136 matches found
Security Advisory - A Security Vulnerability of Using Insecure Random Numbers to Generate Self-signed Certificates in Huawei Products
Some Huawei products automatically generate self-signed certificates upon the first use. The random numbers used to generate these certificates are not random enough. Different devices' certificates may use the same random number consequently, which contains the risk of an attacker compromising t...
SolucionXpressPro 'main.php' SQL Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/33111/info SolucionXpressPro is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to...
JAWS 0.2/0.3/0.4 ControlPanel.PHP SQL Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/10826/info JAWS is reportedly affected by a remote SQL injection vulnerability. This issue occurs in the controlpanel.php script due to a failure of the application to properly sanitize user-supplied URI parameter input...
CGI-World Poll It 2.0 Internal Variable Override Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/1431/info Poll It is a Perl CGI application used to create and maintain opinion polls on websites. The program relies on a number of internal variables. These variables can be overwritten by any remote user by specifying...
InVision: Sensitive information in cookies
I observed sensitive information stored in cookies. eg. This are my extracted cookies. █████ You can clearly see user's email-id in the cookie ███████ You should not pass sensitive information in cookies. If cookies are stolen, this will result in compromising data of user. If you have more...
Roundcube Webmail 0.3.1 - Cross-Site Request Forgery SQL Injection
Roundcube Webmail 0.3.1 - Cross-Site Request Forgery SQL Injection Exploit Title: RoundCube 0.3.1 SQL injection Date: 10/10/2011 Author: Smith Falcon Software Link: http://roundcube.net/download Version: 0.3.1 Tested on: Linux timezone= is vulnerable to SQL Union Injection. "POST" data in...
Roundcube Webmail 0.3.1 - Cross-Site Request Forgery / SQL Injection
Exploit Title: RoundCube 0.3.1 SQL injection Date: 10/10/2011 Author: Smith Falcon Software Link: http://roundcube.net/download Version: 0.3.1 Tested on: Linux timezone= is vulnerable to SQL Union Injection. "POST" data in http://site.com/roundcube/index.php...
Proventia Network Mail Security System CRLF Injection
Security Advisory: MVSA-10-009 / CVE-2010-0155 Vendor: IBM Products: Proventia Network Mail Security System Vulnerabilities: CRLF Injection Risk: Medium Attack Vector: From Remote Authentication: Required Reference: http://www.ventuneac.net/security-advisories/MVSA-10-009 Description Web-based...
UK One Media CMS Error Based SQL Injection
O / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ | | | | | UK One Media CMS id Error Based SQL Injection Vulnerability | | | | | | | | Summary: Content Management System PHP+MySQL | | ...
Secunia Research: OpenOffice.org Word Document Table Parsing Integer Underflow
====================================================================== Secunia Research 01/09/2009 - OpenOffice.org Word Document Table Parsing Integer Underflow - ====================================================================== Table of Contents Affected...
InstallShield Update Agent - Downloads and executes "Rule Scripts" insecurely.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUMMARY InstallShield Update Agent - Remote "Rule Script" Code Execution Vulnerability. OVERVIEW InstallShield Update Agent uses insecure methods of retrieving operational script code from unauthenticated, unverified external sources over HTTP...
Ruby 1.9 - Safe Level Multiple Function Restriction Bypass
source: https://www.securityfocus.com/bid/30644/info Ruby is prone to multiple vulnerabilities that can be leveraged to bypass security restrictions or cause a denial of service: - Multiple security-bypass vulnerabilities occur because of errors in the 'safe level' restriction implementation...
blackboard-xss.txt
//////////////////////////////////////////////////////////////////////////////// //Note: //The full version of this report in pdf format available at my blog: //http://www.secskill.wordpress.com // OR : //http://www.scribd.com/doc/2363025/Blackboard-Academic-Suite-Multiple-XSS-Vulnerabilities-...
Wordpress Multiple Versions Pwnpress Exploitation Tookit
No description provided by source. !/usr/bin/env ruby .---. .---. : : o : happy antiblogging, dear kids! ..-: 0 : :-.. / .-'' ' ---' ---' " -. Copyright c Lance M. Havok .' " ' " . " . ' " . lmh at info-pull.com : '.---.,,.,...,.,.,.,..---. ' ; . " . .' " .' ----- All rights reserved.  ...
HP (Multiple Products) - PML Driver HPZ12 Privilege Escalation
source: https://www.securityfocus.com/bid/21935/info Multiple HP products are prone to a local privilege-escalation vulnerability. An attacker can exploit this issue to gain SYSTEM-level privileges, completely compromising affected computers. This issue affects HP products that use the 'PML Drive...
CVE-2000-0517
Netscape Navigator (4.73 and earlier) may omit warnings or mis-handle cert state if a user previously accepted a non-matching certificate, enabling a DNS-compromise scenario to spoof a legitimate site. Root cause: certificate name mismatch is not revalidated within the same session after a warnin...