Cross site request forgery (csrf)

Eucalyptus before 2.0.3 and Eucalyptus EE before 2.0.2, as used in Ubuntu Enterprise Cloud UEC and other products, do not properly interpret signed elements in SOAP requests, which allows man-in-the-middle attackers to execute arbitrary commands by modifying a request, related to an "XML Signatur...

CVE-2011-0730

CVE-2011-0730 affects Eucalyptus before 2.0.3 and Eucalyptus EE before 2.0.2. The issue arises from improper interpretation of signed elements in SOAP requests, enabling man-in-the-middle attackers to modify a request and execute arbitrary commands. This is tied to XML Signature Element Wrapping ...

CVE-2011-0730

Eucalyptus before 2.0.3 and Eucalyptus EE before 2.0.2, as used in Ubuntu Enterprise Cloud UEC and other products, do not properly interpret signed elements in SOAP requests, which allows man-in-the-middle attackers to execute arbitrary commands by modifying a request, related to an "XML Signatur...

The Social-Engineer Toolkit v1.4 latest Version !

The Social-Engineer Toolkit v1.4 latest Version ! The Social Engineering Toolkit SET is a python-driven suite of custom tools which solely focuses on attacking the human element of penetration testing. It's main purpose is to augment and simulate social-engineering attacks and allow the tester to...

CVE-2011-1772

Multiple cross-site scripting XSS vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving 1 an action name, 2 the action attribute of an s:submit element, or 3 t...

Mozilla Firefox OBJECT mChannel Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Mozilla Firefox. User interaction is required to exploit this vulnerability in that the target must visit a malicious page. The specific flaw exists within the OnChannelRedirect method. When an...

openSUSE Security Update : kdenetwork4 (openSUSE-SU-2010:1076-1)

This update of kdenetwork fixes several bugs, the security related issues are : - CVE-2010-1000: CVSS v2 Base Score: 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N: CWE-22 The 'name' attribute of the 'file' element of metalink files is not properly sanitised this can be exploited to download files to arbitrary...

xmlsec1: arbitrary file creation when verifying signatures

xslt.c in XML Security Library aka xmlsec before 1.2.17, as used in WebKit and other products, when XSLT is enabled, allows remote attackers to create or overwrite arbitrary files via vectors involving the libxslt output extension and a ds:Transform element during signature verification...

CVE-2011-1440

Use-after-free vulnerability in Google Chrome before 11.0.696.57 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the ruby element and Cascading Style Sheets CSS token sequences...

USN-1112-1: Firefox and Xulrunner vulnerabilities

It was discovered that there was a vulnerability in the memory handling of certain types of content. An attacker could exploit this to possibly run arbitrary code as the user running Firefox. CVE-2011-0081 It was discovered that Firefox incorrectly handled certain JavaScript requests. An attacker...

Critical: Red Hat Security Advisory: thunderbird security update

An updated thunderbird package that fixes several security issues is now available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

ZDI-11-138: Webkit Undefined DOM Prototype Attach Remote Code Execution Vulnerability

ZDI-11-138: Webkit Undefined DOM Prototype Attach Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-138 April 19, 2011 -- CVSS: 9, AV:N/AC:L/Au:N/C:P/I:P/A:C -- Affected Vendors: WebKit -- Affected Products: WebKit WebKit -- TippingPointTM IPS Customer...

Webkit Undefined DOM Prototype Attach Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Safari Webkit. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

(Pwn2Own) Webkit CSS Text Element Count Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Webkit. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the WebKit library's...

glibc security update

2.12-1.7.el60.5 - Avoid too much stack use in fnmatch 681054, CVE-2011-1071 - Properly quote output of locale 625893, CVE-2011-1095 - Don't leave empty element in rpath when skipping the first element, ignore rpath elements containing non-isolated use of when privileged 667974, CVE-2011-0536...

Element-IT PowUpload 1.3 File Arbitrary Upload

Exploit for asp platform in category web applications Exploit Title: Element-IT PowUpload 1.3 File Arbitrary Upload Date: 21/03/2011 Author: Daniel Godoy Author Mail: DanielGodoyatGobiernoFederaldotcom Author Web: www.delincuentedigital.com.ar Software: Element-IT PowUpload 1.3 Software Link:...

Element-IT PowUpload 1.3 Arbitrary File Upload

Exploit Title: Element-IT PowUpload 1.3 File Arbitrary Upload Date: 21/03/2011 Author: Daniel Godoy Author Mail: DanielGodoyatGobiernoFederaldotcom Author Web: www.delincuentedigital.com.ar Software: Element-IT PowUpload 1.3 Software Link: http://www.element-it.com/downloadfile.aspx?type=pow Demo...

Element-IT PowUpload 1.3 - Arbitrary File Upload

Element-IT PowUpload 1.3 - Arbitrary File Upload Exploit Title: Element-IT PowUpload 1.3 File Arbitrary Upload Date: 21/03/2011 Author: Daniel Godoy Author Mail: DanielGodoyatGobiernoFederaldotcom Author Web: www.delincuentedigital.com.ar Software: Element-IT PowUpload 1.3 Software Link:...

CVE-2010-4758

installer.pl in Open Ticket Request System OTRS before 3.0.3 has an Inbound Mail Password field that uses the text type, instead of the password type, for its INPUT element, which makes it easier for physically proximate attackers to obtain the password by reading the workstation screen...

CVE-2010-4758

installer.pl in Open Ticket Request System OTRS before 3.0.3 has an Inbound Mail Password field that uses the text type, instead of the password type, for its INPUT element, which makes it easier for physically proximate attackers to obtain the password by reading the workstation screen...