Defense Industrial Base information-sharing program a good start

The recent flood of stories on attacks against the electrical grid, various government agencies and other portions of the critical infrastructure has renewed the calls for improvements in federal cybersecurity and, especially, information sharing between the government and the private sector on...

Proxy bypass vulnerability & plain text passwords in LevelOne AMG-2000

SEC Consult Security Advisory 20090429-0 ======================================================================= title: Proxy bypass vulnerability & plain text passwords in LevelOne AMG-2000 product: LevelOne AMG-2000 Wireless AP Management Gateway vulnerable version: Firmware =2.00.00build00600...

Crack cafe Group Policy the latest method-vulnerability warning-the black bar safety net

Crack a perverted Internet cafe chargessystem See friends because when you run the Group Policy setting“only run permitted Windows Application”, exit the Group Policy After cannot perform any non-specified feasible program, including the gpedit. the msc also cannot run, all of the pop up"this...

Hathaway, Obama administration swing and miss at RSA

Much of the talk at the RSA Conference last week centered on the lack of the unifying theme or big-time story that usually emerges to take over the show by mid-week. But there was, in fact, a major story, and it was the abject failure of the Obama administration, in the person of Melissa Hathaway...

ECShop 2.5.0 (order_sn) Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications ========================================================== ECShop 2.5.0 ordersn Remote SQL Injection Vulnerability ==========================================================...

Symantec Brightmail Gateway and Mail Security Appliance Cross-site Scripting and Elevation of Privil

SUMMARY Symantec Brightmail Gateways Control Center is susceptible to cross-site scripting and elevation of privilege vulnerabilities. AFFECTED PRODUCTS Product | Version | Solutions ---|---|--- Symantec Brightmail Gateway Appliance 8300 | All prior to 8.0.1 | Upgrade to 8.0.1 or later Symantec...

CVE-2009-1362

SQL injection vulnerability in administration/index.php in chCounter 3.1.3 allows remote attackers to execute arbitrary SQL commands via the loginname parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Sql injection

SQL injection vulnerability in administration/index.php in chCounter 3.1.3 allows remote attackers to execute arbitrary SQL commands via the loginname parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2009-1362: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in administration/index.php in chCounter 3.1.3 allows remote attackers to execute arbitrary SQL commands via the loginname parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Few details likely at RSA on Obama's cybersecurity review

One of the more widely anticipated keynotes at the RSA Conference this week is the talk by Melissa Hathaway, who was in charge of the Obama administration’s recently completed review of the country’s information security standing. However it now looks unlikely that Hathaway will actually reveal a...

Linksys WRT54GC 1.5.7 Firmware - administration.cgi Access Validation

Linksys WRT54GC 1.5.7 Firmware - administration.cgi Access Validation source: https://www.securityfocus.com/bid/34616/info The Linksys WRT54GC router is prone to an access-validation vulnerability because of a lack of authentication when users access specific administration applications. Successf...

Linksys WRT54GC - Admin Password Change (POC)

!-- Gabriel Lima - [email protected] www.falandodeseguranca.com English: Linksys WRT54GC - Administration Password Change The Router WRT54GC doesn't seem to check authentication from the administrator in it's .CGI files, accepting any POST request, as a password change. Below, follow...

Linksys WRT54GC 1.5.7 Firmware - 'administration.cgi' Access Validation

source: https://www.securityfocus.com/bid/34616/info The Linksys WRT54GC router is prone to an access-validation vulnerability because of a lack of authentication when users access specific administration applications. Successful attacks will lead to a compromise of the vulnerable device, which m...

Linksys WRT54GC Password Changer

document.senha.submit;...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the 1 name, 2 ip, 3 username, or 4 description parameter to console/portal/Server/Monitorin...

CVE-2009-0038

Multiple cross-site scripting XSS vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the 1 name, 2 ip, 3 username, or 4 description parameter to console/portal/Server/Monitorin...

CVE-2009-0038

Multiple cross-site scripting XSS vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the 1 name, 2 ip, 3 username, or 4 description parameter to console/portal/Server/Monitorin...

CVE-2009-0038

Multiple cross-site scripting XSS vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the 1 name, 2 ip, 3 username, or 4 description parameter to console/portal/Server/Monitorin...

CVE-2009-0039

Multiple cross-site request forgery CSRF vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to hijack the authentication of administrators for requests that 1 change the web administration password, 2 upload application...

CVE-2009-0038

CVE-2009-0038 refers to multiple cross-site scripting (XSS) vulnerabilities in the Apache Geronimo web administration console (versions 2.1 to 2.1.3). The vulnerabilities allow remote attackers to inject arbitrary web script or HTML via parameters (name, ip, username, description) to console/port...