Charlie Miller on Mac Security, Pwn2Own and Selling Vulnerabilities

Dennis Fisher talks with Charlie Miller of Independent Security Evaluators about Mac OS X security, winning the Pwn2Own contest again and the real market for selling vulnerabilities. Read Miller’s paper on selling 0-day vulnerabilities .pdf. Download Subscribe to the Digital Underground podcast o...

SuSE Security Advisory SUSE-SA:2009:022 (MozillaFirefox)

The remote host is missing updates announced in advisory SUSE-SA:2009:022. OpenVAS Vulnerability Test $Id: susesa2009022.nasl 6668 2017-07-11 13:34:29Z cfischer $ Description: Auto-generated from advisory SUSE-SA:2009:022 MozillaFirefox Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft In...

Pwn2Own hacker: Safari is 'easy pickings'

Charlie Miller right, the security researcher who won last year’s Pwn2Own hacker contest, is predicting that Apple’s Safari browser will be the easiest target this year. In a note posted on the popular Daily Dave mailing list, Miller describes Safari as “easy pickin’s” and forecasts that at least...

Google wants to buy Native Client security flaws

Google is indirectly buying security vulnerabilities from the security research community. Under the guise of a Native Client Security Contest, the search engine firm is offering big cash prizes to hackers who find bugs and other security flaws in the open-source research technology for running x...

Pwn2Own 2009: Browsers and smart phones are targets

TippingPoint’s Zero Day Initiative has released the rules for this year’s CanSecWest PWN2OWN contest, which will target unpatched flaws in Web browsers and mobile devices. Among the target list this year: Microsoft’s Internet Explorer 8, Apple’s Safari, Google’s Chrome, Windows Mobile, Google...

25 dMx READY Products Database Disclosure

! ! ! OOOO O OOOOOOOOO ! ! O O O O O ! ! O O O ! ! O OOOO OOOO OOOOOO OOOO OOO OO O OOOO OO OO OOOO ! ! O OOO OOO O O O O OO O O O O OO O O O ! ! O OO OO O O OOOOOO O O O O O O OOOOOO ! ! O O OOOO O O O O O O O O O O O ! ! OOOO OO OOOOOO OOOO OOOOOO OOOOOOOOO OOOO OOO OOO OOOO ! ! OO ! ! OO ! ! O...

Sql injection

SQL injection vulnerability in checkvote.php in Weekly Drawing Contest 0.0.1 allows remote attackers to execute arbitrary SQL commands via the order parameter...

CVE-2007-1603

admin/contest.php in Weekly Drawing Contest 0.0.1 allows remote attackers to bypass authentication, and insert new contest information into a database, via a direct POST request...

Directory traversal

Directory traversal vulnerability in checkvote.php in Weekly Drawing Contest 0.0.1 allows remote attackers to read arbitrary files via a .. dot dot in the order parameter. NOTE: another researcher disputes this vulnerability, noting that the order variable is not used in any context that allows...

CVE-2007-1601

Directory traversal vulnerability in checkvote.php in Weekly Drawing Contest 0.0.1 allows remote attackers to read arbitrary files via a .. dot dot in the order parameter. NOTE: another researcher disputes this vulnerability, noting that the order variable is not used in any context that allows...

CVE-2007-1602

The CVE-2007-1602 entry describes an SQL injection vulnerability in check_vote.php of Weekly Drawing Contest 0.0.1. The vulnerability allows remote attackers to craft a request using the order parameter to execute arbitrary SQL commands, potentially compromising data confidentiality and integrity...

CVE-2007-1603

CVE-2007-1603 describes an authentication bypass in admin/contest.php of the Weekly Drawing Contest 0.0.1, enabling remote attackers to bypass login and insert new contest information via a direct POST request. The CVSS vector (AV:N/AC:L/Au:N/C:P/I:P/A:P) yields a base score of 7.5 (HIGH), indica...

CVE-2007-1601

The CVE-2007-1601 entry concerns a directory traversal in Weekly Drawing Contest 0.0.1, where check_vote.php allegedly allows remote attackers to read arbitrary files via .. in the order parameter. The description also notes that another researcher disputes this vulnerability, stating that the or...

CVE-2007-1601

Directory traversal vulnerability in checkvote.php in Weekly Drawing Contest 0.0.1 allows remote attackers to read arbitrary files via a .. dot dot in the order parameter. NOTE: another researcher disputes this vulnerability, noting that the order variable is not used in any context that allows...

CVE-2007-1602

SQL injection vulnerability in checkvote.php in Weekly Drawing Contest 0.0.1 allows remote attackers to execute arbitrary SQL commands via the order parameter...

PT-2007-2983 · Unknown · Weekly Drawing Contest

Name of the Vulnerable Software and Affected Versions: Weekly Drawing Contest version 0.0.1 Description: The issue allows remote attackers to potentially read arbitrary files via a .. dot dot in the order parameter in the check vote.php file. However, it is noted that another researcher disputes...

wdc-lfi.txt

+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= Weekly Drawing Contest = checkvote.php Remote File Disclosure Vuln Script: Weekly Drawing Contest Version: 0.0.1 S!Te: http://www.hotscripts.com/jump.php?listingid=52638&jumptype=1 Discover: BorN To K!LL...

Weekly Drawing Contest 0.0.1 - 'Check_Vote.php' Local File Inclusion

source: https://www.securityfocus.com/bid/22937/info Weekly Drawing Contest is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. Exploiting this issue may allow an unauthorized user to view local files on the affected webserver. This issue...

Weekly Drawing Contest <= (check_vote.php) Remote File Disclosure Vuln

+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= Weekly Drawing Contest = checkvote.php Remote File Disclosure Vuln Script: Weekly Drawing Contest Version: 0.0.1 S!Te: http://www.hotscripts.com/jump.php?listingid=52638&jumptype=1 Discover: BorN To K!LL...