Open Source Classifieds v1.1.0 Alpha (OSClassi) Mult Vulnerabilities

Exploit for unknown platform in category web applications ==================================================================== Open Source Classifieds v1.1.0 Alpha OSClassi Mult Vulnerabilities ==================================================================== / / / | | \ | |/ | ' \ / | / / / |...

Open Source Classifieds 1.1.0 Alpha (OSClassi) - SQL Injection Cross-Site Scripting Arbitrary Admin Change

Open Source Classifieds 1.1.0 Alpha OSClassi - SQL Injection Cross-Site Scripting Arbitrary Admin Change / / / | | \ | |/ | ' \ / | / / / | ' / | \ \ | | | | | | | | | / / | | | \ \ /|/|| || ||,| /,|./|/...

Pay-Per-Install Malware Models Affiliate Marketing

From Black Hat DC: Sites like Amazon offer affiliate programs that pay users for sending them new customers. And now, malware authors, always quick to adopt tactics that work elsewhere, have developed their own affiliate program. Read the full article. MIT Technology Review...

FreeWebshop.org: multiple vulnerabilities

------------------------------------------------------------------------ FreeWebshop.org: multiple vulnerabilities ------------------------------------------------------------------------ Yorick Koster, March 2009 ------------------------------------------------------------------------ Abstract...

SAP NetWaver Virus Scan Interface - multiple XSS

Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL: http://www.sap.com Bugs:Linked XSS Vulnerability Exploits: YES Reported: 01.04.2010 Vendor response:08.04.2010 Date of Public Advisory:11.11.2011 CVSS:4.3 Author: Dmitriy Evdokimov Description SAP Netweaver Virus Scan Interfa...

FreeWebShop 2.2.9 R2 SQL Injection / Traversal / Etc

------------------------------------------------------------------------ FreeWebshop.org: multiple vulnerabilities ------------------------------------------------------------------------ Yorick Koster, March 2009 ------------------------------------------------------------------------ Abstract...

Charon Cart 3.0 - 'ContentID' Blind SQL Injection

? ?????????????????????????In The Name Of Allah The Mercifull?????????????????????? ? Tybe: reviewupdate.asp ContentID Blind SQL Injection Vulnerability Vendor: www.charon.co.uk Software: charoncartv3 author: R3d-D3v!L Date: 17.dec.2009 T!ME: 4:46 am ? Home: WwW.xP10.ME ? contact: N/A ?...

U.S. Defense Information Systems Agency (DISA) Unix Security Readiness Review (SRR) privilege escalation

Application executes all executables with predefined names found in system...

DISA UNIX SRR scripts execute untrusted programs as root

Overview The Defense Information Systems Agency DISA UNIX Security Readiness Review SRR scripts find1 and execute -exec various programs to obtain version information. The SRR scripts are designed to be run as root. An attacker who can write a file under the root file system may be able to exploi...

Web Shopping Sites Get Independent Testing

U-Test has just completed a substantive, independent review of three major e-tailing sites–Amazon, Walmart and Target– and found a gaping cross-site scripting security hole in one of them. Read the full article. The Last Watchdog...

Code injection

The U.S. Defense Information Systems Agency DISA Security Readiness Review SRR script for the Solaris x86 platform executes files in arbitrary directories as root for filenames equal to 1 java, 2 openssl, 3 php, 4 snort, 5 tshark, 6 vncserver, or 7 wireshark, which allows local users to gain...

CVE-2009-4211

The U.S. Defense Information Systems Agency DISA Security Readiness Review SRR script for the Solaris x86 platform executes files in arbitrary directories as root for filenames equal to 1 java, 2 openssl, 3 php, 4 snort, 5 tshark, 6 vncserver, or 7 wireshark, which allows local users to gain...

U.S. Defense Information Systems Agency (DISA) Unix Security Readiness Review (SRR) root compromise / VU#433821

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Executive Summary - ----------------- Unprivileged local users can obtain root access on Unix systems where the DISA SRR scripts are run. If a remote user can introduce a file into the filesystem e.g. anonymous ftp, http upload, cdrom, samba share,...

Congress Calls for Internal Security Review

After a former Congressional staffer exposed some sensitive data on a file-sharing network recently, some lawmakers are calling for the Congress to start an internal review of its own data security policies immediately. The situation, which is linked to an ethics investigation in the House of...

Microsoft Blames Human Error For Critical SMB2 Vulnerability

Microsoft is blaming human error for the the critical SMB v2 vulnerability that exposed Windows users to remote code execution attacks and argues that it’s near impossible to catch these types of bugs with existing code review tools and techniques. According to a post-mortem of the issue by Redmo...

Unfixed XSS vulnerability at www.rawandwild.com

Security researcher jath, has submitted on 22/09/2009 a cross-site-scripting XSS vulnerability affecting www.rawandwild.com, which at the time of submission ranked 6827275 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 28/11/2011. It is...

Hathaway Resigns as Federal Cybersecurity Adviser

Melissa Hathaway has left her post as the country’s top cybersecurity adviser, casting even more doubt on who will take the open job of cybersecurity coordinator created by President Obama in May. Hathaway said she is resigning for personal reasons and has no interest in the coordinator job,...

[InterN0T] transLucid 1.75 - Multiple Vulnerabilities

transLucid - Cross Site Scripting and HTML Injection Vulnerabilities Version Affected: 1.75 newest Info: transLucidonline is the easy website publishing system with which anyone can create and maintain web content, in multiple languages and based on a growing list of ready-made, professional...

Translucid 1.75 XSS / HTML Injection

transLucid - Cross Site Scripting and HTML Injection Vulnerabilities Version Affected: 1.75 newest Info: transLucidonline is the easy website publishing system with which anyone can create and maintain web content, in multiple languages and based on a growing list of ready-made, professional...

Pivot 1.40.4-7 Multiple Remote Vulnerabilities

No description provided by source. Pivot - XSS and HTML Injection Vulnerabilities Versions Affected: 1.40.4 and 1.40.7 22nd March 2009 newest Info: Pivot is a web-based tool to help you maintain dynamic sites, like weblogs or online journals. Pivot is released under the GPL so it is completely fr...