Microsoft Internet Explorer Scrolling Events Cross Domain Information Disclosure Vulnerability

Description Microsoft Internet Explorer is prone to a cross-domain information-disclosure vulnerability. An attacker can exploit this issue to view content from a browser window in another domain or security zone. This may allow the attacker to obtain sensitive information or aid in further...

MySQL / MariaDB Authentication Bypass (Apr 2012) - Active Check

MySQL / MariaDB is prone to an authentication bypass. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft Fraudulent Digital Certificates Spoofing (2718704)

A security breach has been reported in Microsoft Windows. Two unauthorized certificates that have been issued by Microsoft are being used in active attacks. An unauthorized certificate could be used to spoof content, perform phishing attacks, or perform man-in-the-middle attacks. This issue affec...

SQL Injection Vulnerability in Ruby on Rails

CVE-2012-2661 Ruby on Rails是一款Web应用程序框架，构建在Ruby语言之上 存在一个SQL注入漏洞，问题存在于Active Record处理嵌套查询参数，攻击者可以使用特制请求注入SQL语句。 受影响代码直接把请求参数传递给ActiveRecord类的where方法，如Post.where:id = params:id.all。攻击者可以提交请求使params:id返回特制哈希使WHERE子句使用某些值查询任意表 Impacted code directly passes request params to the where method of an...

CVE-2012-2661 rubygem-activerecord: SQL injection when processing nested query paramaters

The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query...

Active Collab "chat module" Remote PHP Code Injection Exploit

This module exploits an arbitrary code injection vulnerability in the chat module that is part of Active Collab versions 2.3.8 and earlier by abusing a pregreplace using the /e modifier and its replacement string using double quotes. The vulnerable function can be found in...

Exploiting Windows 2008 Group Policy Preferences: получение некоторых паролей из AD

Active Directory в Windows 2008 содержит такую Group Policy Preferences как "Local Users and Groups". При создании юзеров из AD в этом пункте, компьютеры, для которых создаются эти юзеры, скачивают файл с AD и находят там нового юзера и его пароль, который необходимо создать у себя локально. В...

Anatomy of a LulzSec Attack 'Singles Out' Web 2.0 Weakness

A new report analyzing a recent attack on a military dating site underscores the need for stronger safeguards on social networks. As part of its Hacker Intelligence Initiative, database and application security provider Imperva deconstructed a March attack by the hacker collective LulzSec on...

Active Collab "chat module" 2.3.8 Remote PHP Code Injection

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Active Collab "chat module" %q This...

Cross site scripting

Cross-site scripting XSS vulnerability in sabreclassadmin.php in the SABRE plugin before 2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the activeoption parameter to wp-admin/tools.php...

GFI WebMonitor - Web monitoring and Security

GFI WebMonitor - Web monitoring and Security With all the threats that Internet access can present to your users and your data, web security software is one of the most valuable investments you can make in your information security. Any solution should offer the following key protections: 1. Site...

Active Collab 'chat module' < 2.3.8 - Remote PHP Code Injection (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Active Collab "chat module" %q This...

Active Collab "chat module" <= 2.3.8 Remote PHP Code Injection Exploit

Exploit for php platform in category remote exploits This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' cla...

Igaware UTM WAF v9.2.0-2 - Multiple Vulnerabilities

Document Title: =============== Igaware UTM WAF v9.2.0-2 - Multiple Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=569 Release Date: ============= 2012-05-17 Vulnerability Laboratory ID VL-ID: ==================================== 569...

Fedora Update for samba4 FEDORA-2012-6382

Check for the Version of samba4 OpenVAS Vulnerability Test Fedora Update for samba4 FEDORA-2012-6382 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the term...

[SECURITY] Fedora 16 Update: samba4-4.0.0-38.alpha16.fc16

Samba 4 is the ambitious next version of the Samba suite that is being developed in parallel to the stable 3.0 series. The main emphasis in this branch is support for the Active Directory logon protocols used by Windows 2000 and above...

Active News Manager CSRF Vulnerability (Add Admin)

Exploit for php platform in category web applications Active News Manager CSRF Vulnerability Add Admin ==================================================================== .:. Author : AtT4CKxT3rR0r1ST email protected .:. Script : http://www.gazatem.com/Products/activenewsmanager.asp === Exploit...

Fedora Update for samba4 FEDORA-2012-6349

Check for the Version of samba4 OpenVAS Vulnerability Test Fedora Update for samba4 FEDORA-2012-6349 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the term...

[SECURITY] Fedora 15 Update: samba4-4.0.0-26.alpha11.fc15.6

Samba 4 is the ambitious next version of the Samba suite that is being developed in parallel to the stable 3.0 series. The main emphasis in this branch is support for the Active Directory logon protocols used by Windows 2000 and above...

MyChipTime CMS Cross Site Scripting

Exploit Title : MyChipTime Cms Cross-Site Scripting Vulnerabilities Author : BHG Security Center - IrIsT Security Team Discovered By : Am!r Home : http://Black-hg.Org - http://IrIsT.Ir Software Link : http://mychiptime.com/ Security Risk : High Version : All Version Tested on : GNU/Linux Ubuntu -...