Microsoft IE对象处理内存破坏漏洞

Internet Explorer是微软公司开发的广为流行的网络浏览器。 IE在处理畸形格式的网页标记时存在内存对象处理错误，远程攻击者可能利用此漏洞通过精心构造恶意标记数据导致IE处理时执行攻击者指定的任意指令。 此漏洞目前被挂马攻击者积极利用来向用户系统植入恶意软件，而且微软还未发布针对此漏洞的补丁。 Microsoft Internet Explorer 7.0 临时解决方法： 如果您不能立刻安装补丁或者升级，NSFOCUS建议您采取以下措施以降低威胁： 暂时不要使用IE 7浏览网页，可以使用Opera或Firefox。...

FreeBSD Ports: bugzilla, ja-bugzilla

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

HPSBMA02346 SSRT080097 rev.2 - HP Select Identity Active Directory Bidirectional LDAP Connector, Remote Unauthorized Access

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c01502023 Version: 2 HPSBMA02346 SSRT080097 rev.2 - HP Select Identity Active Directory Bidirectional LDAP Connector, Remote Unauthorized Access NOTICE: The information in this Security Bulletin...

BigAnt IM服务器HTTP GET请求远程栈溢出漏洞

BUGTRAQ ID: 28795 BigAnt Messenger是一款可扩展的企业即时通讯平台。 BigAnt Messenger的AntServer模块（AntServer.exe）中存在栈溢出漏洞，如果向该服务的默认6080/TCP端口发送了超长HTTP GET请求的话，就可以触发这个溢出，导致执行任意指令。 华途软件 BigAnt Messenger 2.2 华途软件 -------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.bigant.cn/...

Apple QuickTime多个远程安全漏洞

BUGTRAQ ID: 28583 CVECAN ID: CVE-2008-1013,CVE-2008-1014,CVE-2008-1015,CVE-2008-1016,CVE-2008-1017,CVE-2008-1018,CVE-2008-1019,CVE-2008-1020,CVE-2008-1021,CVE-2008-1022,CVE-2008-1023 Apple QuickTime是一款非常流行的多媒体播放器。 QuickTime的7.4.5之前版本存在多个安全漏洞，允许用户通过畸形的媒体文件获得敏感信息或完全入侵用户系统。 CVE-2008-1013...

Calyptix Security Advisory CX-2007-05 - eSoft InstaGate EX2 Cross-Site Request Forgery Attack

Calyptix Security Advisory CX-2007-05 eSoft InstaGate EX2 Cross-Site Request Forgery Attack Date: 07/11/2007 http://www.calyptix.com/ http://labs.calyptix.com/CX-2007-05.php http://labs.calyptix.com/CX-2007-05.txt Overview Multiple versions of eSoft's InstaGate EX2 UTM device are vulnerable to...

CVE-2007-1732

Cross-site scripting XSS vulnerability in an mt import in wp-admin/admin.php in WordPress 2.1.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the demo parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

prb-advisory-02-2007.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I - TITLE Security advisory: Arbitrary file disclosure vulnerability in php rrd browser prb II - SUMMARY Description: Arbitrary file disclosure vulnerability in php rrd browser 0.2.1 Author: Sebastian Wolfgarten sebastian at wolfgarten dot com,...

MCGalleryPRO random2.php远程文件包含漏洞

mcGalleryPRO是一款图片收藏管理程序。 mcGalleryPRO的random2.php文件没有正确过滤对pathtofolder参数的输入，允许攻击者通过包含本地或外部资源的任意文件执行PHP代码。 random2.php中有漏洞的代码如下： if !empty$SERVER extract$SERVER, EXTROVERWRITE; if !empty$GET extract$GET, EXTROVERWRITE; if !empty$POST extract$POST, EXTROVERWRITE; if !empty$COOKIE extract$COOKIE,...

Cisco Security Advisory: Access Point Web-Browser Interface Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Access Point Web-Browser Interface Vulnerability ===================================================================== Advisory ID: cisco-sa-20062806-ap.shtml http://www.cisco.com/warp/public/707/cisco-sa-20060628-ap.shtml...

[Full-disclosure] Directory traversal vulnerability in "Quick & Dirty PHPSource Printer" 1.0

== Vendor: Kaf Oseo == Product: http://guff.szub.net/quick-dirty-phpsource-printer/ == Version: 1.0 == Vulnerability: Filtering "../" to "" allowed use of ".../...//" to be inserted and changed to "../" allowing directory traversal. == Fix: Use the following line instead: $file = strstr$fileget,...

IPSwitch IMAP Server - LOGON Remote Stack Overflow

/ IpSwitch IMAP Server LOGON stack overflow. Software Hole discovered by iDEFENSE POC written by nolimit and BuzzDee First, some information for the few of you that know how this stuff works. The reason you see no SP2 or 2003 offsets is because of Windows SEH checks. Thats right, in this one...

[VulnWatch] High Risk Vulnerabilities in Eudora Mail Client

John Heasman of NGSSoftware has discovered multiple high risk vulnerabilities in the Windows version of Eudora. Versions affected include: Eudora 6.2.0 and below The flaws permit execution of arbitrary code via: 1 previewing or opening a specially crafted email 2 opening specially crafted...

[SA13660] PHProjekt "path_pre" Parameter Arbitrary File Inclusion Vulnerability

TITLE: PHProjekt "pathpre" Parameter Arbitrary File Inclusion Vulnerability SECUNIA ADVISORY ID: SA13660 VERIFY ADVISORY: http://secunia.com/advisories/13660/ CRITICAL: Highly critical IMPACT: System access WHERE: From remote SOFTWARE: PHProjekt 4.x http://secunia.com/product/4346/ DESCRIPTION:...

[SA13411] MIMEsweeper for SMTP PDF File Processing Denial of Service

TITLE: MIMEsweeper for SMTP PDF File Processing Denial of Service SECUNIA ADVISORY ID: SA13411 VERIFY ADVISORY: http://secunia.com/advisories/13411/ CRITICAL: Moderately critical IMPACT: DoS WHERE: From remote SOFTWARE: MIMEsweeper for SMTP 5.x http://secunia.com/product/4235/ DESCRIPTION: A...

Hosting Controller 0.6.1 Hotfix 1.4 - Directory Browsing

Hosting Controller 0.6.1 Hotfix 1.4 - Directory Browsing Advisory Information ------------------------- Software Package : Hosting Controller Vendor Homepage : http://www.hostingcontroller.com Platforms : Windows based servers Vulnerable Versions : All version Tested on: v.6.1 Hotfix 1.4 Vendor...

Important: Red Hat Security Advisory: xpdf security update

An updated xpdf package that fixes a number of integer overflow security flaws is now available. Xpdf is an X Window System based viewer for Portable Document Format PDF files. During a source code audit, Chris Evans and others discovered a number of integer overflow bugs that affected all versio...

[SA12654] PHP-Fusion Cross-Site Scripting and Identify Spoof Vulnerabilities

TITLE: PHP-Fusion Cross-Site Scripting and Identify Spoof Vulnerabilities SECUNIA ADVISORY ID: SA12654 VERIFY ADVISORY: http://secunia.com/advisories/12654/ CRITICAL: Less critical IMPACT: Cross Site Scripting, Spoofing WHERE: From remote SOFTWARE: PHP-Fusion 4.x http://secunia.com/product/3803/...

Possible DoS attack against jabberd 1.4.3 and jadc2s 0.9.0

jabberd up to and including version 1.4.3 and jadc2s up to and including version 0.9.0 are vulnerable against a DoS attack reported by Jose Antonio Calvo yesterday on the jabberd mailing list. http://jabberstudio.org/pipermail/jabberd/2004-September/002004.html An attacker can crash a running...

[SA12453] IMail Multiple Denial of Service Vulnerabilities

TITLE: IMail Multiple Denial of Service Vulnerabilities SECUNIA ADVISORY ID: SA12453 VERIFY ADVISORY: http://secunia.com/advisories/12453/ CRITICAL: Moderately critical IMPACT: DoS WHERE: From remote SOFTWARE: IMail Server 8.x http://secunia.com/product/3048/ DESCRIPTION: Various vulnerabilities...