Microsoft OpenType CFF Driver Font Encoded Character Corruption (MS11-007; CVE-2011-0033)

OpenType is a font format developed jointly by Microsoft and Adobe as an extension of Apple's TrueType font format. An OpenType font file contains data, in table format, that comprises either a TrueType or a PostScript outline font. A remote code execution vulnerability has been reported in the w...

SuSE 11.1 Security Update : glibc (SAT Patch Number 2700)

This update of glibc fixes the following bugs and security issues : - The implementation of initgroups of the nsscompat module omits all NIS groups at the second invocation within the same process, and also uses a needlessly inefficient method to determine the NIS groups. - An integer overflow th...

CVE-2010-4416

Unspecified vulnerability in the Oracle GoldenGate Veridata component in Oracle Fusion Middleware 3.0.0.4 allows remote attackers to affect availability via unknown vectors related to Server. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims...

Buffer overflow

Unspecified vulnerability in the Oracle GoldenGate Veridata component in Oracle Fusion Middleware 3.0.0.4 allows remote attackers to affect availability via unknown vectors related to Server. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims...

JVN#09157962: SquirrelMail vulnerable to cross-site scripting

SquirrelMail from SquirrelMail Project is an open source webmail web-based email. SquirrelMail contains an issue in handling specific character encoding and processing "data:" URL, which may result in cross-site scripting. Impact An arbitrary script may be executed on the user's web browser...

RHEL 6 : mod_auth_mysql (RHSA-2010:1002)

An updated modauthmysql package that fixes one security issue is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating...

Mozilla Foundation Security Advisory 2010-84

Mozilla Foundation Security Advisory 2010-84 Title: XSS hazard in multiple character encodings Impact: Moderate Announced: December 9, 2010 Reporter: Yosuke Hasegawa, Masatoshi Kimura Products: Firefox, SeaMonkey Fixed in: Firefox 3.6.13 Firefox 3.5.16 SeaMonkey 2.0.11 Description Security...

XSS hazard in multiple character encodings — Mozilla

Security researchers Yosuke Hasegawa and Masatoshi Kimura reported that the x-mac-arabic, x-mac-farsi and x-mac-hebrew character encodings are vulnerable to XSS attacks due to some characters being converted to angle brackets when displayed by the rendering engine. Sites using these character...

SuSE 11 Security Update : systemtap (SAT Patch Number 2579)

This update of systemtab fixes a shell meta character injection vulnerability that allows remote users to execute arbitrary commands with the privileges of the stap-server. CVE-2009-4273 Additionally, a remote denial of service bug in the getargv function has been fixed. CVE-2010-0411 %NASLMINLEV...

Stack overflow

Multiple stack-based buffer overflows in the prnetiotelnetgets function in netio.c in ProFTPD before 1.3.3c allow remote attackers to execute arbitrary code via vectors involving a TELNET IAC escape character to a 1 FTP or 2 FTPS server...

CVE-2010-4221

Multiple stack-based buffer overflows in the prnetiotelnetgets function in netio.c in ProFTPD before 1.3.3c allow remote attackers to execute arbitrary code via vectors involving a TELNET IAC escape character to a 1 FTP or 2 FTPS server...

SqlInjector : A MS SQL Server Blind Injector !

SqlInjector was originally called as BlindSQLInjector. SqlInjector is an application to perform completely blind SQL injection, that currently supports only MS SQL Server. It uses time based inference to determine true or false conditions to extract data. The key feature is that it uses a binary...

Joomla! Component ccInvoices - SQL Injection

Joomla Component ccinvoices SQL Injection Vulnerability Author : Fl0riX Bug Researchers Name : Joomla comccinvoices Bug Type : SQL injection Infection : Admin Login Bilgileri Alinabilir. Vendor: http://www.chillcreations.com/ Demo Vuln : +index.php?option=comccinvoices&task=viewInv&id=EXPLOIT Not...

Adobe Acrobat / Reader multiple security vulnerabilities

Multiple memory corruptions, code executions, privilege escalations, shell character vulnerabilities...

Spammers Using SHY Character to Hide Malicious URLs

Spammers have jumped on the little-used soft hyphen or SHY character to fool URL filtering devices. According to researchers at Symantec Corp., spammers are larding up URLs for sites they promote with the soft hyphen character, which many browsers ignore. Spammers aren’t shy about jumping humans...

ecshop advertising call page message header is written into the storms path-vulnerability warning-the black bar safety net

/affiche.php,php5 environmental error exposure program path, php4 environment to display the written information the charset parameter is not to do rigorous filtration result in an http message header truncated written...

CentOS Update for freetype CESA-2010:0607 centos3 i386

Check for the Version of freetype OpenVAS Vulnerability Test CentOS Update for freetype CESA-2010:0607 centos3 i386 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

Design/Logic Flaw

Unspecified vulnerability in FreeType 2.3.9, and other versions before 2.4.2, allows remote attackers to cause a denial of service via vectors involving nested Standard Encoding Accented Character aka seac calls, related to psaux.h, cffgload.c, cffgload.h, and t1decode.c...

CVE-2010-3054

Unspecified vulnerability in FreeType 2.3.9, and other versions before 2.4.2, allows remote attackers to cause a denial of service via vectors involving nested Standard Encoding Accented Character aka seac calls, related to psaux.h, cffgload.c, cffgload.h, and t1decode.c...

CVE-2010-2813

SquirrelMail’s imap_general.php vulnerability (CVE-2010-2813) affects versions prior to 1.4.21, where 8-bit password handling allows remote attackers to trigger a denial of service (disk consumption) by issuing numerous IMAP login attempts with different usernames, causing many preferences files ...