ZDI-09-052: CA Unicenter Software Delivery dtscore.dll Stack Overflow Vulnerability

ZDI-09-052: CA Unicenter Software Delivery dtscore.dll Stack Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-052 August 7, 2009 -- Affected Vendors: Computer Associates -- Affected Products: Computer Associates Unicenter Software Delivery -- TippingPointTM IPS Customer...

Generic Emailer (SMTP)

This module can be used to automate email delivery. This code is based on Joshua Abraham's email script for social engineering. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'yaml' class MetasploitModule...

Online crime complaints hit record high in 2008

The FBI’s Internet Crime Complaint Center IC3 says complaints of online crime hit a record high in 2008, driven mostly by non-delivery of goods and service and those pesky 419 Nigerian e-mail scams. Accordign to a new report PDF from ic3.gov, the center received a a total of 275,284 complaints, a...

imap security update

CentOS Errata and Security Advisory CESA-2009:0275 Updated imap packages to fix a security issue are now available for Red Hat Enterprise Linux 3. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The imap package provides server daemons for both...

Privilege escalation via PR_SET_PDEATHSIG

Linux kernel 2.4.35 and other versions allows local users to send arbitrary signals to a child process that is running at higher privileges by causing a setuid-root parent process to die, which delivers an attacker-controlled parent process death signal PRSETPDEATHSIG...

dmail / tmail MDA buffer overflow

Buffer overflow in mail delivery foder argument...

[SECURITY] Fedora 8 Update: rubygem-actionmailer-2.1.1-1.fc8

Makes it trivial to test and deliver emails sent from a single service laye r...

CVE-2008-3646

The Postfix configuration file in Mac OS X 10.5.5 causes Postfix to be network-accessible when mail is sent from a local command-line tool, which allows remote attackers to send mail to local Mac OS X users...

[OPENX-SA-2008-002] OpenX 2.4.9 and 2.6.2 fix SQL injection vulnerability

======================================================================== OpenX security advisory OPENX-SA-2008-002 ------------------------------------------------------------------------ Advisory ID: OPENX-SA-2008-002 Date: 2008-Oct-06 Security risk: Moderately critical Applications affetced:...

CVE-2008-4393

CVE-2008-4393 affects VeriSign Kontiki Delivery Management System (DMS) 5.0 and earlier. The vulnerability is an XSS in which an attacker can inject arbitrary script via the action parameter to zodiac/servlet/zodiac, enabling remote script execution in the victim’s browser. The issue stems from u...

verisign-xss.txt

VeriSign Kontiki Delivery Management System DMS Cross-Site Scripting Vulnerability CVE Number: CVE-2008-4393 Vulnerability Type / Importance: XSS / Medium Problem discovered: September 24th 2007 Vendor contacted: September 26th 2007 Advisory published: March 28th 2008 Abstract The Kontiki Deliver...

VeriSign Kontiki Delivery Management System 5.0 - action Cross-Site Scripting

VeriSign Kontiki Delivery Management System 5.0 - action Cross-Site Scripting source: https://www.securityfocus.com/bid/31580/info Kontiki Delivery Management System is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may...

VeriSign Kontiki Delivery Management System 5.0 - 'action' Cross-Site Scripting

source: https://www.securityfocus.com/bid/31580/info Kontiki Delivery Management System is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an...

[SECURITY] Fedora 9 Update: rubygem-actionmailer-2.1.1-1.fc9

Makes it trivial to test and deliver emails sent from a single service laye r...

PoCfix (PoC for Postfix local root vuln - CVE-2008-2936)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, The recent vulnerability in Postfix discovered by Sebastian Krahmer is trivially exploitable when certain preconditions are met. Nevertheless, it's very difficult to find such conditions in a real-world scenario. I wrote this exploit for fun an...

DSA-1629-2 postfix - privilege escalation

Bulletin has no description...

CVE-2008-2937

Postfix 2.5 before 2.5.4 and 2.6 before 2.6-20080814 delivers to a mailbox file even when this file is not owned by the recipient, which allows local users to read e-mail messages by creating a mailbox file corresponding to another user's account name...

GLSA-200808-12 : Postfix: Local privilege escalation vulnerability

The remote host is affected by the vulnerability described in GLSA-200808-12 Postfix: Local privilege escalation vulnerability Sebastian Krahmer of SuSE has found that Postfix allows to deliver mail to root-owned symlinks in an insecure manner under certain conditions. Normally, Postfix does not...

Postfix: Local privilege escalation vulnerability

Background Postfix is Wietse Venema's mailer that attempts to be fast, easy to administer, and secure, as an alternative to the widely-used Sendmail program. Description Sebastian Krahmer of SuSE has found that Postfix allows to deliver mail to root-owned symlinks in an insecure manner under...

CA Products That Embed Ingres Multiple Vulnerabilities

Title: CA Products That Embed Ingres Multiple Vulnerabilities CA Advisory Date: 2008-08-01 Reported By: iDefense Labs Impact: A remote attacker can execute arbitrary code, gain privileges, or cause a denial of service condition. Summary: CA products that embed Ingres contain multiple...