OpenSSL SSLv2 - Malformed Client Key Remote Buffer Overflow Vulnerability (1)

No description provided by source. source: http://www.securityfocus.com/bid/5363/info A buffer-overflow vulnerability has been reported in some versions of OpenSSL. The issue occurs in the handling of the client key value during the negotiation of the SSLv2 protocol. A malicious client may be abl...

Evilsentinel <= 1.0.9 (multiple vulnerabilities) Disable Exploit

No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo ' Evilsentinel = 1.0.9 Disable Exploit by BlackHawk [email protected] http://itablackhawk.altervista.org Thanks to rgod for the php code and Marty for the Love '; if $argc3 echo Usage: php .$argv0. Host Path newmail...

Zero-Day TimThumb WebShot Vulnerability leaves Thousands of Wordpress Blogs at Risk

Yesterday we learned of a critical Zero-day vulnerability in a popular image resizing library called TimThumb, which is used in thousands WordPress themes and plugins. WordPress is a free and open source blogging tool and a content management system CMS with more than 30,000 plugins, each of whic...

PT-2014-2179 · D Link · D-Link Dir-601 Wireless N150 Home Router

Name of the Vulnerable Software and Affected Versions: D-Link DIR-601 Wireless N150 Home Router version 1.02NA Description: A directory traversal issue in the TFTP server of the affected router allows remote attackers to read arbitrary files. The exact vectors used for exploitation are not...

F5 ARX Data Manager contains a SQL injection vulnerability

Overview F5 ARX Data Manager 3.0.0 - 3.1.0 contains a SQL injection vulnerability. Description CWE-89: Improper Neutralization of Special Elements used in an SQL Command F5 ARX Data Manager 3.0.0 - 3.1.0 contains an unspecified SQL injection vulnerability. --- Impact A remote authenticated attack...

Juniper Networks Junos OS RDP Crash Vulnerability

RDP crash when receiving BGP UPDATE with malformed inetflow prefix. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:juniper:junos...

Windows Autologin Password Dumper & Manager v2.0

Windows Autologin Password is the free command-line tool to quickly dump and manage the Windows Automatic Logon Password. Automatic Logon is one of the useful feature in Windows which allows you to login to system automatically without entering the password everytime. This tool helps you to easil...

PT-2014-1882

Name of the Vulnerable Software and Affected Versions xmonad-contrib versions prior to 0.11.2 Description The issue allows remote attackers to execute arbitrary commands via a web page title. This can be achieved when the user clicks on the xmobar window title, as demonstrated using an action tag...

tomcat: session fixation still possible with disableURLRewriting enabled

It was found that previous fixes in Tomcat 6 to path parameter handling introduced a regression that caused Tomcat to not properly disable URL rewriting to track session IDs when the disableURLRewriting option was enabled. A man-in-the-middle attacker could potentially use this flaw to hijack a...

tomcat: session fixation still possible with disableURLRewriting enabled

It was found that previous fixes in Tomcat 6 to path parameter handling introduced a regression that caused Tomcat to not properly disable URL rewriting to track session IDs when the disableURLRewriting option was enabled. A man-in-the-middle attacker could potentially use this flaw to hijack a...

Dropbox Patches Shared Links Privacy Vulnerability

Dropbox has acknowledged and disabled a vulnerable shared links feature that exposed documents stored by the service to third parties. Shared links are a collaboration feature that allows user, especially in a business environment, to share and edit documents. Dropbox rival Intralinks reported th...

Juniper Networks Junos OS Web Filtering Denial of Service Vulnerability

Denial of Service Vulnerability when Enhanced Web Filtering is enabled. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

DEBIAN-CVE-2013-7273

GNOME Display Manager gdm 3.4.1 and earlier, when disable-user-list is set to true, allows local users to cause a denial of service unable to login by pressing the cancel button after entering a user name...

CVE-2013-7273

GNOME Display Manager gdm 3.4.1 and earlier, when disable-user-list is set to true, allows local users to cause a denial of service unable to login by pressing the cancel button after entering a user name...

CVE-2013-7273

GNOME Display Manager gdm 3.4.1 and earlier, when disable-user-list is set to true, allows local users to cause a denial of service unable to login by pressing the cancel button after entering a user name...

PT-2014-2087 · Blender +1 · Blender +1

Name of the Vulnerable Software and Affected Versions: Blender versions 2.5 through 2.63a Description: The undo save quit routine in the kernel in Blender allows local users to overwrite arbitrary files via a symlink attack on the quit.blend temporary file. This issue might be a regression of a...

StopTheHacker: CSRF - Disabling orders at https://panel.stopthehacker.com/manage/disable-order/order/ID

Hi there, there's a CSRF which would allow an attacker to disable an order. Host: https://panel.stopthehacker.com Steps to reproduce: - 1. Login to the panel. - 2. Subscribe/order a new scan - 3. Go to the Billing page and get the order ID - 4. Put the order id in the PoC below and submit it - 5...

Localize: OPTIONS Method Enabled

HTTP OPTIONS method is enabled on the web server of Localize. The OPTIONS method provides a list of the methods that are supported by the web server, it represents a request for information about the communication options available on the request/response chain identified by the Request-URI. This...

Localize: Password type input with auto-complete enabled

Vulnerability description When a new name and password is entered in a form and the form is submitted, the browser asks if the password should be saved. Thereafter when the form is displayed, the name and password are filled in automatically or are completed as the name is entered. An attacker wi...

UBUNTU-CVE-2014-2580

The netback driver in Xen, when using certain Linux versions that do not allow sleeping in softirq context, allows local guest administrators to cause a denial of service "scheduling while atomic" error and host crash via a malformed packet, which causes a mutex to be taken when trying to disable...