net2ftp Multiple Cross-Site Scripting Vulnerabilities

The net2ftp program is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

New vulnerabilities in Power Phlogger

Здравствуйте 3APA3A! Сообщаю вам о найденных мною новых Information Leakage, Insufficient Anti-automation и Insufficient Authentication уязвимостях в Power Phlogger. Information Leakage: В скрипте счётчика pphlogger.js, или в коде вызова скрипта с сервера системы в параметре id, на сайте...

Vulnerabilities in Invision Power Board

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Abuse of Functionality та Insufficient Anti-automation уязвимостях в форумном движке Invision Power Board. Abuse of Functionality: Мне уже давно была известна возможность определения логинов на форуме - имя пользователя на форуме есть одновременно...

Yap Blog < 1.1.1 RFI Vulnerability - Active Check

Yap Blog is prone to a remote file inclusion RFI vulnerability because it fails to sufficiently sanitize user-supplied input. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

New vulnerabilities in Power Phlogger

Здравствуйте 3APA3A! Сообщаю вам о найденных мною новых Abuse of Functionality та Denial of Service уязвимостях в Power Phlogger. Abuse of Functionality: Уязвимость в системе восстановления создания нового пароля http://site/dspNewPw.php. Зная "Имя пользователя" или "e-mail" id, который есть...

Scripts For Sites EZ Hotscripts 'software-description.php' SQL Injection Vulnerability

EZ Hotscripts is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the...

Microsoft explains how ActiveX in Office is abused by attackers

On the Microsoft Secure Windows Iniative blog, software engineer Chengyun discusses the default behaviour of ActiveX controls embedded in Office documents. The software giant also provides information on how can an attacker abuse ActiveX and how Office users can change the behavior of ActiveX...

kernel: fix soft lockups/OOM issues with unix socket garbage collector

Linux kernel 2.6.28 allows local users to cause a denial of service "soft lockup" and process loss via a large number of sendmsg function calls, which does not block during AFUNIX garbage collection and triggers an OOM condition, a different vulnerability than CVE-2008-5029...

CVE-2009-0243

Microsoft Windows does not properly enforce the Autorun and NoDriveTypeAutoRun registry values, which allows physically proximate attackers to execute arbitrary code by 1 inserting CD-ROM media, 2 inserting DVD media, 3 connecting a USB device, and 4 connecting a Firewire device; 5 allows...

PT-2009-2915 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Microsoft Windows affected versions not specified Description: The issue allows attackers to execute arbitrary code through various means, including inserting CD-ROM or DVD media, connecting a USB or Firewire device, mapping a network drive, ...

New vulnerabilities in Power Phlogger

Здравствуйте 3APA3A! Сообщаю вам о найденных мною новых Insufficient Anti-automation, Abuse of Functionality и Information Leakage уязвимостях в Power Phlogger. Insufficient Anti-automation: На странице регистрации http://site/dspSignup.php нет защиты от автоматизированных запросов капчи. Abuse o...

New vulnerabilities in Power Phlogger

Здравствуйте 3APA3A! Сообщаю вам о найденных мною новых Cross-Site Scripting и Abuse of Functionality уязвимостях в Power Phlogger. XSS: Это reflected и persistent XSS. http://site/edCss.php?action=create+new&fields5Bcss5D=3Cscript3Ealertdocument.cookie3C/script3E Код в дальнейшем исполняется при...

browser-overflows.txt

Multiple Browsers Stack overflow in javascript with infinite array original article:http://lostmon.blogspot.com/ 2008/11/multiple-browsers-stack-overflow-in.html Description Multiple Browsers are prone vulnerables to a stack overflow or crash via infinite array in Javascript engine. This is a...

CVE-2008-4616

The SpamBam plugin for WordPress allows remote attackers to bypass restrictions and add blog comments by using server-supplied values to calculate a shared key...

Gentoo Security Advisory GLSA 200410-22 (MySQL)

The remote host is missing updates announced in advisory GLSA 200410-22. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Gentoo Security Advisory GLSA 200410-22 (MySQL)

The remote host is missing updates announced in advisory GLSA 200410-22. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Abuse of Functionality vulnerability in WP-ContactForm for WordPress

Здравствуйте 3APA3A! Сообщаю вам о найденной мною Abuse of Functionality уязвимости в плагине WP-ContactForm для WordPress. Abuse of Functionality: На странице контактов есть функция “Copy yourself on the form submission”. Она включается в настройках Copy Option и приводит к тому, что через сайт...

Vulnerabilities in Contact Form ][ for WordPress

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Insufficient Anti-automation, Abuse of Functionality и Cross-Site Scripting уязвимостях в плагине Contact Form для WordPress. Insufficient Anti-automation: Отсутствие капчи позволяет слать автоматические сообщения в частности спам админам сайта...

kernel: ptrace: Crash on PTRACE_{ATTACH,DETACH} race

Race condition in the ptrace and utrace support in the Linux kernel 2.6.9 through 2.6.25, as used in Red Hat Enterprise Linux RHEL 4, allows local users to cause a denial of service oops via a long series of PTRACEATTACH ptrace calls to another user's process that trigger a conflict between...

Vulnerabilities in WordPress

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Abuse of Functionality и Weak Password уязвимостях в WordPress. Abuse of Functionality: В WordPress имеется возможность определения логинов в системе. Уязвимость заключается в том, что при введении верного и неверного логина при неверном пароле...