CVE-2003-1580

The Apache HTTP Server 2.0.44, when DNS resolution is enabled for client IP addresses, uses a logging format that does not identify whether a dotted quad represents an unresolved IP address, which allows remote attackers to spoof IP addresses via crafted DNS responses containing numerical top-lev...

How to Take Down a Botnet

The botnet problem has reached epidemic levels in recent months, with the continued growth of large-scale botnets, as well as the identification of smaller, more targeted networks around the world. But researchers have been taking steps to disrupt botnets of late, with some notable successes, as...

Enlightenment - Linux Null PTR Dereference Exploit Framework

No description provided by source. / enlightenment 200909092307 To create your own exploit module for enlightenment, just name it expwhatever.c It will be auto-compiled by the runexploits.sh script and thrown into the list of loaded exploit modules Each module must have the following features: It...

55,000 Hacked Sites Serving Malware Cocktail

Security researchers are raising an alarm for a potent malware cocktail — backdoor Trojans and password stealers — being pushed to Windows users from about 55,000 hacked Web sites. According to Mary Landesman, a researcher in ScanSafe’s security threat alert team, the cybercriminals have embedded...

American Airlines Local File Inclusion

American Airlines' domains have been vulnerable to Local file Include I wonder if anyone has flown free using this http://www.aa.com.do/aa/i18nForward.do?p=../../../../../../../../../../../../../../../../../../../../../../../etc/passwd...

The Microsoft MsVidCtl Video Control Flaw Explained

From Websense Security Labs The recently publicized Zero-Day Vulnerability in Microsoft DirectShow is in the wild and spreads through infection of thousands of legitimate Web sites. The proof-of-concept of the vulnerability is out and exploitation is very easy to achieve. In our labs we have been...

UPDATED: Mass Attacks Exploiting 0-Day in Microsoft Video DLL

There is a widespread attack underway against an unpatched vulnerability in the Msvidctl DLL, with attackers using thousands of newly compromised Web sites to exploit victims’ PCs via drive-by downloads. The attacks are using Internet Explorer as the attack vector and are pushing a Trojan...

tomcat XML parser information disclosure

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the 1 web.xml, 2 context.xml, or 3 tld files of arbitrary web applications via a crafted...

CVE-2009-2282

The Virtual Network Terminal Server daemon vntsd for Logical Domains aka LDoms in Sun Solaris 10, and OpenSolaris snv41 through snv108, on SPARC platforms does not check authorization for guest console access, which allows local control-domain users to gain guest-domain privileges via unknown...

Authorization

The Virtual Network Terminal Server daemon vntsd for Logical Domains aka LDoms in Sun Solaris 10, and OpenSolaris snv41 through snv108, on SPARC platforms does not check authorization for guest console access, which allows local control-domain users to gain guest-domain privileges via unknown...

CVE-2009-2282

The CVE-2009-2282 issue affects Sun Solaris 10 on SPARC and OpenSolaris snv_41–snv_108, where the Virtual Network Terminal Server daemon (vntsd) does not validate authorization for guest console access. This allows local control-domain users to obtain guest-domain privileges via unspecified vecto...

Faster Actions Needed Against Phishing Domains

From Netcraft Criminals often register their own domain name to perform phishing attacks. Unlike the other common phishing site scenarios including hacked servers, open redirects, and abuse of free webhosting, phishing sites that have their own domain name can be harder to remove, because the...

file: resources

Mozilla Firefox before 3.0.11 and SeaMonkey before 1.1.17 associate local documents with external domain names located after the file:// substring in a URL, which allows user-assisted remote attackers to read arbitrary cookies via a crafted HTML document, as demonstrated by a URL with...

SonicWALL Global VPN Client 4.0 - Log File Remote Format String

SonicWALL Global VPN Client 4.0 - Log File Remote Format String source: https://www.securityfocus.com/bid/35093/info SonicWALL Global VPN Client is prone to a remote format-string vulnerability because it fails to properly sanitize user-supplied input before passing it as the format specifier to ...

SonicWALL Global VPN Client 4.0 - Log File Remote Format String

source: https://www.securityfocus.com/bid/35093/info SonicWALL Global VPN Client is prone to a remote format-string vulnerability because it fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function. Successfully exploiting this issu...

Gumblar: The malware that is sweeping the nation

The latest large-scale malware outbreak to hit the Web, known variously as Gumblar and Geno and Martuz, is a multi-stage attack that not only infects compromised machines with a number of separate pieces of malware but also has the ability to steal credentials and block the victim from taking...

Solaris 10 (sparc) : 139397-02 (deprecated)

Logical Domains LDoms Manager 1.0.2 ldmd patch. Date this patch was last updated by Sun : Nov/11/08 This plugin has been deprecated and either replaced with individual 139397 patch-revision plugins, or deemed non-security related. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. @DEPRECATED@...

firefox: does not properly prevent the literal rendering of homoglyph characters in IDN domain names (spoof URLs and conduct phishing attacks)

The Internationalized Domain Names IDN blacklist in Mozilla Firefox 3.0.6 and other versions before 3.0.9; Thunderbird before 2.0.0.21; and SeaMonkey before 1.1.15 does not include box-drawing characters, which allows remote attackers to spoof URLs and conduct phishing attacks, as demonstrated by...

Ubuntu Update for firefox vulnerabilities USN-690-3

Ubuntu Update for Linux kernel vulnerabilities USN-690-3 OpenVAS Vulnerability Test $Id: gbubuntuUSN6903.nasl 7969 2017-12-01 09:23:16Z santu $ Ubuntu Update for firefox vulnerabilities USN-690-3 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH,...

Copyright 2008 Future US Cross Site Scripting

NULL CODE SERVICES www.nullcode.com.ar Hunting Security Bugs! +===================================================================================================================+ + Copyright 2008 - Copyright 2008 Future US //Cross-site scripting XSS Remote Java Execution +...