[MajorSecurity SA-074]CMS RedAks 2.0 - Multiple Cross-site Scripting issues

MajorSecurity SA-074CMS RedAks 2.0 - Multiple Cross-site Scripting issues Details ============= Product: CMS RedAks 2.0 Security-Risk: moderated Remote-Exploit: yes Vendor-URL: http://www.redaks.com/ Advisory-Status: published Credits ============= Discovered by: David Vieira-Kurz of MajorSecurit...

CMS RedAks 2.0 - Multiple Cross-site Scripting issues

Exploit for php platform in category web applications ===================================================== CMS RedAks 2.0 - Multiple Cross-site Scripting issues ===================================================== Details ============= Product: CMS RedAks 2.0 Security-Risk: moderated...

CMS RedAks 2.0 - SQL Injection vulnerability

Exploit for php platform in category web applications ============================================ CMS RedAks 2.0 - SQL Injection vulnerability ============================================ Details ============= Product: CMS RedAks v.2.0 Security-Risk: high Remote-Exploit: yes Vendor-URL:...

Compliance Tests

This script controls various compliance tests like IT-Grundschutz. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[DSECRG-09-064] SAP GUI - Insecure method, code execution

Digital Security Research Group DSecRG Advisory DSECRG-09-064 Application: SAP GUI Versions Affected: SAP GUI SAP GUI 7.1 Vendor URL: http://SAP.com Bugs: Insecure method. Code Execution. Exploits: YES Reported: 16.10.2009 Vendor response: 27.10.2009 Date of Public Advisory: 23.03.2010 Author:...

[DSECRG-09-039] Symantec Antivirus 10.0 ActiveX - buffer Overflow.

Digital Security Research Group DSecRG Advisory DSECRG-09-039 Application: Symantec Antivirus Client Proxy Versions Affected: Version 10 Vendor URL: http://symantec.com Bugs: Buffer Overflow Exploits: POC Reported: 04.05.2009 Vendor response: 07.05.2009 Date of Public Advisory: 17.02.2010...

TVUPlayer 2.4.9beta1 Active-X Insecure Method

DSECRG-09-065 TuvNetworks TVUPlayer ActiveX component - Insecure method TVUPlayer contains ActiveX component PlayerOcx which contains insecure method that can overwrite any unhidden file in the system. Application: TVUPlayer Versions Affected: Tested on v2.4.9beta1build1797 Vendor URL:...

[DSECRG-09-065] TVUPlayer PlayerOcx.ocx ActiveX - Insecure method

ActiveX component contains insecure method that can overwrite any file in system Digital Security Research Group DSecRG Advisory DSECRG-09-065 Application: TVUPlayer Versions Affected: Tested on v2.4.9beta1build1797 Vendor URL: www.tvunetworks.com Bugs: insecure method, File overwriting Exploits:...

[DSECRG-09-048] HP LaserJet printers - Multiple Stored XSS vulnerabilities

Digital Security Research Group DSecRG Advisory DSECRG-09-048 http://dsecrg.ru/pages/vul/show.php?id=148 Application: HP LaserJet printer web interface Vulnerable: HP LaserJet 2200, 4350, 4600, 5500, and many others Vendor URL: http://www.hp.com/ Bug: Multiple Stored XSS Vulnerabilities Exploits:...

HP LaserJet Printers - Multiple Persistent Cross-Site Scripting Vulnerabilities

Digital Security Research Group DSecRG Advisory DSECRG-09-048 http://dsecrg.ru/pages/vul/show.php?id=148 Application: HP LaserJet printer web interface Vulnerable: HP LaserJet 2200, 4350, 4600, 5500, and many others Vendor URL: http://www.hp.com/ Bug: Multiple Stored XSS Vulnerabilities Exploits:...

HP LaserJet printers - 存储型xss

No description provided by source. Digital Security Research Group DSecRG Advisory DSECRG-09-048 http://dsecrg.ru/pages/vul/show.php?id=148 Application: HP LaserJet printer web interface Vulnerable: HP LaserJet 2200, 4350, 4600, 5500, and many others Vendor URL: http://www.hp.com/ Bug: Multiple...

Chris Hoff on Cloud Security, Disruptive Technologies and PCI DSS

Dennis Fisher talks with Chris Hoff of Cisco about the challenges of cloud deployment and security, cloud use cases and the effect that disruptive technologies can have on enterprises, vendors and standards organizations. Download Subscribe to the Digital Underground podcast on Podcast audio...

(edited) [DSECRG-09-044] SAP GUI 7.1 Insecure Methods

Digital Security Research Group DSecRG Advisory DSECRG-09-044 Application: EnjoySAP, SAP GUI for Windows 6.4 and 7.1 Versions Affected: Tested on 7100.2.7.1038 PL 7 Vendor URL: http://SAP.com Bugs: insecure method, File owervriting Exploits: YES Reported: 02.07.2009 Vendor response: 02.07.2009 Da...

[DSECRG-09-055] OSSIM 2.1 - Multiple security vulnerabilities

OSSIM - Open Source Security Information Management is vulnerable to multiple security vulnerabilities. 1. SQL Injections 2. Linked XSS 3. Unauthorized access Digital Security Research Group DSecRG Advisory DSECRG-09-055 Application: OSSIM Versions Affected: 2.1 and may be 2.1.1 Vendor URL:...

Adobe JRun 4 - logfile (Authenticated) Directory Traversal

Adobe JRun 4 - logfile Authenticated Directory Traversal Digital Security Research Group DSecRG Advisory DSECRG-09-052 Application: Adobe JRun Application Server Versions Affected: 4 updater 7 Vendor URL: http://www.adobe.com/products/jrun/ Bug: Directory Traversal File Read Exploits: YES Reporte...

An Open Letter to Heartland CEO Robert Carr

Mr. Carr, I read your interview with Bill Brenner in CSO magazine today, and I sympathize with your situation. I completely agree that the current system of standards and audits contained in the Payment Card Industry Data Security Standard is flawed and unreliable as a breach-prevention mechanism...

PCI DSS compliance : options settings

This plugin reports the values of a few important scan settings if PCI DSS compliance checks are enabled. These scan settings are preset based on the scan template you have selected, but in some cases may be overriden. C Tenable Network Security, Inc. include"compat.inc"; ifdescription...

SAP GUI 6.4 - ActiveX (Accept) Remote Buffer Overflow (PoC)

Digital Security Research Group DSecRG Advisory DSECRG-09-015 Original Advisory: http://dsecrg.com/pages/vul/show.php?id=115 Application: SAP GUI for Windows, EnjoySAP Versions Affected: Version 6.4 Vendor URL: http://SAP.com Bugs: Buffer Overflow Exploits: YES Reported: 13.11.2008 Vendor respons...

Armorlogic Profense Web Application Firewall 2.4 multiple vulnerabilities.

Armorlogic Profense Web Application Firewall 2.4 multiple vulnerabilities. An advisory by EnableSecurity. Trustwave published a joint advisory named TWSL2009-001 ID: ES-20090500 Advisory URL: http://resources.enablesecurity.com/advisories/ES-20090500-profense.txt Affected Versions: versions prior...

The 5 claims of PCI DSS snake oil salesmen

The Payment Card Industry Data Security Standard PCI DSS is fast becoming the de facto standard for securing critical infrastructure across many industries. This is because a large number of businesses much larger than originally envisioned process credit cards and are, therefore, required to be...