Sina microblogging certified design flaws and fixes-vulnerability warning-the black bar safety net

Brief description: Sina Weibo design defects, resulting in know the original account password, even if the modified password can be obtained permission to publish Twitter, add attention like operation, 可以参考http://www.80sec.com/session-hijackin.html Describe: Sina microblogging authentication on t...

CVE-2011-4728

The CVE-2011-4728 entry concerns Parallels Plesk Panel 10.2.0_build1011110331.18, where the Server Administration Panel does not set the secure flag on a cookie during HTTPS sessions. This allows an attacker to capture the cookie by probing or intercepting traffic in an HTTP context, as demonstra...

Apache Struts会话篡改安全限制绕过漏洞

BUGTRAQ ID: 50940 Apache Struts是一款开发Java web应用程序的开源Web应用框架。 Apache Struts在实现上存在安全限制绕过漏洞，成功攻击可允许攻击者绕过安全限制获取非法访问权 Apache Struts 2.1.8 .1 Apache Struts 2.0.9 厂商补丁： Apache Group ------------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://httpd.apache.org/...

Serv-U FTP server security vulnerabilities

Resource exhaustion, administrative session hijacking...

WikkaWiki <= 1.3.2 Multiple Security Vulnerabilities

---------------------------------------------------- WikkaWiki = 1.3.2 Multiple Security Vulnerabilities ---------------------------------------------------- author............: Egidio Romano aka EgiX mail..............: n0b0d13satgmaildotcom software link.....: http://wikkawiki.org/...

CodeIgniter 'CI_Security' Class 'xss_clean()'过滤器安全绕过漏洞

Bugtraq ID: 50847 CVE ID：CVE-2011-4025 CodeIgniter是一套给PHP网站开发者使用的应用程序开发框架和工具包 依赖xssclean过滤器进行XSS保护的EllisLab ExpressionEngine和CodeIgniter存在跨站脚本漏洞，允许攻击者进行会话劫持，信息泄露，安装恶意软件等攻击。 CISecurity类的removeevilattributes函数和xssclean实现存在缺陷，内部XSS过滤器可被绕过，允许在使用EllisLab ExpressionEngine和CodeIgniter产品上进行成功的XSS攻击。...

WikkaWiki 1.3.2 Code Execution / Shell Upload / SQL Injection

---------------------------------------------------- WikkaWiki Query" 142. UPDATE ".$this-GetConfigValue'tableprefix'."users 143. SET email = '".mysqlrealescapestring$email."', 144. doubleclickedit = '".mysqlrealescapestring$doubleclickedit."', 145. showcomments =...

WikkaWiki <= 1.3.2 Multiple Security Vulnerabilities

Exploit for php platform in category web applications ---------------------------------------------------- WikkaWiki Query" 142. UPDATE ".$this-GetConfigValue'tableprefix'."users 143. SET email = '".mysqlrealescapestring$email."', 144. doubleclickedit = '".mysqlrealescapestring$doubleclickedit."'...

WikkaWiki 1.3.2 - Multiple Vulnerabilities

---------------------------------------------------- WikkaWiki Query" 142. UPDATE ".$this-GetConfigValue'tableprefix'."users 143. SET email = '".mysqlrealescapestring$email."', 144. doubleclickedit = '".mysqlrealescapestring$doubleclickedit."', 145. showcomments =...

WikkaWiki 1.3.2 - Multiple Vulnerabilities

WikkaWiki 1.3.2 - Multiple Vulnerabilities ---------------------------------------------------- WikkaWiki Query" 142. UPDATE ".$this-GetConfigValue'tableprefix'."users 143. SET email = '".mysqlrealescapestring$email."', 144. doubleclickedit = '".mysqlrealescapestring$doubleclickedit."', 145...

kernel: net: improve sequence number generation

The 1 IPv4 and 2 IPv6 implementations in the Linux kernel before 3.1 use a modified MD4 algorithm to generate sequence numbers and Fragment Identification values, which makes it easier for remote attackers to cause a denial of service disrupted networking or hijack network sessions by predicting...

iGuard Biometric Access Control - Multiple Vulnerabilities

Title: ====== iGuard Biometric Access Control - Multiple Vulnerabilities Date: ===== 2011-11-08 References: =========== 2011/Q3-4 URL: http://vulnerability-lab.com/getcontent.php?id=104 VL-ID: ===== 104 Introduction: ============= Each iGuard Biometric / Smart Card Security Appliance has a built-...

Support Incident Tracker 3.65 - 'translate.php' Remote Code Execution

?php / ------------------------------------------------------------------------------ Support Incident Tracker = 3.65 translate.php Remote Code Execution Exploit ------------------------------------------------------------------------------ author...............: Egidio Romano aka EgiX...

SonicWall Aventail v7.2.16 - Multiple Web Vulnerabilities

Document Title: =============== SonicWall Aventail v7.2.16 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=286 CNNVD-201112-148 Release Date: ============= 2011-11-17 Vulnerability Laboratory ID VL-ID:...

SonicWall Aventail v7.2.16 - Multiple Web Vulnerabilities

Document Title: =============== SonicWall Aventail v7.2.16 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=286 CNNVD-201112-148 Release Date: ============= 2011-11-17 Vulnerability Laboratory ID VL-ID:...

Skype Cross Site Scripting

Title: ====== Skype Vendor Website - Cross Site Scripting Vulnerability Date: ===== 2011-11-11 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=309 VL-ID: ===== 309 Introduction: ============= Skype is a software application that allows users to make voice and video call...

Skype Vendor Website - Cross Site Scripting Vulnerability

Document Title: =============== Skype Vendor Website - Cross Site Scripting Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=309 Release Date: ============= 2011-11-12 Vulnerability Laboratory ID VL-ID: ==================================== 3...

Infoblox NetMRI 6.2.1 Cross Site Scripting

============================================================ FOREGROUND SECURITY, SECURITY ADVISORY 2011-004 - Original release date: November 10, 2011 - Discovered by: Jose Carlos de Arriba - Senior Security Analyst at Foreground Security - Contact: jcarriba at foregroundsecurity dot com, dade a...

Joomla ALFContact 1.9.3 Cross Site Scripting

============================================================ FOREGROUND SECURITY, SECURITY ADVISORY 2011-003 - Original release date: Nomvember 9, 2011 - Discovered by: Jose Carlos de Arriba Sr Security Analyst at Foreground Security - Contact: jcarriba at foregroundsecurity dot com, dade at...

Oracle GlassFish Server Invalid Username Cross Site Scripting (CVE-2011-2260)

A persistent cross-site scripting vulnerability has been reported in Oracle GlassFish Server. The vulnerability is due to insufficient input validation of username values. A remote attacker may exploit this vulnerability by sending a specially crafted POST request to an affected server. Successfu...