Bitweaver R2 CMS Remote File Upload / Disclosure Vulnerabilities

Exploit for unknown platform in category web applications ================================================================ Bitweaver R2 CMS Remote File Upload / Disclosure Vulnerabilities ================================================================ WwW.BugReport.ir AmnPardaz Security Research...

bitweaver-sqlxss.txt

HSC Bitweaver XSS & SQL Injection Vulnerability Bitweaver is an open source content management system. Its speed and power are ideal for large-scale community websites and corporate applications, but it is simple enough for non-technical small site users to set up and administrate. It comes fully...

After 6 months - fix available for Microsoft DNS cache poisoning attack

After 6 months - fix available for Microsoft DNS cache poisoning attack On April this year I discovered a new vulnerability that enables DNS cache poisoning attack against the Windows DNS server. Today November 13th, 2007 - six and a half months after being informed - Microsoft released a fix for...

Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : firefox vulnerabilities (USN-535-1)

Various flaws were discovered in the layout and JavaScript engines. By tricking a user into opening a malicious web page, an attacker could execute arbitrary code with the user's privileges. CVE-2007-5336, CVE-2007-5339, CVE-2007-5340 Michal Zalewski discovered that the onUnload event handlers we...

pointroll-xss.txt

A cross-site scripting vulnerability has been discovered on multiple websites which use ads provided by Pointroll. The following list is a subset of the websites which contain the vulnerability: http://www.cnn.com/pointroll/PointRollAds.htm http://www.myspace.com/pointroll/PointRollAds.htm...

[SECURITY] Fedora 7 Update: mediawiki-1.9.4-35.fc7

MediaWiki is the software used for Wikipedia and the other Wikimedia Foundation websites. Compared to other wikis, it has an excellent range of features and support for high-traffic websites using multiple servers This package supports wiki farms. Copy /var/www/wiki over to the desired wiki...

BIND 8 EOL and BIND 8 DNS Cache Poisoning (Amit Klein, Trusteer)

BIND 8 EOL and BIND 8 DNS Cache Poisoning Note: this is a different attack from BIND 9 DNS cache poisoning. I discovered a new weakness in BIND 8 DNS server which enables "DNS Forgery Pharming". An attacker can remotely poison the cache of any BIND 8 caching DNS server and force users who use thi...

[SECURITY] Fedora 7 Update: mediawiki-1.9.3-34.0.2.fc7

MediaWiki is the software used for Wikipedia and the other Wikimedia Foundation websites. Compared to other wikis, it has an excellent range of features and support for high-traffic websites using multiple servers This package supports wiki farms. Copy /var/www/wiki over to the desired wiki...

"BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer)

I discovered a new weakness in BIND 9 DNS server which enables "DNS Forgery Pharming". An attacker can remotely poison the cache of any BIND 9 caching DNS server and force users who use this DNS server to reach fraudulent websites each time they try to access real websites. BIND 9 is the most...

MPack with virtual hosting and PHP security-vulnerability warning-the black bar safety net

MPack is by a self-proclaimed "Dream Coders Team" of the organization development of the PHP program, which contain a number of the latest exploit code can be used to manipulate the distal end of attacks on Panda Labs at the end of last year when for the first time found that, at the time someone...

WordPress <= 2.2.1 - Multiple vulnerabilities

Because of these vulnerabilities, the attackers can redirect visitors to other websites and potentially obtain sensitive information. Solution Update WordPress...

Various sites program's default database-vulnerability warning-the black bar safety net

Action Network: The default database /data/dvbbs7. mdb BACKUP DATABASE /databackup/dvbbs7. mdb Front: Username: admin Key code: admin888 Background: Username: admin Key code: admin888 --------------- bbsxp: The default database database/bbsxp. mdb ＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿ LeadBBS The default database...

Unfixed XSS vulnerability at www.indianwebsites.com

Security researcher GURUS, has submitted on 06/03/2007 a cross-site-scripting XSS vulnerability affecting www.indianwebsites.com, which at the time of submission ranked 741272 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 06/03/2007. It is...

PHP-Generics 1.0.0 Beta - Multiple Remote File Inclusions

-------------------------------------------------------- php-generics 1.0 Remote File Inclusion Vulnerabilities -------------------------------------------------------- Software: php-generics 1.0Beta Vendor: http://ie.archive.ubuntu.com/sourceforge/p/ph/php-generics/php-generics-1.0.0-beta.zip...

CVE-2007-1256

Mozilla Firefox 2.0.0.2 allows remote attackers to spoof the address bar, favicons, and document source, and perform updates in the context of arbitrary websites, by repeatedly setting document.location in the onunload attribute when linking to another website, a variant of CVE-2007-1092...

CVE-2007-1256

Mozilla Firefox 2.0.0.2 allows remote attackers to spoof the address bar, favicons, and document source, and perform updates in the context of arbitrary websites, by repeatedly setting document.location in the onunload attribute when linking to another website, a variant of CVE-2007-1092...

CVE-2007-1256

CVE-2007-1256 affects Mozilla Firefox 2.0.0.2. A malicious page can spoof the address bar, favicons, and document source by repeatedly setting document.location in the onunload attribute when navigating to another site, a variant of CVE-2007-1092. Affected component: Firefox; vulnerable behavior:...

Using Porttunnel do Super springboard-a vulnerability warning-the black bar safety net

PortTunnel heard? Uh, a good port mapping tool Previously had not how to use, just bitter to the even data are put in the www. brinkster. com space, and domestic on this website has been blocked, so can not access,, gas Had to pick up this weapon Because in the cafe can not properly use the http...

Mac OS X Security Update 2006-008

The remote host is running a version of Mac OS X 10.4 that does not have Security Update 2006-008 applied. This update fixes a flaw in QuickTime that may allow a rogue website to obtain the images rendered on the user screen. By combining this flaw with Quartz Composer, an attacker may be able to...

CVE-2003-1311

siteminderagent/SmMakeCookie.ccc in Netegrity SiteMinder does not ensure that the TARGET parameter names a valid redirection resource, which allows remote attackers to construct a URL that might trick users into visiting an arbitrary web site referenced by this parameter...