White House Unveils Cybersecurity Legislative Agenda

The White House proposed Thursday reforming the Federal Information Security Management Act by formalizing the Department of Homeland Security role in managing cybersecurity for the federal government's civilian computers and networks. What the Obama administration does not propose is the...

OSSIM repository_attachment.php页面任意文件上传漏洞

BUGTRAQ ID: 37377 OSSIM即开源安全信息管理（Open Source Security Information Management），是一个非常流行和完整的开源安全管理系统。 OSSIM的ossiminstall/repository/repositoryattachment.php脚本没有正确地执行安全检查，用户可以向Webroot中的文件夹上传带有任意扩展名的文件。如果用户上传了包含有某些Web Shell的PHP脚本，就会导致执行任意PHP代码。 AlienVault OSSIM 2.2 AlienVault OSSIM 2.1.5 厂商补丁：...

AlienVault OSSIM Detection

Detects the installed version of AlienVault OSSIM Open Source Security Information Management and USM Unified Security Management This script sends an HTTP GET request and tries to get the version from the response. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpt...

McAfee ePolicy Orchestrator Framework Services Log Handling Format String (CVE-2008-1357)

McAfee Corporation is a major vendor of numerous anti-virus, network, and desktop security products which are deployed in consumer as well as enterprise environments. McAfee ePolicy Orchestrator is a central security management system to manage security policy, assess and enforce policy, notify...

CVE-2009-4374

CVE-2009-4374 describes a directory traversal vulnerability in AlienVault Open Source Security Information Management (OSSIM) 2.1.5, and possibly earlier versions before 2.1.5-4. The flaw occurs in repository/repository_attachment.php, where an attacker can upload files into arbitrary directories...

Trend Micro OfficeScan CGI Password Decryption Buffer Overflow (CVE-2008-1365)

Trend Micro OfficeScan is a centralized virus and security scan management system. It is meant to consolidate the coordination of security scan actions and the management of Trend Micro virus scanner products installed on the nodes of an enterprise network. The product is a central command centre...

CVE-2008-7084

Directory traversal vulnerability in the web server 1.0 in Velocity Security Management System allows remote attackers to read arbitrary files via a .. dot dot in the URI...

CVE-2008-7084

CVE-2008-7084 describes a directory traversal vulnerability in the web server 1.0 of Velocity Security Management System. An attacker can read arbitrary files by using a “..” in the URI. The NVD entry lists a CVSSv2 base score of 5.0 (Medium) with network access, low attack complexity, no authent...

NSD vulnerable to one-byte overflow

Overview A vulnerability exists in the way NSD processes certain types of packets that may lead to a one-byte buffer overflow. Description Name server daemon NSD is an open source name server developed by NLnet Labs. NSD contains an off-by-one error that can cause a one-byte buffer overflow when...

CentOS Update for python CESA-2007:1077-01 centos2 i386

Check for the Version of python OpenVAS Vulnerability Test CentOS Update for python CESA-2007:1077-01 centos2 i386 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

HZHOST域名虚拟主机管理系统sql注射漏洞

是在线开通ftp.sql.web的一个管理系统。一套web程序。和IIS管理程序。实现在线开通. 存在文本框的注射。 HZHOST域名虚拟主机管理系统 暂无 123' UPDATE memlst SET upss='e10adc3949ba59abbe56e057f20f883e' WHERE unme='admin'-- 123' and select top 1 isnullcastunme as nvarchar4000,char32+char94+isnullcastUpss as nvarchar4000,char32 from select top 2unme,Upss fr...

Pooya Site Builder (PSB) SQL Injection Vulnerabilities

www.BugReport.ir AmnPardaz Security Research Team Title: Pooya Site Builder PSB SQL Injection Vulnerabilities Vendor: www.paridel.com Vulnerable Version: 6.0 Assembly Version Exploit: Available Impact: High Fix: N/A Original Advisory: www.bugreport.ir/?/42 1. Description: Pooya site builder psb i...

Pooya Site Builder (PSB) 6.0 Multiple SQL Injection Vulnerabilities

Exploit for unknown platform in category web applications =================================================================== Pooya Site Builder PSB 6.0 Multiple SQL Injection Vulnerabilities =================================================================== AmnPardaz Security Research Team Titl...

Pooya Site Builder (PSB) 6.0 - Multiple SQL Injections

Pooya Site Builder PSB 6.0 - Multiple SQL Injections www.BugReport.ir AmnPardaz Security Research Team Title: Pooya Site Builder PSB SQL Injection Vulnerabilities Vendor: www.paridel.com Vulnerable Version: 6.0 Assembly Version Exploit: Available Impact: High Fix: N/A Original Advisory:...

Pooya Site Builder (PSB) 6.0 - Multiple SQL Injections

www.BugReport.ir AmnPardaz Security Research Team Title: Pooya Site Builder PSB SQL Injection Vulnerabilities Vendor: www.paridel.com Vulnerable Version: 6.0 Assembly Version Exploit: Available Impact: High Fix: N/A Original Advisory: www.bugreport.ir/?/42 1. Description: Pooya site builder psb i...

Update Protection against McAfee ePolicy Orchestrator Framework Services HTTP Buffer Overflow Vulnerability

A buffer overflow vulnerability was reported in the McAfee ePolicy Orchestrator ePO Framework Services. McAfee ePolicy Orchestrator is a central management system to enforce and monitor system security. A remote attacker could exploit this issue to execute arbitrary code on the affected system...

McAfee Common Management Agent 3.6.0 UDP Packet Handling Format String (credentialed check)

The remote host is running a Common Management Agent, a component of the ePolicy Orchestrator system security management solution from McAfee. The version of the Common Management Agent on the remote host is earlier than 3.6.0.595 and, as such, contains a format string vulnerability. If configure...

F5 Big-IP Web管理界面审计日志HTML注入漏洞

BUGTRAQ ID: 28416 F5 BIG-IP是集成了网络流量管理、应用程序安全管理器、负载均衡等功能的多合一网络设备。 F5 BIG-IP的Web管理界面的审计日志工具存在跨站脚本漏洞。日志项未经HTML编码便直接输出，这允许攻击者创建内嵌了脚本的日志项，如果管理员查看了审计日志就会执行恶意脚本。 一种可能的攻击方式是创建在节点名中嵌入了脚本的节点对象，由于不支持的字符，创建这个节点会失败，但仍会创建审计日志；此外还可以创建特制的URL链接，该链接会生成内嵌有HTTP GET请求的日志项，因此可以远程利用这个漏洞。 F5 BigIP 9.4.3 临时解决方法：...

CVE-2007-5665

STEngine.exe 3.5.0.20 in Novell ZENworks Endpoint Security Management ESM 3.5, and other ESM versions before 3.5.0.82, dynamically creates scripts in a world-writable directory when generating diagnostic reports, which allows local users to gain privileges, as demonstrated by creating a cmd.exe...

Directory traversal

STEngine.exe 3.5.0.20 in Novell ZENworks Endpoint Security Management ESM 3.5, and other ESM versions before 3.5.0.82, dynamically creates scripts in a world-writable directory when generating diagnostic reports, which allows local users to gain privileges, as demonstrated by creating a cmd.exe...