SugarCRM on Apache / Windows .htaccess Direct Request Arbitrary File Access

The version of SugarCRM running on the remote host has an information disclosure vulnerability. When Apache is running on Windows, .htaccess restrictions are case-sensitive, but filenames are not. A remote attacker can bypass .htaccess restrictions by using uppercase letters when requesting files...

Check Point response to the "Evil Maid" attack

Symptoms Check Point Full Disk Encryption is not vulnerable to the "Evil Maid" attack. Solution Full technical details of the "Evil Maid" attack Check Point Full Disk Encryption is not vulnerable to the "Evil Maid" attack, as this particular program specifically targets the True Crypt boot code,...

Facebook Wins $711 Million in Spam Case

Social networking website Facebook was awarded $711.2 million in damages relating to an anti-spam case against Internet marketer Sanford Wallace, court documents show. The site filed an anti-spamming case against Wallace in February for accessing people’s Facebook accounts without their permissio...

BPLawyerCaseDocuments - SQL Injection

x========================================================================================================================================x | AntiSecuritydotorg |...

Xerver HTTP Server 4.32 Disclosure

Xerver HTTP Server v4.32 Remote Arbitrary Source Code Disclosure Found By: DrIDE Download: http://www.javascript.nu/xerver Tested On: Windows XPSP3 - Description - Xerver v4.32 is a Windows based HTTP server. This is the latest version of the application available. Xerver v4.32 is vulnerable to...

Fedora 11 : viewvc-1.1.2-2.fc11 (2009-8507)

CHANGES in 1.1.2: - security fix: validate the 'view' parameter to avoid XSS attack - security fix: avoid printing illegal parameter names and values - add optional support for character encoding detection issue 400 - fix username case handling in svnauthz module issue 419 - fix cvsdbadmin/svnadm...

CVE-2009-2161

Directory traversal vulnerability in backend/admin-functions.php in TorrentTrader Classic 1.09, when used on a case-insensitive web site, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the ssuri parameter, in conjunction with a modified component name...

Firefox 3 Layout engine crashes

The browser engine in Mozilla Firefox 3.x before 3.0.9, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.16 allows remote attackers to cause a denial of service application crash and possibly trigger memory corruption via vectors related to 1 nsAsyncInstantiateEvent::Run, 2...

ftpdmin 0.96 RNFR Remote Buffer Overflow Exploit (xp sp3/case study)

No description provided by source. ?php / ftpdmin v. 0.96 RNFR remote buffer overflow exploit xp sp3 / case study by Nine:Situations:Group::surfista software site: http://www.sentex.net/mwandel/ftpdmin/ our site: http://retrogod.altervista.org/ bug found by rgod in 2006, RNFR sequences can trigge...

ftpdmin 0.96 RNFR Remote Buffer Overflow Exploit (xp sp3/case study)

Exploit for windows platform in category remote exploits ==================================================================== ftpdmin 0.96 RNFR Remote Buffer Overflow Exploit xp sp3/case study ==================================================================== ".$cmd."\n";...

glFusion <= 1.1.2 COM_applyFilter()/order SQL Injection Exploit

Exploit for unknown platform in category web applications =============================================================== glFusion = 4.1 php.ini independent google dork: "Page created in" "seconds by glFusion" +RSS Vulnerability, sql injection in 'order' and 'direction' arguments: look...

Fedora Update for NetworkManager FEDORA-2007-0186

Check for the Version of NetworkManager OpenVAS Vulnerability Test Fedora Update for NetworkManager FEDORA-2007-0186 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify i...

NULL FTP Server 1.1.0.7 SITE Parameters Command Injection Vuln

No description provided by source. vuln.sg Vulnerability Research Advisory NULL FTP Server SITE Parameters Command Injection Vulnerability by Tan Chew Keong Release Date: 2008-12-05 Summary A vulnerability has been found in NULL FTP Server. When exploited, this vulnerability allows an authenticat...

NULL FTP Server 1.1.0.7 - 'Site' Command Injection

vuln.sg Vulnerability Research Advisory NULL FTP Server SITE Parameters Command Injection Vulnerability by Tan Chew Keong Release Date: 2008-12-05 Summary A vulnerability has been found in NULL FTP Server. When exploited, this vulnerability allows an authenticated user to execute arbitrary shell...

GLSA-200812-04 : lighttpd: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200812-04 lighttpd: Multiple vulnerabilities Multiple vulnerabilities have been reported in lighttpd: Qhy reported a memory leak in the httprequestparse function in request.c CVE-2008-4298. Gaetan Bisson reported that URIs are not...

vim: heap buffer overflow in mch_expand_wildcards()

Heap-based buffer overflow in the mchexpandwildcards function in osunix.c in Vim 6.2 and 6.3 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames, as demonstrated by the netrw.v3 test case...

ProCheckUp Security Advisory 2007.31

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 PR07-31: Unauthenticated SQL Injection, XSS and Username Enumeration on DPSnet Case Progress Vulnerabilities Found: 23 May 2007 Vendor Contacted: 10 July 2007, 31 August 2007, 17 September 2007, 12 December 2007 Note: the vendor stopped responding on ...

Debian DSA-1645-1 : lighttpd - various

Several local/remote vulnerabilities have been discovered in lighttpd, a fast webserver with minimal memory footprint. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-4298 A memory leak in the httprequestparse function could be used by remote...

[SECURITY] [DSA-1645-1] New lighttpd packages fix various problems

------------------------------------------------------------------------ Debian Security Advisory DSA-1645-1 [email protected] http://www.debian.org/security/ Steve Kemp October 06, 2008 http://www.debian.org/security/faq -...

[SECURITY] [DSA-1645-1] New lighttpd packages fix various problems

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1645-1 [email protected] http://www.debian.org/security/ Steve Kemp October 06, 2008 http://www.debian.org/security/faq -...