WordPress Plugin IWantOneButton 3.0.1 - Multiple Vulnerabilities

Vulnerability ID: HTB22846 Reference: http://www.htbridge.ch/advisory/sqlinjectioniniwantonebuttonwordpres splugin.html Product: IWantOneButton wordpress plugin Vendor: Daniel Sands http://www.danielsands.co.cc/ Vulnerable Version: 3.0.1 Vendor Notification: 10 February 2011 Vulnerability Type: S...

SWFUpload v2.5.0 Beta 3 File Arbitrary Upload

Exploit for php platform in category web applications Exploit Title: SWFUpload v2.5.0 Beta 3 File Arbitrary Upload Date: 07/02/2011 Author: Daniel Godoy Author Mail: DanielGodoyatGobiernoFederaldotcom Author Web: www.delincuentedigital.com.ar Software: SWFUpload v2.5.0 Beta 3 Software Link:...

comercioplus 5.6 - Multiple Vulnerabilities

Exploit Title: Comerciosonline CMS SQLi Google Dork: allintext: " Servicio ofrecido por ComerciosOnLine " Date: 27/01/2011 Author: Daniel Godoy Author Mail: DanielGodoyatGobiernoFederaldotcom Author Web: www.delincuentedigital.com.ar Software Link: http://www.comerciosonline.com/index.php?p=8...

Moderate: Red Hat Security Advisory: pidgin security update

Updated pidgin packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings...

SquirrelMail Virtual Keyboard 0.9.1 Cross Site Scripting

Hi, Squirrelmail plugin 'Virtual Keyboard' version 0.9.1 and lower is vulnerable to cross site scripting XSS. The vkeyboard.php script fails to sanitize the value of HTTP GET parameter 'passformname' which the script stores in a variable of the same name and outputs unmodified into a HTML documen...

Cisco ASA Software HTTP Response Splitting Vulnerability

Cisco ASA Software versions prior to 8.12 contain a vulnerability that could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks. The vulnerability exists due to improper handling of characters within URLs. An unauthenticated, remote attacker could exploit this...

Researchers Get Funding for New Secure Operating System

Researchers at the University of Illinois at Chicago have received a $1.15 million grant from the National Science Foundation to build a new computer operating system based on virtual machines and the concept of isolation. The new OS project, called Ethos, is the brainchild of UIC associate...

CA20100304-01: Security Notice for CA SiteMinder

CA20100304-01: Security Notice for CA SiteMinder Issued: March 04, 2010 CA's support is alerting customers to a security risk with CA SiteMinder. Multiple cross site scripting XSS vulnerabilities exist that can allow a remote attacker to potentially gain sensitive information. CA has provided...

Unfixed XSS vulnerability at servicios.personal.com.ar

Security researcher Daniel Godoy, has submitted on 03/01/2010 a cross-site-scripting XSS vulnerability affecting servicios.personal.com.ar, which at the time of submission ranked 6332 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 13/01/2012. ...

Unfixed XSS vulnerability at brasil.dineromail.com

Security researcher Daniel Godoy, has submitted on 02/01/2010 a cross-site-scripting XSS vulnerability affecting brasil.dineromail.com, which at the time of submission ranked 40792 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 24/06/2010. It ...

Unfixed XSS vulnerability at chile.dineromail.com

Security researcher Daniel Godoy, has submitted on 02/01/2010 a cross-site-scripting XSS vulnerability affecting chile.dineromail.com, which at the time of submission ranked 10401 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 21/12/2011. It i...

Unfixed XSS vulnerability at mexico.dineromail.com

Security researcher Daniel Godoy, has submitted on 02/01/2010 a cross-site-scripting XSS vulnerability affecting mexico.dineromail.com, which at the time of submission ranked 10401 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 21/12/2011. It ...

SharePoint Source Code Disclosure

======= Summary ======= Name: SharePoint Team Services source code disclosure through download facility Release Date: 21 October 2009 Reference: NGS00532 Discover: Daniel Martin Vendor: Microsoft Systems Affected: SharePoint 2007 12.0.0.6219, 12.0.0.4518 and possibly others Risk: Medium Status:...

SA-CONTRIB-2009-043 - Image Assist - Multiple vulnerabilities

The Image Assist module for Drupal 5.x and 6.x allows users to upload and insert inline images into posts. Two vulnerabilities and weaknesses were discovered in the contributed Image Assist module. Cross site scripting The node title is treated as if it was safe text, and is not escaped before...

DSA-1831-1 djbdns - privilege escalation

Bulletin has no description...

Vulnerability in OpenSSL CVE-2009-1377

Fix a denial of service flaw in the DTLS implementation. Records are buffered if they arrive with a future epoch to be processed after finishing the corresponding handshake. There is currently no limitation to this buffer allowing an attacker to perform a DOS attack to a DTLS server by sending...

Vulnerability in OpenSSL CVE-2009-1378

Fix a denial of service flaw in the DTLS implementation. In dtls1processoutofseqmessage the check if the current message is already buffered was missing. For every new message was memory allocated, allowing an attacker to perform an denial of service attack against a DTLS server by sending out of...

Vulnerability in OpenSSL CVE-2009-1379

Use-after-free vulnerability in the dtls1retrievebufferedfragment function could cause a client accessing a malicious DTLS server to crash...

CVE-2009-0858

The responseaddname function in response.c in Daniel J. Bernstein djbdns 1.05 and earlier does not constrain offsets in the required manner, which allows remote attackers, with control over a third-party subdomain served by tinydns and axfrdns, to trigger DNS responses containing arbitrary record...

Code injection

dnscache in Daniel J. Bernstein djbdns 1.05 does not prevent simultaneous identical outbound DNS queries, which makes it easier for remote attackers to spoof DNS responses, as demonstrated by a spoofed A record in the Additional section of a response to a Start of Authority SOA query...