JVN#51769987: Yahoo! Toolbar (for Chrome, Safari) vulnerable to toolbar alteration

Yahoo! Toolbar for Chrome, Safari contains a vulnerability where the toolbar may be altered when visiting a specially crafted web page. Impact A remote attacker may alter the toolbar. As a result, keywords entered in the toolbar may be leaked to a third party. Solution Update the software Update ...

CentOS Update for dhclient CESA-2011:1160 centos5 x86_64

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

DSA-2516-1 isc-dhcp - denial of service

Bulletin has no description...

Fedora Update for clamav FEDORA-2012-9577

Check for the Version of clamav OpenVAS Vulnerability Test Fedora Update for clamav FEDORA-2012-9577 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the term...

[SECURITY] Fedora 16 Update: clamav-0.97.5-1600.fc16

Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs ar...

Buffer Overflow Vulnerabilities in the Cisco WebEx Player

The Cisco WebEx Recording Format WRF player contains four buffer overflow vulnerabilities and the Cisco Advanced Recording Format ARF player contains one buffer overflow vulnerability. In some cases, exploitation of the vulnerabilities could allow a remote attacker to execute arbitrary code on th...

[SECURITY] Fedora 17 Update: clamav-0.97.5-1700.fc17

Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs ar...

WordPress Automatic Plugin "q" SQL注入漏洞

WordPress是一种使用PHP语言和MySQL数据库开发的Blog（博客、网志引擎，用户可以在支持PHP和MySQL数据库的服务器上建立自己的Blog。 Wordpress Automatic Plugin for WordPress 2.0.3之前版本没有验证通过"q"参数传递到csv.php的输入即用作SQL查询，csv.php文件没有要求有效的登录凭证，通过注入任意SQL代码可操作SQL查询，执行SQL注入攻击。 0 WordPress Automatic Plugin 2.x 厂商补丁： WordPress ---------...

WordPress Automatic Plugin 2.0.3 - SQL Injection

This WordPress Automatic plugin is prone to an SQL injection. This vulnerability works in the csv.php file which does not require valid login credential and it allows an attacker to execute SQL Queries. Solution Upgrade this plugin to version 2.0.4...

Wordpress Automatic Plugin v2.0.3 CSRF Exploit

Exploit for php platform in category web applications Title: ====== Wordpress Automatic Plugin v2.0.3 CSRF Exploit Date: ===== 2012-06-15 Website: =========== http://codecanyon.net/item/wordpress-automatic-plugin/1904470 Introduction: ============= Wordpress automatic plugin posts quality targete...

WordPress Automatic 2.0.3 Cross Site Request Forgery

Title: ====== Wordpress Automatic Plugin v2.0.3 CSRF Exploit Date: ===== 2012-06-15 Website: =========== http://codecanyon.net/item/wordpress-automatic-plugin/1904470 Introduction: ============= Wordpress automatic plugin posts quality targeted articles, Amazon Products, clickbank Products, Youtu...

Microsoft Releases Automatic Updater for Certificate Revocation Lists, Plans to Invalidate Short RSA Keys

As part of its response to the Flame malware and its usage of a forged Microsoft certificate to sign malicious files, Microsoft has changed the way that Windows handles certificates, releasing an automatic updater function that will recognize and flag untrusted certificates. The new functionality...

sdcms过滤不严

简要描述： 最新的SDCMS可以通过程序后台自动创建目录,从而拿到网站权限 详细说明： 以Sdcms1.3.1为例子 在后台,出现模版功能,可创建文件夹及文件. 看图. 现在创建1个文件夹 OK了，但是过滤掉了部分. 文件夹无办法了,那么试下文件呢. 1.asp;1.htm 直接提示 失败 找到系统设置功能,点上传类型,增加asp类型asp,aaspsp,asasa,aasasa,全部失败 继续修改上传目录为1.asp 然后直接在文章页面上传jpg程序, 利用IIS 解析漏洞,成功执行. 可以直接用菜刀就可以了。...

Sielco Sistemi Winlog Buffer Overflow 2.07.14

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'Sielco Sistemi...

RedHat Update for python RHSA-2011:0554-01

Check for the Version of python OpenVAS Vulnerability Test RedHat Update for python RHSA-2011:0554-01 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the ter...

Expert Warns That WordPress Autoupdate Feature Used To Infect Blogs With Malware

UPDATE: More than 1,000 WordPress blogs are currently being infected by a form of malware that has ‘piggybacked’ its way onto the blogging platform using the WordPress automatic update function, a security researcher has discovered. According to Denis Sinegubko, founder of Unmask Parasites, the...

Opera 12 Beta Released With New Security Features, Including Do Not Track Support

This seems to be the season for major new versions of browsers. A couple of days after Mozilla released Firefox 12, Opera has pushed out a beta of version 12 of its browser, which includes several security updates, such as private browsing and support for the Do Not Track header. The new version ...

[SECURITY] Fedora 17 Update: wicd-1.7.2.1-1.fc17

Wicd is designed to give the user as much control over behavior of network connections as possible. Every network, both wired and wireless, has its own profile with its own configuration options and connection behavior. Wicd will try to automatically connect only to networks the user specifies it...

BulletProof FTP Client 2010 - Buffer Overflow (PoC)

BulletProof FTP Client 2010 - Buffer Overflow PoC Title: ====== BulletProof FTP Client 2010 - Buffer Overflow Vulnerability Date: ===== 2012-04-02 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=475 VL-ID: ===== 475 Introduction: ============= BPFTP Client is a fully...

Liferay XSL - Command Execution (Metasploit)

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' require 'activesupport/json'...