Code injection

The Zend Engine in PHP before 5.4.16 RC1, and 5.5.0 before RC2, does not properly determine whether a parser error occurred, which allows context-dependent attackers to cause a denial of service memory consumption and application crash via a crafted function definition, as demonstrated by an atta...

Moxiecode File Manager 3.1.5 Shell Upload

Hello list! I want to warn you about vulnerabilities in Moxiecode File Manager MCFileManager. This is commercial plugin for TinyMCE. It concerns as MCFileManager, as all web applications which have MCFileManager in their bundle. These are Arbitrary File Uploading vulnerabilities, which lead to Co...

Hacked DNS Servers Used in Cdorked Malware Campaign

The attack that employed compromised Apache Web server binaries is turning out to be more complex than originally thought, as researchers now have found that the attackers also are using Trojaned Nginx and Lighttpd binaries as part of the campaign. More concerning, though, is the possibility that...

[SECURITY] Fedora 17 Update: rubygem-rack-1.4.0-4.fc17

Rack provides a common API for connecting web frameworks, web servers and layers of software in between...

20 Years On, the Open Web Faces Challenges

For people of a certain age in the technology industry, one of the ways of establishing a connection with someone is by asking some version of the following question: How long have you been online? Depending upon how you define “online”, the answer can vary from 15 to 25 or even 30 years. But...

New Apache backdoor serving Blackhole exploit kit

A new sophisticated and stealthy Apache backdoor meant to drive traffic to malicious websites serving Blackhole exploit kit widely has been detected by Sucuri recently. Researchers claimed that this backdoor affecting hundreds of web servers right now. Dubbed Linux/Cdorked.A, one of the most...

Who Needs a Botnet when you have a 4 Gbps DDoS Cannon?

In recent months the DDoS world has shifted from complex small scale Botnet attacks to much larger network based DDoS attacks, perpetrated largely by hijacked web servers. How many of these hijacked servers are out there remains to be seen. However, Incapsula recently got a very good idea of just...

Who Needs a Botnet when you have a 4 Gbps DDoS Cannon?

In recent months the DDoS world has shifted from complex small scale Botnet attacks to much larger network based DDoS attacks, perpetrated largely by hijacked web servers. How many of these hijacked servers are out there remains to be seen. However, Incapsula recently got a very good idea of just...

EasyPHP Webserver <= 12.1 Multiple Vulnerabilities - Active Check

EasyPHP Webserver is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Size, Funding of Bank DDoS Attacks Grow in Third Phase

The resumption this week of distributed denial of service attacks against major U.S. banks brought not only more cost and disruption to financial institutions trying keep online services available, but it also raised new questions about the funding and true motives behind the attacks. A number of...

Nmap NSE 6.01: http-malware-host

This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle Application Express (Apex) Detection

The remote host is running Oracle Application Express Apex. ---------------------------------------------------- c Recx Ltd 2009-2012 http://www.recx.co.uk/ Oracle Application Express Detection on HTTP ports Version 1.1 ---------------------------------------------------- include"compat.inc"; if...

Oracle Application Express (Apex) Version Detection

The remote host is running Oracle Application Express Apex. -------------------------------------------------------------- c Recx Ltd 2009-2012 http://www.recx.co.uk/ Detect Oracle Application Express Version on Apex/HTTP ports Version 1.0...

Multilayer DDoS Attacks Have Reset Stage for Network Attacks

Back in the dark days of dial-up connectivity, attackers wouldn’t bother compromising home computers as bots to be used in distributed denial-of-service. The lack of bandwidth made PCs persona non grata in the DDoS world. Instead, attackers targeted Web servers, the only machines with the...

Fedora Update for rubygem-rack FEDORA-2013-0837

Check for the Version of rubygem-rack OpenVAS Vulnerability Test Fedora Update for rubygem-rack FEDORA-2013-0837 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

[SECURITY] Fedora 17 Update: rubygem-rack-1.4.0-3.fc17

Rack provides a common API for connecting web frameworks, web servers and layers of software in between...

[SECURITY] Fedora 18 Update: rubygem-rack-1.4.0-4.fc18

Rack provides a common API for connecting web frameworks, web servers and layers of software in between...

[SECURITY] Fedora 16 Update: rubygem-rack-1.3.0-3.fc16

Rack provides a common API for connecting web frameworks, web servers and layers of software in between...

[SECURITY] Fedora 17 Update: awstats-7.0-9.fc17

Advanced Web Statistics is a powerful and featureful tool that generates advanced web server graphic statistics. This server log analyzer works from command line or as a CGI and shows you all information your log contai ns, in graphical web pages. It can analyze a lot of web/wap/proxy servers lik...

[ISME v0.7] IP Phone Scanning Made Easy

ISME is a small framework to test IP phones from several editors. It can gather information from IP phone infrastructures, test their web servers for default login/password combinations, and also implement attacks against the systems. ISME has been written in perl with a perl/Tk interface to...