VUPEN Security - Adobe Acrobat and Reader U3D Filter Code Execution Vulnerabilities

VUPEN Vulnerability Research - Adobe Acrobat and Reader U3D Filter Code Execution Vulnerabilities I. BACKGROUND --------------------- Adobe Acrobat is a family of computer programs developed by Adobe Systems, designed to view, create, manipulate and manage files in Adobe's Portable Document Forma...

Snitz Forums 2000 Multiple Cross-Site Scripting Vulnerabilities

No description provided by source. Application: Snitz Forums 2000 Version affected: 3.4.07 Website: http://forum.snitz.com/ Discovered By: Andrea Fabrizi Email: andrea.fabrizi gmail com Web: http://www.andreafabrizi.it Vuln: Multiple Cross-Site Scripting PERMANENT XSS If sound tag is allowed:...

CVE-2009-3730

creationtimestamp| type| source ---|---|--- 2009-10-15 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/33292 2009-10-15 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/33293 2009-10-15 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/10094...

CVE-2009-4554

creationtimestamp| type| source ---|---|--- 2009-10-15 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/9856 2009-10-15 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/33290 2009-10-15 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/33291...

Adobe Warns: Unpatched PDF Vulnerability Under Attack

Adobe has confirmed a critical, unpatched vulnerability in its PDF Reader/Acrobat software is being exploited by malicious attackers. The vulnerability affects Adobe Reader and Acrobat 9.1.3 and earlier versions on Windows, Macintosh and UNIX. Adobe described the in-the wild attacks as limited an...

QuickCart XSS / XSRF / LFI

DISCOVERED: Paweł 'kl3ryk' Łaskarzewski GREETZ: hawk, pin3ska, black ant, qwert666, ua and gacmaan DIRECTORY TRAVERSAL http://victim.com/?p=ONE OF THE EXISITING FILES-EXISITING ACTION IN THIS FILE- Most of actions load templates form bad directory and then throw an exception. example:...

PHPGenealogie 2.0 'CoupleDB.php' RFI Vulnerability

PHPGenealogie is prone to a remote file inclusion RFI vulnerability. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2009-4745

creationtimestamp| type| source ---|---|--- 2009-10-08 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/10006 2009-10-13 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/33282...

HP LaserJet printers - Multiple Stored XSS vulnerabilities

Exploit for unknown platform in category remote exploits ========================================================== HP LaserJet printers - Multiple Stored XSS vulnerabilities ========================================================== Title: HP LaserJet printers - Multiple Stored XSS vulnerabiliti...

HP LaserJet printers - 存储型xss

No description provided by source. Digital Security Research Group DSecRG Advisory DSECRG-09-048 http://dsecrg.ru/pages/vul/show.php?id=148 Application: HP LaserJet printer web interface Vulnerable: HP LaserJet 2200, 4350, 4600, 5500, and many others Vendor URL: http://www.hp.com/ Bug: Multiple...

HP LaserJet Printers - Multiple Persistent Cross-Site Scripting Vulnerabilities

HP LaserJet Printers - Multiple Persistent Cross-Site Scripting Vulnerabilities Digital Security Research Group DSecRG Advisory DSECRG-09-048 http://dsecrg.ru/pages/vul/show.php?id=148 Application: HP LaserJet printer web interface Vulnerable: HP LaserJet 2200, 4350, 4600, 5500, and many others...

The Reality Behind SQL Injection Attacks

TORONTO — The frequency and scope of SQL injection attacks has exploded in the last year or two, with thousands of legitimate Web sites having been compromised and used to serve malware or further Web exploits. That’s the bad news. The good news is that there are some remarkably effective...

CVE-2009-3709

creationtimestamp| type| source ---|---|--- 2009-10-05 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/9991 2009-10-29 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/9866...

CVE-2009-3708

creationtimestamp| type| source ---|---|--- 2009-10-05 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/9991 2009-10-29 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/9866...

CVE-2009-4743

creationtimestamp| type| source ---|---|--- 2009-10-05 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/9857 2009-10-06 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/33268...

nginx Proxy DNS Cache Domain Spoofing Vulnerability

The 'nginx' program is prone to a vulnerability that may allow attackers to spoof domains because the software fails to properly compare domains when referencing an internal DNS cache. This issue can be exploited when nginx is configured to act as a forward proxy, but this is a nonstandard and...

PHP 5.2.11, 5.3.0 Multiple Restriction-Bypass Vulnerabilities

PHP is prone to a SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:php:php"; ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.100281"...

(edited) [DSECRG-09-044] SAP GUI 7.1 Insecure Methods

Digital Security Research Group DSecRG Advisory DSECRG-09-044 Application: EnjoySAP, SAP GUI for Windows 6.4 and 7.1 Versions Affected: Tested on 7100.2.7.1038 PL 7 Vendor URL: http://SAP.com Bugs: insecure method, File owervriting Exploits: YES Reported: 02.07.2009 Vendor response: 02.07.2009 Da...

[DSECRG-09-043] SAP GUI 7.1 Insecure Method

Digital Security Research Group DSecRG Advisory DSECRG-09-043 Application: EAI WebViewer2D EnjoySAP, SAP GUI for Windows 6.4 and 7.1 Versions Affected: Tested on 7100.2.7.1038 PL 7 Vendor URL: http://SAP.com Bugs: insecure method, File owervriting Exploits: YES Reported: 02.07.2009 Vendor respons...

SuSE 11 Security Update : acroread_ja (SAT Patch Number 769)

Multiple flaws in the JBIG2 decoder and the JavaScript engine of the Adobe Reader allowed attackers to crash acroread or even execute arbitrary code by tricking users into opening specially crafted PDF files. CVE-2009-0658 / CVE-2009-0927 / CVE-2009-0193 / CVE-2009-0928 / CVE-2009-1061 /...