[SECURITY] Fedora 15 Update: rssh-2.3.3-1.fc15

rssh is a restricted shell for use with OpenSSH, allowing only scp and/or sftp. For example, if you have a server which you only want to allow users to copy files off of via scp, without providing shell access, you can use rssh to do that. It is a alternative to scponly...

[SECURITY] Fedora 15 Update: tmux-1.4-4.fc15

tmux is a "terminal multiplexer." It enables a number of terminals or windows to be accessed and controlled from a single terminal. tmux is intended to be a simple, modern, BSD-licensed alternative to programs such as GNU Screen...

[SECURITY] Fedora 13 Update: tmux-1.4-3.fc13

tmux is a "terminal multiplexer." It enables a number of terminals or windows to be accessed and controlled from a single terminal. tmux is intended to be a simple, modern, BSD-licensed alternative to programs such as GNU Screen...

[SECURITY] Fedora 14 Update: tmux-1.4-3.fc14

tmux is a "terminal multiplexer." It enables a number of terminals or windows to be accessed and controlled from a single terminal. tmux is intended to be a simple, modern, BSD-licensed alternative to programs such as GNU Screen...

[SECURITY] Fedora 14 Update: exim-4.72-2.fc14

Exim is a message transfer agent MTA developed at the University of Cambridge for use on Unix systems connected to the Internet. It is freely available under the terms of the GNU General Public Licence. In style it is similar to Smail 3, but its facilities are more general. There is a great deal ...

DSA-2214-1 ikiwiki - missing input validation

Bulletin has no description...

Альтернативный LIMIT

Затравка. Приведу альтернативу LIMIT, когда в url нельзя использовать символы: пробел,,',/,% Из-за ограничений отпадают альтернативные пробелы %09,%0A,... и //. Остается альтернативный синтаксис с использованием скобок. Но синтаксис limit не позволяет даже их: Код: ... limit1,100 -- error...

CVE-2010-3294

CVE-2010-3294 is a cross-site scripting vulnerability in the APC project’s apc.php (APC extension for PHP) present before version 3.1.4. The vulnerability enables remote attackers to inject arbitrary script/HTML via unspecified vectors. Publicly cited fixes include upgrading the APC package to ve...

PT-2010-4717 · Php +2 · Alternative Php Cache (Apc) Extension +2

Name of the Vulnerable Software and Affected Versions: Alternative PHP Cache APC extension versions prior to 3.1.4 Description: The issue is related to a cross-site scripting XSS vulnerability. This allows remote attackers to inject arbitrary web script or HTML. Recommendations: For versions prio...

Bug Count Just One Problem for Facebook Foe Diaspora

Saying that you want to take on the world’s biggest social network is the kind of thing that puts a big target on your back. At least that’s what the ambitious young crew behind Diaspora, an open source alternative to Facebook, found out this week. The Diaspora team pushed out an early as in...

sFileManager 24a - Local File Inclusion

sFileManager 24a - Local File Inclusion -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= sFileManager eNYe-Sec - www.enye-sec.org - www.pepelux.org ----- by the author ----- Simple File Manager SFM is a web based file management utility. It is designed to be used by those that don't wan...

w3m: doesn't handle NULL in Common Name properly

istream.c in w3m 0.5.2 and possibly other versions, when sslverifyserver is enabled, does not properly handle a '\0' character in a domain name in the 1 subject's Common Name or 2 Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary S...

openSUSE Security Update : w3m (openSUSE-SU-2010:0393-1)

w3m did not handle embedded nul characters in the common name and in subject alternative names of x509 certificates. CVE-2010-2074 has been assigned to this issue. This update also turns on verification of x509 certificates by default which was not the case before. %NASLMINLEVEL 70300 C Tenable...

SSH Brute Force Attacks Resurface

Security experts are warning about a fresh round of attacks against SSH implementations. The attacks are brute-force attempts to authenticate to remote SSH servers, a tactic that has been used quite often in the past in distributed attacks. The attacks, which the handlers at the SANS Internet Sto...

DEBIAN-CVE-2010-2074

istream.c in w3m 0.5.2 and possibly other versions, when sslverifyserver is enabled, does not properly handle a '\0' character in a domain name in the 1 subject's Common Name or 2 Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary S...

Facebook 'Like-jacking' Scams Expand

Facebook attacks that force users to unwittingly endorse scam pages keep spreading, researchers say. Attacks have now circulated that cause users to recommend pages promising naked pictures of alternative rock diva Hayley Williams or the phone number of heart-throb singer Justin Bieber. Read the...

iScripts VisualCaster - SQL Injection

iScripts VisualCaster - SQL Injection Exploit Title:SQli Vulnerability in iScripts VisualCaster Version: Web Application vendor :www.iscripts.com/ Date: 29 apr,2010 Dork: Powered by iScripts VisualCaster Author:Sid3^effects Code :...

iScripts VisualCaster - SQL Injection

Exploit Title:SQli Vulnerability in iScripts VisualCaster Version: Web Application vendor :www.iscripts.com/ Date: 29 apr,2010 Dork: Powered by iScripts VisualCaster Author:Sid3^effects Code : -------------------------------------------------------------------------------------- Sid3^effects aKa...

EPay Enterprise 4.13 - 'cid' SQL Injection

/ / / \ \ \ \ \ / / \\ \ \ \ \ // /// \ \ / / \ //|\ / \ \ \ \ \ \ / / \ \ / / \ | | | \ | | || | | |/ / \ V / || |\ V / / \ | / \ | /| | | || / | | | | . | ' || / | || // \ // \|||/|||||||||\ .WEB.ID ----------------------------------------------------------------------- EPay...

Microsoft Warns of New IE Zero Day Attacks

A zero-day unpatched vulnerability in Microsoft’s Internet Explorer is being exploited in the wild, the company warned in an advisory issued today. On the same day it issued software fixes as part of its Patch Tuesday schedule, Microsoft released a pre-patch advisory to warn of the risk of remote...