CVE-2007-1064

Cisco Secure Services Client CSSC 4.x, Trust Agent 1.x and 2.x, Cisco Security Agent CSA 5.0 and 5.1 when a vulnerable Trust Agent has been deployed, and the Meetinghouse AEGIS SecureConnect Client do not drop privileges when the help facility in the supplicant GUI is invoked, which allows local...

CVE-2007-1066

Cisco Secure Services Client CSSC 4.x, Trust Agent 1.x and 2.x, Cisco Security Agent CSA 5.0 and 5.1 when a vulnerable Trust Agent has been deployed, and the Meetinghouse AEGIS SecureConnect Client use an insecure default Discretionary Access Control Lists DACL for the connection client GUI, whic...

CVE-2007-1064

The CVE-2007-1064 issue affects Cisco Secure Services Client (CSSC) 4.x, Trust Agent 1.x/2.x, Cisco Security Agent (CSA) 5.0/5.1 (when a vulnerable Trust Agent is deployed), and the Meetinghouse AEGIS SecureConnect Client. The vulnerability arises because privileges are not dropped when invoking ...

Cisco Security Advisory: Multiple Vulnerabilities in 802.1X Supplicant

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Multiple Vulnerabilities in 802.1X Supplicant Advisory ID: cisco-sa-20070221-supplicant http://www.cisco.com/warp/public/707/cisco-sa-20070221-supplicant.shtml Revision 1.0 For Public Release 2007 February 21 1600 UTC GMT -...

Malicious XDG Desktop File

This module creates a malicious XDG Desktop .desktop file. On most modern systems, desktop files are not trusted by default. The user will receive a warning prompt that the file is not trusted when running the file, but may choose to run the file anyway. The default file manager applications in...

Multiple Printer Providers (spooler service) Privilege Escalation Exploit

No description provided by source. /Private exploit- internal use only Title: Universal exploit for vulnerable printer providers spooler service. Vulnerability: Insecure EnumPrintersW calls Author: Andres Tarasco Acu [email protected] Website: http://www.514.es This code should allow to gain SYSTEM...

Multiple Printer Providers (Spooler Service) - Local Privilege Escalation

Multiple Printer Providers Spooler Service - Local Privilege Escalation /Private exploit- internal use only Title: Universal exploit for vulnerable printer providers spooler service. Vulnerability: Insecure EnumPrintersW calls Author: Andres Tarasco Acuña - [email protected] Website:...

Multiple Printer Providers (Spooler Service) - Local Privilege Escalation

/Private exploit- internal use only Title: Universal exploit for vulnerable printer providers spooler service. Vulnerability: Insecure EnumPrintersW calls Author: Andres Tarasco Acuña - [email protected] Website: http://www.514.es This code should allow to gain SYSTEM privileges with the following...

Perforce client: security hole by design

= Abstract = The Perforce client has a huge gapping security hole by design. It totally trusts the Perforce server and does whatever the server tells it, writing arbitrary files. = Disclaimer = This is so terribly obvious that I'd be surprised that this is news, but I couldn't find anything. Or I...

IBM多个产品未明信任书伪造漏洞

IBM包含多系列产品，如IBM Tivoli，IBM WebSphere等。 IBM多个产品存在信任书伪造问题，远程攻击者可以利用这个漏洞访问资源和数据或可能控制应用程序。 目前报告此问题可以使攻击者利用COOKIE或伪造其他信任用户未授权访问资源，目前没有详细漏洞细节提供。 IBM Tivoli Access Manager for e-business 5.1 IBM Tivoli Access Manager for e-business 4.1 IBM Tivoli Access Manager for e-business 3.9 IBM Tivoli Access Manag...

SAP Internet Transaction Server XSS vulnerability

Vulnerability class : Cross-Site Scripting Discovery date : 13 September 2006 Remote : Yes Credit : ILION Research Labs Vulnerable : SAP ITS Vulnerable version: Versions 6.1 and 6.2 have been found to be vulnerable. Other versions might be too. A XSS Cross-Site-Scripting vulnerability has been...

devhelp, seamonkey security update

CentOS Errata and Security Advisory CESA-2006:0676 Updated seamonkey packages that fix several security bugs are now available for Red Hat Enterprise Linux 2.1, 3, and 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open sour...

[Full-disclosure] Cisco Secure ACS Weak Session Management Vulnerability

Cisco Secure ACS Weak Session Management Vulnerability June 23, 2006 Product Overview: Cisco Secure Access Control Server ACS provides a centralized identity networking solution and simplified user management experience across all Cisco devices and security management applications. Cisco Secure A...

spymacXSSflaws.txt

Multiple Cross site scripting in Spymac WOS v Vendor url: http://www.spymac.com/network.php?p=wos Advisore:http://lostmon.blogspot.com/2006/05/ multiple-cross-site-scripting-in.html Vendor notify: yes Exploit available: yes Spymac WOS is powered by an integrated collection of Web and desktop...

phpMyAdmin XSS vuln.

phpMyAdmin XSS vuln. Vuln. discovered by : r0t Date: 20 april 2006 vendorlink:http://www.phpmyadmin.net/ affected versions: phpMyAdmin 2.8.0.3 phpMyAdmin 2.8.0.2 phpMyAdmin 2.8.1-dev CVS version phpMyAdmin 2.9.0-dev CVS version and prior versions also can be affected orginal advisory:...

Authentication flaw

HP System Management Homepage SMH 2.1.3.132, when running on CompaqHTTPServer/9.9 on Windows, Linux, or Tru64 UNIX, and when "Trust by Certificates" is not enabled, allows remote attackers to bypass authentication via a crafted URL...

[SRC-Telindus advisory] - HP System Management Homepage Remote Unauthorized Access

HP System Management Homepage Remote Unauthorized Access -------------------------------------------------------- Vulnerability: Remote Authentication Bypass Product: CompaqHTTPServer/9.9 HP System Management Homepage 2.1.3.132 and above Platform: Microsoft® Windows® - Linux operating systems IA3...

Spoofing

Microsoft Internet Explorer 5.01 through 6 allows remote attackers to conduct phishing attacks by spoofing the address bar and other parts of the trust UI via unknown methods that allow "window content to persist" after the user has navigated to another site, aka the "Address Bar Spoofing...

CVE-2006-1192

CVE-2006-1192 refers to an Address Bar Spoofing vulnerability in Internet Explorer 5.01–6 where phishing could be facilitated by persisting window content and trust UI after navigation, allowing a malicious page to display a legitimate URL while loading content from another site. The Connected do...

SKForum XSS vuln.

SKForum XSS vuln. Vuln. discovered by : r0t Date: 5 april 2006 vendor:http://soft.killingar.net/documents/SKForum affected versions:1.5 and prior orginal advisory:http://pridels.blogspot.com/2006/04/skforum-xss-vuln.html Vuln. Description: SKForum contains a flaw that allows a remote cross site...