and Sun4 systems, a remote system can read any file that is readable to the user running SunView. On the 386i, a remote system can read any file on the workstation running SunView regardless of protections...
iPlanet 4.1 Web Publisher Remote Buffer Overflow Vulnerability (2)
No description provided by source. source: http://www.securityfocus.com/bid/2732/info iPlanet Webserver is an http server product offered by the Sun-Netscape Alliance. By sending a specially crafted request composed of at least 2000 characters it is possible to cause a buffer overflow. This could...
phpplanner <= PHP Planner 0.4 - Multiple Vulnerabilities
No description provided by source. Title: phpplanner = PHP Planner v.0.4 Multiple Vulnerabilities Date: 13/05/10 Author: cp77fk4r | empty0pageSHIFT+2gmail.com | www.DigitalWhisper.co.il Software Link: http://phpplanner.sourceforge.net/ Version: = v.0.4 Tested on: PHP Full Path Disclosure Full Pat...
Brocade Fabric OS Default Credentials
The remote device is a Brocade Fabric OS device that uses a set of known, default credentials. Knowing these, an attacker able to connect to the service can gain control of the device. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...
openSUSE Security Update : libfreetype6 (openSUSE-SU-2010:0549-1)
This update of freetype2 fixes several vulnerabilities that could lead to remote system compromise by executing arbitrary code with user privileges : - CVE-2010-1797: stack-based buffer overflow while processing CFF opcodes - CVE-2010-2497: integer underflow - CVE-2010-2498: invalid free -...
Remote Command Injection in Ruby Gem sfpagent 0.4.14
Title: Remote Command Injection in Ruby Gem sfpagent 0.4.14 Date: 4/15/2014 Author: Larry W. Cashdollar, @larry0 CVE: 2014-2888 Download: http://rubygems.org/gems/sfpagent Vulnerability The list variable generated from the user supplied JSONbody input is passed directly to the system shell on lin...
Ruby Gem sfpagent 0.4.14 Command Injection Vulnerability
Ruby Gem sfpagent version 0.4.14 suffers from a remote command injection vulnerability. Title: Remote Command Injection in Ruby Gem sfpagent 0.4.14 Date: 4/15/2014 Author: Larry W. Cashdollar, @larry0 CVE: 2014-2888 Download: http://rubygems.org/gems/sfpagent Vulnerability The list variable...
Default Password (ironport) for 'admin' Account
The account 'admin' on the remote host has the password 'ironport'. An attacker may leverage this issue to gain access to the affected system and launch further attacks against it. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. account = "admin"; password = "ironport";...
Quantum DXi V1000 2.2.1 - Static SSH Key
Quantum DXi® V-Series is a virtual deduplication backup appliance that protects physical and virtual data across remote sites, the datacenter and cloud deployments. Details: ---------- 0x01 - Default root user The root user has a hardcoded password that is unknown and not changeable. Normally...
Vtiger CRM 5.4.0, 6.0 RC, 6.0.0 GA - Local File Inclusion Vulnerability
Vtiger CRM versions 5.4.0, 6.0 RC, and 6.0.0 GA suffer from a local file inclusion vulnerability. CVE: CVE-2014-1222 Vendor: Vtiger Product: CRM Affected version: Vtiger 5.4.0, 6.0 RC & 6.0.0 GA Fixed version: Vtiger 6.0.0 Security patch 1 Reported by: Jerzy Kramarz Details: A local file inclusio...
Updated polarssl, pdns & ragel packages fix CVE-2013-5915
Updated polarssl packages fix security vulnerability: The researchers Cyril Arnaud and Pierre-Alain Fouque investigated the PolarSSL RSA implementation and discovered a bias in the implementation of the Montgomery multiplication that we used. For which they then show that it can be used to mount ...
FreeBSD : polarssl -- Timing attack against protected RSA-CRT implementation (ccefac3e-2aed-11e3-af10-000c29789cb5)
PolarSSL Project reports : The researchers Cyril Arnaud and Pierre-Alain Fouque investigated the PolarSSL RSA implementation and discovered a bias in the implementation of the Montgomery multiplication that we used. For which they then show that it can be used to mount an attack on the RSA key...
polarssl -- Timing attack against protected RSA-CRT implementation
PolarSSL Project reports: The researchers Cyril Arnaud and Pierre-Alain Fouque investigated the PolarSSL RSA implementation and discovered a bias in the implementation of the Montgomery multiplication that we used. For which they then show that it can be used to mount an attack on the RSA key...
Default Password (nsroot) for 'nsroot' Account
The account 'nsroot' on the remote host has the password 'nsroot'. An attacker may leverage this issue to gain administrative access to the affected system. Note that Citrix NetScaler appliances are known to use these credentials to provide complete, administrative access to the Citrix NetScaler...
[Hidden CMD Detector] Discover Hidden Command prompts
Hidden CMD Detector is the free tool to discover Hidden Command prompts and detect any Hacker presence on your system. The first thing any Hacker does on getting access to remote system is to run a hidden Command shell. This tool can help you to automatically detect any such hidden cmd prompts an...
Default Password (abc123) for 'root' Account
The account 'root' on the remote host has the password 'abc123'. An attacker may leverage this issue to gain full access to the affected system. Note that Junos Space is known to use these credentials by default. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. account = "root"; password =...
Kaspersky Internet Security 2013 - Denial Of Service Vulnerability
Exploit for windows platform in category dos / poc I usually do not write security advisories unless absolutely necessary. This time I should, however I have neither the time, nor the desire to do so. But Kaspersky did not react, so ... quick and dirty: Kaspersky Internet Security 2013 and any...