705 matches found
Cryptographp Local File Inclusion / HTTP Response Splitting
During a security assessment, Ive found that my target was using Cryptographp which is a PHP script used for generate « captchas ». It was easily noticeable when Ive found the following URL: http://WWWW/cryptographp.inc.php?cfg=XX&sn=YYYY&ZZZZ So I've decided to take a look at the source code a...
Oracle GlassFish Server 3.1.1 (build 12) - Multiple Cross-Site Scripting Vulnerabilities
Oracle GlassFish Server 3.1.1 build 12 - Multiple Cross-Site Scripting Vulnerabilities Details Vendor Site: Oracle www.oracle.com Date: April, 19th 2012 – CVE 2012-0551 Affected Software: Oracle GlassFish Server 3.1.1 build 12 Researcher: Roberto Suggi Liverani PDF version:...
Android Security - Boot Camp Workshop & Presentation #2
Document Title: =============== Android Security - Boot Camp Workshop & Presentation 2 References: =========== Mirror: http://www.vulnerability-lab.com/resources/documents/471.rar Release Date: ============= 2012-03-07 Vulnerability Laboratory ID VL-ID: ==================================== 471...
stoneware webnetwork6 - Multiple Vulnerabilities
Stoneware WebNetwork6 Vulnerability Assessment CVE-2012-0285 – XSS CVE-2012-0286 - CSRF Conducted by: Leland Public Schools Stoneware Customer Jacob Holcomb Network Engineer for LPS Conducted for: Leland Public Schools Purchaser of WebNetwork product. Test was to assure cloud security Stoneware...
stoneware webnetwork6 - Multiple Vulnerabilities
stoneware webnetwork6 - Multiple Vulnerabilities Stoneware WebNetwork6 Vulnerability Assessment CVE-2012-0285 – XSS CVE-2012-0286 - CSRF Conducted by: Leland Public Schools Stoneware Customer Jacob Holcomb Network Engineer for LPS Conducted for: Leland Public Schools Purchaser of WebNetwork...
Stoneware WebNetwork6 Multiple Vulnerabilities
Exploit for jsp platform in category web applications Stoneware WebNetwork6 Vulnerability Assessment Conducted by: Leland Public Schools Stoneware Customer Jacob Holcomb Network Engineer for LPS Conducted for: Leland Public Schools Purchaser of WebNetwork product. Test was to assure cloud securit...
IT-Grundschutz M4.277: Absicherung der SMB-, LDAP- und RPC-Kommunikation unter Windows Server 2003(Windows)
IT-Grundschutz M4.277: Absicherung der SMB-, LDAP- und RPC-Kommunikation unter Windows Server 2003Windows. ACHTUNG: Dieser Test wird nicht mehr unterstützt. Er wurde ersetzt durch den entsprechenden Test der nun permanent and die aktuelle EL angepasst wird: OID 1.3.6.1.4.1.25623.1.0.94223 Diese...
Windows Gather Windows Host File Enumeration
This module returns a list of entries in the target system's hosts file. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Windows Host File Enumeration', 'Description' = %q This...
Windows Manage Hosts File Injection
This module allows the attacker to insert a new entry into the target system's hosts file. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'English' class MetasploitModule 'Windows Manage Hosts File Injection'...
OSSAMS - Open Source Security Assessment Management System
OSSAMS - Open Source Security Assessment Management System As information security professionals, we conduct security assessments for companies. One of the biggest problems we have is after all the data is collected, how can we correlate the data accurately. So we decided to start a project to...
OSSAMS - Open Source Security Assessment Management System
OSSAMS - Open Source Security Assessment Management System As information security professionals, we conduct security assessments for companies. One of the biggest problems we have is after all the data is collected, how can we correlate the data accurately. So we decided to start a project to...
SAP NetWeaver servlet JavaDumpService - Multiple XSS
Application: SAP NetWeaver JavaDumpService Versions Affected: SAP NetWeaver JavaDumpService Vendor URL: Bugs: XSS Exploits: YES Reported: 30.07.2011 Vendor response: 02.08.2011 Date of Public Advisory: 30.10.2013 Reference: SAP Security Note 1828801 CVSS: AV:N/AC:M/AU:N/C:N/I:P/A:N 4.3 Author:...
SAP RSTXSCRP report - smb relay vulnerability
Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL: http://www.sap.com Bugs:Path traversal, SMBRelay Exploits: YES Reported: 14.03.2011 Vendor response:16.03.2011 Date of Public Advisory:11.11.2011 CVSS: 2.1 Author: Dmitriy Chastuchin Description SAP RSTXSCRP Report has path...
SAP NetWeaver - Authentication bypass (Verb Tampering)
Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL: http://www.sap.com Bugs:Auth bypass, Verb tampering Exploits: YES Reported: 14.03.2011 Vendor response:15.03.2011 Date of Public Advisory:11.11.2011 CVSS: 10 by ERPSCAN 7.3 by SAP Author:Alexandr Polyakov Description...
Mac OS X 10.6 < 10.6.6 Multiple Vulnerabilities
Binary data 5739.prm...
The Problem With Bug Counts
It’s getting to be that time of year again, when everyone starts looking for ways to do something with all of the data that they’ve accumulated during the last 12 months. That means reports and top tens and lists and rankings and controversy. And, inevitably, it also means more examples of why...
Oracle Sun Java System Web Server - HTTP Response Splitting
Oracle Sun Java System Web Server - HTTP Response Splitting Description Security-Assessment.com discovered that is possible to successfully perform an HTTP Response Splitting attack against applications served by Sun Java System Web Server. The vulnerability can be exploited if user supplied inpu...
Oracle JRE - java.net.URLConnection class Same-of-Origin 'SOP' Policy Bypass
Description Security-Assessment.com discovered that a Java Applet making use of java.net.URLConnection class can be used to bypass same-of-origin SOP policy and domain based security controls in modern browsers when communication occurs between two domains that resolve to the same IP address. Thi...
Google Debuts Phishing Alert Service
Google has added a feature to its service for network operators that will alert site owners when Google’s automated scanners find a phishing URL on a particular site. The phishing-URL alert service is an addition to the existing set of services that Google offers for site owners to help them...
CVE-2010-0033
creationtimestamp| type| source ---|---|--- 2010-09-25 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/16665 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/ms10004textbytesatom.rb 2025-02-06...