CVE-2011-4870

Multiple buffer overflows in the 1 GUIControls, 2 BatchObjSrv, and 3 BatchSecCtrl ActiveX controls in Invensys Wonderware InBatch 9.0 and 9.0 SP1, and InBatch 8.1 SP1, 9.0 SP2, and 9.5 Server and Runtime Clients, allow remote attackers to execute arbitrary code via a long string in a property...

CVE-2011-4870

CVE-2011-4870 covers multiple buffer overflows in Invensys Wonderware InBatch, specifically the GUIControls, BatchObjSrv, and BatchSecCtrl ActiveX controls. Affected versions include InBatch 8.1 SP1, 9.0, 9.0 SP1, 9.0 SP2, and 9.5 Server/Runtime Clients; the root cause is improper handling of lon...

VulnCheck KEV: CVE-2012-0158

Microsoft MSCOMCTL.OCX contains an unspecified vulnerability that allows for remote code execution, allowing an attacker to take complete control of an affected system under the context of the current user...

UBUNTU-CVE-2011-4600

The networkReloadIptablesRules function in network/bridgedriver.c in libvirt before 0.9.9 does not properly handle firewall rules on bridge networks when libvirtd is restarted, which might allow remote attackers to bypass intended access restrictions via a 1 DNS or 2 DHCP query...

SASHA v0.2.0 Mutiple XSS

Exploit Title: SASHA v0.2.0 Mutiple XSS Date: 12/16/11 Author: G13 Software Link: http://sourceforge.net/projects/sasha/files/ Version: 0.2.0 Category: webapps php Vulnerability When adding a new course to the schedule, the application relies on Client Side controls for input. This can easily be...

SASHA 0.2.0 Cross Site Scripting

Exploit Title: SASHA v0.2.0 Mutiple XSS Date: 12/16/11 Author: G13 Software Link: http://sourceforge.net/projects/sasha/files/ Version: 0.2.0 Category: webapps php Vulnerability When adding a new course to the schedule, the application relies on Client Side controls for input. This can easily be...

What is Your Risk Assessment Worth?

A risk assessment provides your organization with a tool to determine how, where and how much to invest in controls and security over technology. It also serves to document the risk acceptance policy of your organization as the acceptable level of risk dictates the level of controls to be...

JavaScript Switcharoo Proof Of Concept

/ Another whimsical browser proof-of-concept: http://lcamtuf.coredump.cx/switch/ It seems that relatively few people realize that holding a JavaScript handle to another window either because we opened it, or because the window was at some point displaying our content allows the attacker to tamper...

Internet Explorer Unsafe Scripting Misconfiguration Code Execution

A remote code execution vulnerability has been reported in Internet Explorer. The vulnerability is due to improper configuration of the way Internet Explorer handles ActiveX controls. A remote attacker may exploit this vulnerability by enticing a target user to open a specially crafted web page...

Microsoft IE虚拟函数表格内存破坏漏洞(MS11-081)

BUGTRAQ ID: 49966 CVE ID: CVE-2011-2001 Microsoft Internet Explorer简称MSIE，是微软公司推出的一款网页浏览器。 IE在处理虚拟函数表格时在实现上存在内存破坏漏洞，远程攻击者可利用此漏洞远程代码，导致拒绝服务或执行任意指令。 攻击者可以保存使用IE利用漏洞的特制网站，然后诱使用户查看该网站。也可在应用或保存了IE渲染引擎的Office文档中嵌入ActiveX控件。然后利用受控站点存储或接受用户内容或广告，诱使用户点击电子邮件或即时消息的链接转到攻击者网站。 Microsoft Internet Explorer 9.x...

Parental Controls, 2.0, 3.0

It wasn’t until the second iteration of iOS that Apple got serious about what happens when children get their hands on their parents’ phones. With 2.0, parents were given the ability to block certain functions on their child’s handset including Safari, YouTube and whether or not anything could be...

Microsoft Office Web Components Arbitrary Code Execution (CVE-2009-1136)

A code execution vulnerability has been reported in Microsoft office web components. The vulnerability is due to insecure design of certain methods within ActiveX controls. A remote attacker may exploit this vulnerability by enticing a target user to open a malicious web-page. Successful...

DEBIAN-CVE-2010-4340

libcloud before 0.4.1 does not verify SSL certificates for HTTPS connections, which allows remote attackers to spoof certificates and bypass intended access restrictions via a man-in-the-middle MITM attack...

20 Major Sites Cross Site Scripting

Most of the biggest and Famous sites are found to be Vulnerable to XSS attack . Cross-site scripting XSS is a type of computer security vulnerability typically found in web applications which allow code injection by malicious web users into the web pages viewed by other users. Examples of such co...

McAfee SaaS Endpoint Protection ActiveX Controls Multiple Code Execution Vulnerabilities

McAfee SaaS Endpoint Protection is prone to multiple code execution vulnerabilities. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Feeling Heat Facebook Adds Google+ Like Privacy Controls

History has taught us that monopolies are bad for consumers. It was true in the first decades of the 20th century with Standard Oil, and in the final decade of the same century with Microsoft. Its been true, in recent years, with social networking behemoth, Facebook, also. But now, with Google’s...

Open Classifieds 1.7.2 Cross Site Scripting

-------------------------------------------------------------------- + Title : Open classifieds 1.7.2 Xss Vulnerability + Name : Open classifieds + Affected Version : v1.7.2 + Software Link : http://open-classifieds.com/ + Tested on : Vista & Windows Xp and Windows 7 + Date : 23/08/2011 + Dork :...

TeeChart Professional ActiveX Control 2010.0.0.3 Trusted Integer Dereference

$Id: teechartpro.rb 13554 2011-08-13 02:05:08Z sinn3r $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...

Microsoft .NET Framework Chart Control Information Disclosure Vulnerability (2567943)

This host is missing an important security update according to Microsoft Bulletin MS11-066. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2011-1977

The ASP.NET Chart controls in Microsoft .NET Framework 4, and Chart Control for Microsoft .NET Framework 3.5 SP1, do not properly verify functions in URIs, which allows remote attackers to read arbitrary files via special characters in a URI in an HTTP request, aka "Chart Control Information...