Oracle Java APPLET Tag Children Property Memory Corruption

Exploit for windows platform in category dos / poc ========================================================== Oracle Java APPLET Tag Children Property Memory Corruption ========================================================== Source:...

Oracle Java - APPLET Tag Children Property Memory Corruption

Source: http://skypher.com/index.php/2010/10/13/issue-18-oracle-java-applet-childre/ o=document.createElement"applet"; setTimeoutfunction x=o.children; location.reload; , 1; Tested with: Windows XP sp3 5.1.2600 MSIE 7.0.5730.13 MSIE 8.0.6001.18702 Sun Java Version 6 Update 20 1.6.020-b02...

FreeBSD - 'pseudofs' Null Pointer Dereference Privilege Escalation

/ source: https://www.securityfocus.com/bid/43060/info 18.08.2010, babcia padlina FreeBSD 7.0 - 7.2 pseudofs null ptr dereference exploit to obtain SYSENT8SYCALLADDR, run: $ kgdb /boot/kernel/kernel kgdb print &sysent8.sycall / define SYSENT8SYCALLADDR 0xc0c4afa4 / FreeBSD 7.2-RELEASE / define...

XSS vulnerability in space key, particularly with decorators off

As discovered while looking at CONF-20667, Confluence stores the space key unencoded in a content tag. Considerable functionality relies on this content tag. Eg Doc Theme breaks without it. Themes choice breaks without it. To exploit it, create a user with html in the login name, then create a...

XSS vulnerability in space key, particularly with decorators off

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-20865. panel As discovered while looking at CONF-20667, Confluence stores the space key unencoded in a content tag. Considerable...

XSS vulnerability in space key, particularly with decorators off

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Cloud. Using Confluence Server? See the corresponding bug report|http://jira.atlassian.com/browse/CONFSERVER-20865. panel As discovered while looking at CONF-20667, Confluence stores the space key unencoded in a content tag. Considerabl...

django -- cross-site scripting vulnerability

Django project reports: The provided template tag for inserting the CSRF token into forms -- % csrftoken % -- explicitly trusts the cookie value, and displays it as-is. Thus, an attacker who is able to tamper with the value of the CSRF cookie can cause arbitrary content to be inserted, unescaped,...

Cross-site scripting vulnerability in Access Analyzer CGI by futomi's CGI Cafe

Overview Access Analyzer CGI from futomi's CGI Cafe contains a cross-site scripting vulnerability. This is caused by a particular method in which tags are embedded into the web page. Access Analyzer CGI provided by futomi's CGI Cafe is a software to analyze web access logs. Access Analyzer CGI...

Debian DSA-2106-1 : xulrunner - several vulnerabilities

Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2010-2760, CVE-2010-3167, CVE-2010-3168 Implementation errors in XUL processing allow the...

rpm security update

4.3.3-33nonptl - fix CVE-2010-2059, fails to drop SUID/SGID bits on package upgrade 626709 - add dist tag...

UTF-7 XSS by overriding document charset using <object> type attribute — Mozilla

Security researchers David Huang and Collin Jackson of Carnegie Mellon University CyLab Silicon Valley campus reported that the type attribute of an tag can override the charset of a framed HTML document, even when the document is included across origins. A page could be constructed containing su...

Mozilla Firefox Plugin Parameter Array Dangling Pointer (CVE-2010-2755)

Mozilla Firefox is a web browser developed by Mozilla Foundation. The browser is capable of interpreting and rendering many types of content published on the Internet, including various versions of HTML, XML, XUL, JavaScript, various graphics formats, and so on. The browser runs on the Windows,...

Absolute path traversal Apache Tomcat WEBDAV

Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag...

PMSoftware Simple Web Server 2.1 - 'From:' Header Processing Remote Denial of Service

source: https://www.securityfocus.com/bid/42155/info PMSoftware Simple Web Server is prone to a denial-of-service vulnerability. Remote attackers can exploit this issue to cause the application to stop responding, denying service to legitimate users. Simple Web Server 2.1 is vulnerable; other...

Null pointer dereference

The clientautoresp function in familyicbm.c in the oscar protocol plugin in libpurple in Pidgin before 2.7.2 allows remote authenticated users to cause a denial of service NULL pointer dereference and application crash via an X-Status message that lacks the expected end tag for a 1 desc or 2 titl...

LibTIFF 3.9.4 - Out-Of-Order Tag Type Mismatch Remote Denial of Service

source: https://www.securityfocus.com/bid/41475/info LibTIFF is prone to a denial-of-service vulnerability because it fails to properly validate user-supplied input. An attacker can exploit this issue to crash an application that uses the vulnerable library, denying service to legitimate users...

libtiff: TIFFExtractData out-of-bounds read crash

The TIFFExtractData macro in LibTIFF before 3.9.4 does not properly handle unknown tag types in TIFF directory entries, which allows remote attackers to cause a denial of service out-of-bounds read and application crash via a crafted TIFF file...

Altair Engineering PBS Pro 10.x - 'pbs_mom' Insecure Temporary File Creation

source: https://www.securityfocus.com/bid/41449/info Altair Engineering PBS Pro creates temporary files in an insecure manner. An attacker with local access could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected applicatio...

CVE-2010-2630

The TIFFReadDirectory function in LibTIFF 3.9.0 does not properly validate the data types of codec-specific tags that have an out-of-order position in a TIFF file, which allows remote attackers to cause a denial of service application crash via a crafted file, a different vulnerability than...

DEBIAN-CVE-2010-2631

LibTIFF 3.9.0 ignores tags in certain situations during the first stage of TIFF file processing and does not properly handle this during the second stage, which allows remote attackers to cause a denial of service application crash via a crafted file, a different vulnerability than CVE-2010-2481...