CVE-2010-1307

Nuclei templates confirm a Local File Inclusion in Joomla! via the Magic Updater (com_joomlaupdater). The vulnerability arises from a directory traversal in the index.php controller parameter, allowing remote attackers to read arbitrary files. Affected component: Joomla! Magic Updater (com_joomla...

Joomla Magic Updater Local File Inclusion

================================================================================================ Title : Joomla Magic Updater comjoomlaupdater LFI Vulnerability Date : Monday, 05 April 2010 Indonesia Author : Vrs-hCk Contact : anderatantisecurity.org Blog : http://c0li.blogspot.com/...

Joomla Magic Updater com_joomlaupdater LFI Vulnerability

Exploit for php platform in category web applications ======================================================== Joomla Magic Updater comjoomlaupdater LFI Vulnerability ========================================================...

Joomla! Component Magic Updater - Local File Inclusion

================================================================================================ Title : Joomla Magic Updater comjoomlaupdater LFI Vulnerability Date : Monday, 05 April 2010 Indonesia Author : Vrs-hCk Contact : anderatantisecurity.org Blog : http://c0li.blogspot.com/...

Adobe PDF Reader Gets Another Security Makeover

Adobe has released a mega-update for its Reader and Acrobat software products to fix a total of eight documented security vulnerabilities. The update comes with significant security improvements, including the on-by-default addition “Enhanced Security,” a feature that provides a set of default...

On Adobe, Their Silent Updater and Becoming a Target for Attackers

Ryan Naraine and Dennis Fisher discuss all of the news and criticism concerning Adobe this week, including their release of a silent updater and the company becoming a top target for attackers. SHOW NOTES Despite Danger, Adobe Says Javascript Support Important Tough Road Ahead for Adobe on Securi...

Microsoft Plans Quiet January Patch Tuesday

Microsoft’s first Patch Tuesday for 2010 will be very light: A solitary bulletin addressing a vulnerability that is rated critical only for Windows 2000 users. According to Redmond’s advance notice for the next batch of patches due on January 12, the bulletin is rated “low” for every other affect...

Gentoo Security Advisory GLSA 200901-12 (noip-updater)

The remote host is missing updates announced in advisory GLSA 200901-12. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Gentoo Security Advisory GLSA 200901-12 (noip-updater)

The remote host is missing updates announced in advisory GLSA 200901-12. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR GPL-3.0-only...

GLSA-200901-12 : noip-updater: Execution of arbitrary code

The remote host is affected by the vulnerability described in GLSA-200901-12 noip-updater: Execution of arbitrary code xenomuta found out that the GetNextLine function in noip2.c misses a length check, leading to a stack-based buffer overflow. Impact : A remote attacker could exploit this...

noip-updater: Execution of arbitrary code

Background noip-updater is a tool used for updating IP addresses of dynamic DNS records at no-ip.com. Description xenomuta found out that the GetNextLine function in noip2.c misses a length check, leading to a stack-based buffer overflow. Impact A remote attacker could exploit this vulnerability ...

RE: DoS code for Cisco VLAN Trunking Protocol Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, This is Paul Oxman with Cisco PSIRT. For mitigations and workarounds, please consult the Cisco Security Response available at: http://www.cisco.com/warp/public/707/cisco-sr-20081105-vtp.shtml Regards From: showrun.lee mailto:[email protected]...

opensuse-updater符号链接本地信息泄漏漏洞

BUGTRAQ ID: 29608 CVE ID：CVE-2008-2389 CNCVE ID:CNCVE-20082389 opensuse-updater是一款类似apt-get的软件包更新实现。 opensuse-updater处理符号链接存在问题，本地攻击者可以利用漏洞获得敏感信息。 目前没有详细漏洞细节提供。 S.u.S.E. opensuse-updater 0 S.u.S.E. openSUSE 10.2 SUSE-SR:2008:012已经修正此漏洞：...

CVE-2008-2388

Multiple off-by-one errors in opensuse-updater in openSUSE 10.2 have unspecified impact and attack vectors. NOTE: the vendor states that these "can be considered no security problem."...

Code injection

Multiple off-by-one errors in opensuse-updater in openSUSE 10.2 have unspecified impact and attack vectors. NOTE: the vendor states that these "can be considered no security problem."...

CVE-2008-2388

CVE-2008-2388 affects opensuse-updater in openSUSE 10.2. The vulnerability is described as multiple off-by-one errors in the updater component, with the impact and attack vectors stated as unspecified. The vendor notes these “can be considered no security problem,” and no concrete exploitation de...

CVE-2008-2389

CVE-2008-2389 affects opensuse-updater in openSUSE 10.2. Local users can access arbitrary files via a symlink attack due to improper handling of symbolic links in the updater. The issue is publicly documented across multiple feeds; SUSE fixed it in SUSE-SR:2008:012 (security advisory).

CVE-2008-2389

opensuse-updater in openSUSE 10.2 allows local users to access arbitrary files via a symlink attack...

openSUSE 10 Security Update : opensuse-updater (opensuse-updater-5262)

This update fixes a symlink problem and two off-by-one vulnerabilities. The overflows can be considered no security problem but the symlink flaw could be used by local users to gain unauthorized access to information like passwords. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

CVE-2007-6475

Multiple directory traversal vulnerabilities in GF-3XPLORER 2.4 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the langsel parameter to 1 updater.php and 2 thumber.php...