Unfixed XSS vulnerability at calendar.njit.edu

Security researcher SaMTHG, has submitted on 08/09/2008 a cross-site-scripting XSS vulnerability affecting calendar.njit.edu, which at the time of submission ranked 16724 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 22/09/2008. It is current...

Unfixed XSS vulnerability at www.fantasyworld.pl

Security researcher pouyaserver, has submitted on 08/05/2008 a cross-site-scripting XSS vulnerability affecting www.fantasyworld.pl, which at the time of submission ranked 142322 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 08/06/2008. It is...

iDefense Security Advisory 07.31.08: Apple Mac OS X CoreGraphics PDF Type1 Font Integer Overflow Vulnerability

iDefense Security Advisory 07.31.08 http://labs.idefense.com/intelligence/vulnerabilities/ Jul 31, 2008 I. BACKGROUND Mac OS X is a Unix operating system built from the XNU kernel. Mac OS X provides all the standard Unix capabilities and tools with an additional GUI component. For more informatio...

E-Mail header Injection in HiFriend

------------------------------------ -------Header Injection---------- ------------------------------------ Script: hifriend.pl Vendor: Hibyte SoftwareVersion: The free one you get from many webpages Dork: "hifriend.pl" + "cgi-bin" ------------------------------------...

Bacula: Information disclosure

Background Bacula is a network based backup suite. Description Matthijs Kooijman reported that the "makecatalogbackup" script uses the MySQL password as a command line argument when invoking other programs. Impact A local attacker could list the processes on the local machine when the script is...

Unfixed XSS vulnerability at www.sancarweb.com

Security researcher 1923Turk, has submitted on 17/07/2008 a cross-site-scripting XSS vulnerability affecting www.sancarweb.com, which at the time of submission ranked 1677813 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 23/09/2008. It is...

CVE-2008-2463

The Microsoft Office Snapshot Viewer ActiveX control in snapview.ocx 10.0.5529.0, as distributed in the standalone Snapshot Viewer and Microsoft Office Access 2000 through 2003, allows remote attackers to download arbitrary files to a client machine via a crafted HTML document or e-mail message,...

Code injection

The Microsoft Office Snapshot Viewer ActiveX control in snapview.ocx 10.0.5529.0, as distributed in the standalone Snapshot Viewer and Microsoft Office Access 2000 through 2003, allows remote attackers to download arbitrary files to a client machine via a crafted HTML document or e-mail message,...

CVE-2008-2463

The Microsoft Office Snapshot Viewer ActiveX control in snapview.ocx 10.0.5529.0, as distributed in the standalone Snapshot Viewer and Microsoft Office Access 2000 through 2003, allows remote attackers to download arbitrary files to a client machine via a crafted HTML document or e-mail message,...

CVE-2008-3068

Microsoft Crypto API 5.131.2600.2180 through 6.0 (used in Outlook, Windows Live Mail, and Office 2007) performs CRL checks by using an arbitrary URL from a certificate embedded in an S/MIME email or a signed document via the Authority Information Access (AIA) extension. This allows remote attacke...

Unfixed XSS vulnerability at www.gourny.com

Security researcher n1n3, has submitted on 07/03/2008 a cross-site-scripting XSS vulnerability affecting www.gourny.com, which at the time of submission ranked 7074197 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 07/04/2008. It is currently...

Unfixed XSS vulnerability at www.rencontres-webcam.com

Security researcher xerces, has submitted on 21/06/2008 a cross-site-scripting XSS vulnerability affecting www.rencontres-webcam.com, which at the time of submission ranked 15390 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 07/07/2008. It is...

Unfixed XSS vulnerability at www.kutuphanem.net

Security researcher lejoner, has submitted on 15/06/2008 a cross-site-scripting XSS vulnerability affecting www.kutuphanem.net, which at the time of submission ranked 144955 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 15/06/2008. It is...

Lotus Notes Applix Graphics viewer BEGIN tag buffer overflow

Added: 06/06/2008 CVE: CVE-2007-5405 BID: 28454 OSVDB: 44194 Background Lotus Notes is the client for Lotus Domino servers. Lotus Notes uses the Autonomy KeyView library to display Applix Graphics .ag attachments. Problem A buffer overflow vulnerability when parsing the initial BEGIN tag in an...

Lotus Notes Applix Graphics viewer BEGIN tag buffer overflow

Added: 06/06/2008 CVE: CVE-2007-5405 BID: 28454 OSVDB: 44194 Background Lotus Notes is the client for Lotus Domino servers. Lotus Notes uses the Autonomy KeyView library to display Applix Graphics .ag attachments. Problem A buffer overflow vulnerability when parsing the initial BEGIN tag in an...

Unfixed XSS vulnerability at www.philly.com

Security researcher mox, has submitted on 06/04/2008 a cross-site-scripting XSS vulnerability affecting www.philly.com, which at the time of submission ranked 8197 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 06/04/2008. It is currently...

softpedia-upload.txt

SiteXS CMS Remote File Upload Vulnerability Discovered by : Ciph3r E-Mail : [email protected] CMS: sitexs-0.1.1 CMS All Version Vulnerable Download CMS : http://dfn.dl.sourceforge.net/sourceforge/sitexs/sitexs-0.1.1.tar.gz Sp TANX4 : google.com ; milw0rm.com ; sourceforge.net SP TANX2 :...

joomlamycontent-sql.txt

!/usr/bin/perl use LWP::UserAgent; use Getopt::Long; if!$ARGV1 print " \n"; print " \n"; print " Joomla Component mycontent Blind SQL Injection Exploit \n"; print " Author:His0k4 ALGERIAN HaCkeR \n"; print " \n"; print " Conctact: His0k4.hlmatgamil.com \n"; print " Greetz: All friends & muslims...

Unfixed XSS vulnerability at nettips.dk

Security researcher Dialogitec ImeCiQ, has submitted on 31/05/2008 a cross-site-scripting XSS vulnerability affecting nettips.dk, which at the time of submission ranked 262378 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 06/06/2008. It is...

Roundup: Permission bypass

Background Roundup is an issue-tracking system with command-line, web and e-mail interfaces. Description Philipp Gortan reported that the xml-rpc server in Roundup does not check property permissions CVE-2008-1475. Furthermore, Roland Meister discovered multiple vulnerabilities caused by...