ITS SCADA SQL Injection

STANKOINFORMZASCHITA-10-02 ITS SCADA – Authorization bypass Authors: Eugene Salov [email protected], Andrej Komarov [email protected] Product: ITS SCADA CVSS v2 Base Score: 9.0 AV:N/AC:L/Au:R/C:C/I:C/A:C Impact Subscore: 10.0 Exploitability Subscore: 8.0 Availability of exploit: Yes Product...

XSS in Horde Application Framework <=3.3.8, icon_browser.php

Hi, Horde Application Framework v3.3.8 and lower are subject to a cross site scripting XSS vulnerability. The iconbrowser.php script fails to properly sanitize user supplied input to the 'subdir' URL parameter before printing it out as part of a HTML formatted error message. The following URL can...

Horde Application Framework 3.3.8 Cross Site Scripting

Hi, Horde Application Framework v3.3.8 and lower are subject to a cross site scripting XSS vulnerability. The iconbrowser.php script fails to properly sanitize user supplied input to the 'subdir' URL parameter before printing it out as part of a HTML formatted error message. The following URL can...

ACROS Security: Remote Binary Planting in Apple iTunes for Windows (ASPR #2010-08-18-1)

=====BEGIN-ACROS-REPORT===== PUBLIC ========================================================================= ACROS Security Problem Report 2010-08-18-1 ------------------------------------------------------------------------- ASPR 2010-08-18-1: Remote Binary Planting in Apple iTunes for Windows...

Insecure secure cookie in Tornado

BLUE MOON SECURITY ADVISORY 2010-01 =================================== :Title: Insecure secure cookie in Tornado :Severity: Low :Reporter: Blue Moon Consulting :Products: Tornado v1.0 :Fixed in: Tornado v1.0.1 Description ----------- Tornado is an open source version of the scalable, non-blockin...

horde-base -- XSS and CSRF vulnerabilities

The Horde team reports: Thanks to Naumann IT Security Consulting for reporting the XSS vulnerability. Thanks to Secunia for releasing an advisory for the new CSRF protection in the preference interface The major changes compared to Horde version 3.3.8 are: Fixed XSS vulnerability in...

[DSECRG-09-039] Symantec Antivirus 10.0 ActiveX - buffer Overflow.

Digital Security Research Group DSecRG Advisory DSECRG-09-039 Application: Symantec Antivirus Client Proxy Versions Affected: Version 10 Vendor URL: http://symantec.com Bugs: Buffer Overflow Exploits: POC Reported: 04.05.2009 Vendor response: 07.05.2009 Date of Public Advisory: 17.02.2010...

Outsourcing Giant Tata Consulting's Domain Hacked

Top flight outsourcing firm Tata Consulting Services appeared to have lost control of its website to hackers today, with the domain apparently being touted for sale. Read the full article. The Register...

Windows Live Messenger 2009 Denial Of Service

Product: Windows Live Messenger 2009 Build 14.0.8089.726 Vulnerability: ActiveX - Denial of Service Discussion: Vulnerability is in Activex Controlmsgsc.14.0.8089.726.dll Sending a string to ViewProfile , cause a crash on msnmsgr.exe must be signed in Msn Messenger account for triggerin the...

Microsoft Windows Live Messenger 2009 - ActiveX Denial of Service

Product: Windows Live Messenger 2009 Build 14.0.8089.726 Vulnerability: ActiveX - Denial of Service Discussion: Vulnerability is in Activex Controlmsgsc.14.0.8089.726.dll Sending a string to ViewProfile , cause a crash on msnmsgr.exe must be signed in Msn Messenger account for triggerin the...

CVE-2009-4422

Multiple cross-site scripting XSS vulnerabilities in the GetURLArguments function in jpgraph.php in Aditus Consulting JpGraph 3.0.6 allow remote attackers to inject arbitrary web script or HTML via a key to csiminhtmlex1.php, and other unspecified vectors...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the GetURLArguments function in jpgraph.php in Aditus Consulting JpGraph 3.0.6 allow remote attackers to inject arbitrary web script or HTML via a key to csiminhtmlex1.php, and other unspecified vectors...

CVE-2009-4422

Multiple cross-site scripting XSS vulnerabilities in the GetURLArguments function in jpgraph.php in Aditus Consulting JpGraph 3.0.6 allow remote attackers to inject arbitrary web script or HTML via a key to csiminhtmlex1.php, and other unspecified vectors...

CVE-2009-4422

Multiple cross-site scripting XSS vulnerabilities in the GetURLArguments function in jpgraph.php in Aditus Consulting JpGraph 3.0.6 allow remote attackers to inject arbitrary web script or HTML via a key to csiminhtmlex1.php, and other unspecified vectors...

CVE-2009-4422

Multiple cross-site scripting XSS vulnerabilities in the GetURLArguments function in jpgraph.php in Aditus Consulting JpGraph 3.0.6 allow remote attackers to inject arbitrary web script or HTML via a key to csiminhtmlex1.php, and other unspecified vectors...

CVE-2009-4422

CVE-2009-4422 corresponds to multiple cross-site scripting (XSS) vulnerabilities in Aditus Consulting JpGraph 3.0.6, specifically in the GetURLArguments function inside jpgraph.php. The public description indicates remote attackers can inject arbitrary web script or HTML via a key to csim_in_html...

[BMSA-2009-08] Multiple Vulnerabilities in PyForum

BLUE MOON SECURITY ADVISORY 2009-08 =================================== :Title: Multiple Vulnerabilities in PyForum :Severity: Critical :Reporter: Hoang Quoc Thinh and Blue Moon Consulting :Products: PyForum v1.0.3 :Fixed in: -- Description ----------- PyForum is a 100 python-based message board...

Neo CMS SQL Injection vulnerability

---------------------------------------------------------------------- PT-2009-36 Positive Technologies Security Advisory Neo CMS SQL Injection vulnerability ---------------------------------------------------------------------- --- Affected Software Neo CMS Versions up to 1.777 Product Link:...

HP LaserJet Printers - Multiple Persistent Cross-Site Scripting Vulnerabilities

Digital Security Research Group DSecRG Advisory DSECRG-09-048 http://dsecrg.ru/pages/vul/show.php?id=148 Application: HP LaserJet printer web interface Vulnerable: HP LaserJet 2200, 4350, 4600, 5500, and many others Vendor URL: http://www.hp.com/ Bug: Multiple Stored XSS Vulnerabilities Exploits:...

HP LaserJet printers - 存储型xss

No description provided by source. Digital Security Research Group DSecRG Advisory DSECRG-09-048 http://dsecrg.ru/pages/vul/show.php?id=148 Application: HP LaserJet printer web interface Vulnerable: HP LaserJet 2200, 4350, 4600, 5500, and many others Vendor URL: http://www.hp.com/ Bug: Multiple...