Economy, SMB security to dominate at RSA Conference

As a security show, the RSA Conference leaves a lot to be desired. Its technical sessions carry an uncomfortable load of marketing baggage and don’t have either the cachet or entertaining edge of those at Black Hat or CanSecWest. Anyone will tell you that the real business of RSA is happening off...

Verizon Data Breach Report Reveals Depth of Breach Problem

Last night, the fine folks at Verizon posted the 2009 version of the DBIR. I haven’t had time to do a full deep dive yet, but I thought I’d share my initial notes in the meantime. Stuff in italics is from the DBIR, regular text is me: 81 percent of organizations subject to PCI DSS had not been...

ablespace 1.0 - Cross-Site Scripting / Blind SQL Injection

riginal advisory: http://dsecrg.com/pages/vul/show.php?id=137 Digital Security Research Group DSecRG Advisory DSECRG-09-037 Application: AbleSpace Versions Affected: 1.0 Vendor URL: http://abk-soft.com/ Bugs: Multiple Blind SQL Injections, Multiple XSS Exploits: YES Reported: 18.03.2009 Vendor...

AbleSpace 1.0 (XSS/BSQL) Multiple Remote Vulnerabilities

No description provided by source. riginal advisory: http://dsecrg.com/pages/vul/show.php?id=137 Digital Security Research Group DSecRG Advisory DSECRG-09-037 Application: AbleSpace Versions Affected: 1.0 Vendor URL: http://abk-soft.com/ Bugs: Multiple Blind SQL Injections, Multiple XSS Exploits:...

Synactis All_IN_THE_BOX ActiveX 3.0 - Null Byte File Overwrite

Digital Security Research Group DSecRG Advisory DSECRG-09-006 http://www.dsecrg.com/pages/vul/show.php?id=62 Application: Synactis AllINTHEBOX ActiveX Versions Affected: 3 Vendor URL: http://synactis.com Bugs: Null byte File overwriting Exploits: YES Reported: 15.01.2009 Vendor response: NONE...

Synactic ALL_IN_THE_BOX File Overwrite

DSECRG-09-006 Synactis AllINTHEBOX ActiveX Control - Null byte File Owervrite Synactis AllINTHEBOX ActiveX Control ALLINTHEBOX.OCX can be used to owervrite any any file in target system. Vulnerable method is "SaveDoc" Application: Synactis AllINTHEBOX ActiveX Versions Affected: 3 Vendor URL:...

Pixie CMS 1.0 Local File Inclusion

Digital Security Research Group DSecRG Advisory DSECRG-09-005 Application: Pixie CMS Versions Affected: 1.0 Vendor URL: http://www.getpixie.co.uk/ Bug: Multiple Local File Include Exploits: YES Reported: 29.08.2008 Vendor Response: 30.08.2008 Solution: NONE Date of Public Advisory: 27.01.2009...

Pixie CMS 1.0 - Multiple Local File Inclusions

Pixie CMS 1.0 - Multiple Local File Inclusions Digital Security Research Group DSecRG Advisory DSECRG-09-005 Application: Pixie CMS Versions Affected: 1.0 Vendor URL: http://www.getpixie.co.uk/ Bug: Multiple Local File Include Exploits: YES Reported: 29.08.2008 Vendor Response: 30.08.2008 Solutio...

Pixie CMS 1.0 Multiple Local File Inclusion Vulnerabilities

Exploit for unknown platform in category web applications =========================================================== Pixie CMS 1.0 Multiple Local File Inclusion Vulnerabilities =========================================================== Digital Security Research Group DSecRG Advisory DSECRG-09-0...

Digital Security Research Group [DSecRG] Advisory #DSECRG-09-001

Digital Security Research Group DSecRG Advisory DSECRG-09-001 Application: Oracle Application Server SOA Versions Affected: Oracle Application Server SOA version 10.1.3.1.0 Vendor URL: http://www.oracle.com Bugs: XSS Exploits: YES Reported: 10.01.2008 Vendor response: 11.01.2008 Date of Public...

Oracle Application Server Cross Site Scripting

Digital Security Research Group DSecRG Advisory DSECRG-09-001 Application: Oracle Application Server SOA Versions Affected: Oracle Application Server SOA version 10.1.3.1.0 Vendor URL: http://www.oracle.com Bugs: XSS Exploits: YES Reported: 10.01.2008 Vendor response: 11.01.2008 Date of Public...

[DSECRG-08-041] Stored XSS Vulnerability in Xoops 2.3.x

Digital Security Research Group DSecRG Advisory DSECRG-08-041 Application: XOOPS Versions Affected: 2.3.1, 2.3.2a Vendor URL: http://www.xoops.org/ Bug: Stored XSS Exploits: YES Reported: 10.11.2008 Vendor response: 10.11.2008 Solution: YES Date of Public Advisory: 08.12.2008 Authors: Digital...

[DSECRG-08-040] Multiple Local File Include Vulnerabilities in Xoops 2.3.x

Digital Security Research Group DSecRG Advisory DSECRG-08-040 Application: XOOPS Versions Affected: 2.3.1 Vendor URL: http://www.xoops.org/ Bug: Multiple Local File Include Exploits: YES Reported: 10.11.2008 Vendor response: 10.11.2008 Solution: YES Date of Public Advisory: 08.12.2008 Authors:...

XOOPS 2.3.1 Multiple Local File Inclusion Vulnerabilities

No description provided by source. Digital Security Research Group DSecRG Advisory DSECRG-08-040 Application: XOOPS Versions Affected: 2.3.1 Vendor URL: http://www.xoops.org/ Bug: Multiple Local File Include Exploits: YES Reported: 10.11.2008 Vendor response: 10.11.2008 Solution: YES Date of Publ...

XOOPS 2.3.1/2.3.2a Cross Site Scripting

Digital Security Research Group DSecRG Advisory DSECRG-08-041 Application: XOOPS Versions Affected: 2.3.1, 2.3.2a Vendor URL: http://www.xoops.org/ Bug: Stored XSS Exploits: YES Reported: 10.11.2008 Vendor response: 10.11.2008 Solution: YES Date of Public Advisory: 08.12.2008 Authors: Digital...

XOOPS 2.3.1 Multiple Local File Inclusion Vulnerabilities

Exploit for unknown platform in category web applications ========================================================= XOOPS 2.3.1 Multiple Local File Inclusion Vulnerabilities ========================================================= Digital Security Research Group DSecRG Advisory DSECRG-08-040...

XOOPS 2.3.1 - Multiple Local File Inclusions

Digital Security Research Group DSecRG Advisory DSECRG-08-040 Application: XOOPS Versions Affected: 2.3.1 Vendor URL: http://www.xoops.org/ Bug: Multiple Local File Include Exploits: YES Reported: 10.11.2008 Vendor response: 10.11.2008 Solution: YES Date of Public Advisory: 08.12.2008 Authors:...

Pluck CMS 4.5.3 (g_pcltar_lib_dir) Local File Inclusion Vulnerability

No description provided by source. Hello, bugtraq. Digital Security Research Group DSecRG Advisory DSECRG-08-039 Application: Pluck CMS Versions Affected: 4.5.3 Vendor URL: http://www.pluck-cms.org/ Bug: Local File Include Exploits: YES Reported: 25.08.2008 Vendor Response: 30.08.2008 Solution: Y...

[DSECRG-08-039] Local File Include Vulnerability in Pluck CMS 4.5.3

Hello, bugtraq. Digital Security Research Group DSecRG Advisory DSECRG-08-039 Application: Pluck CMS Versions Affected: 4.5.3 Vendor URL: http://www.pluck-cms.org/ Bug: Local File Include Exploits: YES Reported: 25.08.2008 Vendor Response: 30.08.2008 Solution: YES Date of Public Advisory:...

Pluck CMS 4.5.3 - 'g_pcltar_lib_dir' Local File Inclusion

Hello, bugtraq. Digital Security Research Group DSecRG Advisory DSECRG-08-039 Application: Pluck CMS Versions Affected: 4.5.3 Vendor URL: http://www.pluck-cms.org/ Bug: Local File Include Exploits: YES Reported: 25.08.2008 Vendor Response: 30.08.2008 Solution: YES Date of Public Advisory:...