ICJobSite 1.1 - pid SQL Injection

ICJobSite 1.1 - pid SQL Injection source: https://www.securityfocus.com/bid/47100/info ICJobSite is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the...

osCSS 2.1 - Multiple Cross-Site Scripting / Local File Inclusions

source: https://www.securityfocus.com/bid/47074/info osCSS is prone to a cross-site scripting vulnerability and multiple local file-include vulnerabilities because the application fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script...

Newsportal 0.37 - 'post.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/46961/info NewsPortal is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. An attacker may leverage this issue to execute arbitrary script code in the...

BlackBerry WebKit Browser Engine Vulnerability

Research In Motion has released a security notice to alert users of a vulnerability affecting the WebKit browser engine provided in BlackBerry Device Software versions 6.0 and later. By convincing a user to browse to specially crafted website, a remote attacker may be able to execute arbitrary...

kernel: bio: integer overflow page count when mapping/copying user data

Multiple integer overflows in fs/bio.c in the Linux kernel before 2.6.36.2 allow local users to cause a denial of service system crash via a crafted device ioctl to a SCSI device...

Google's security tool infected with trojan !

It's pretty bold and a cunning coup; criminals have installed a trojan in the Android Market Security Tool that Google is distributing to delete the contaminated apps that recently popped up on the Android Market. As users have been told to expect to see the application running on their phones...

iSO Air Files 2.6 - Directory Traversal

iSO Air Files 2.6 - Directory Traversal Exploit Title: Air Files v2.6 for iPhone / iPod touch, Directory Traversal Date: 02/24/2011 Author: R3d@l3rt, Sunlight, H@ckk3y Software Link : http://itunes.apple.com/kr/app/filer-lite-download-view-manage/id339732484?mt=8 Version: 2.6 Tested on: iPhone,...

IBM Lotus Sametime - stconf.nsfWebMessage?messageString Cross-Site Scripting

IBM Lotus Sametime - stconf.nsfWebMessage?messageString Cross-Site Scripting source: https://www.securityfocus.com/bid/46471/info IBM Lotus Sametime Server is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this...

The inside story of the HBGary hack by Anonymous Hackers !

It has been an embarrassing week for security firm HBGary and its HBGary Federal offshoot. HBGary Federal CEO Aaron Barr thought he had unmasked the hacker hordes of Anonymous and was preparing to name and shame those responsible for co-ordinating the group's actions, including the...

RunCMS 2.2.2 - register.php SQL Injection

RunCMS 2.2.2 - register.php SQL Injection source: https://www.securityfocus.com/bid/46342/info RunCMS is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to...

Microsoft Windows Kernel Elevation of Privilege Vulnerability (2393802)

This host is missing a critical security update according to Microsoft Bulletin MS11-011. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Microsoft Visio Object Memory Corruption (CVE-2011-0092) Remote Code Execution Vulnerability

Description Microsoft Visio is prone to a remote code-execution vulnerability because it fails to adequately handle user-supplied data. Attackers can exploit this issue to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will result in a...

Facebook Kills Firesheep With New Secure Browsing Feature

Facing a wave of criticism for not offering a secured browsing option, Facebook has finally added a new feature to browse the popular social network on a secure connection https. However, the https:// browsing is not turned on by default and must be manually activated from an “Account Settings”...

PHP Coupon Script 'page' Parameter SQL Injection Vulnerability

PHP Coupon Script is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input. Attackers may exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. PHP Coupon Script 6.0 is...

FBI to press criminal charges over AT&T iPad user data hack !

Remember last summer when iPad users on the AT&T network in the US were subject to a hack that allegedly saw around 120,000 customers personal details compromised? The FBI certainly remembers and today it is set to reveal details criminal charges relating to the case, according to Reuters. As we...

Sahana Disaster Management System 'sel' Parameter SQL Injection Vulnerability

Sahana Disaster Management System is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyrig...

Novell iPrint Client 'ienipp.ocx' ActiveX Buffer Overflow Vulnerability

Novell iPrint Client is prone to a buffer overflow vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:novell:iprint";...

ChurchInfo <= 1.2.12 SQL Injection Vulnerability

Exploit for php platform in category web applications ChurchInfo = 1.2.12 SQL Injection Vulnerability Script: "ChurchInfo is a free church database program to help churches track members, families, groups, pledges and payments..." Script site: http://www.churchdb.org/ Download:...

ChurchInfo 1.2.12 - SQL Injection

:::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered by dun \ posdubatgmail.com 2011-01-01 ChurchInfo = 1.2.12 SQL Injection Vulnerability Script: "ChurchInfo is a free church database program to help churche...

Injader CMS 2.4.4 Cross Site Scripting / SQL Injection

================================== Vulnerability ID: HTB22743 Reference: http://www.htbridge.ch/advisory/sqlinjectionininjadercms1.html Product: Injader CMS Vendor: http://www.injader.com/ http://www.injader.com/ Vulnerable Version: 2.4.4 Vendor Notification: 07 December 2010 Vulnerability Type:...