CVE-2010-4852

CVE-2010-4852 affects Eclime 1.1.2b, where login.php’s reason parameter is vulnerable to cross-site scripting (XSS) due to insufficient input sanitization. Exploitation could cause arbitrary script/HTML execution in a user’s browser. Concrete details across connected records confirm the vulnerabl...

fuse: unprivileged user can unmount arbitrary locations via symlink attack

fuse 2.8.5 and earlier does not properly handle when /etc/mtab cannot be updated, which allows local users to unmount arbitrary directories via a symlink attack...

Chrome's Fail Folder

There’s something very retro about the “fail folder,” Google’s go-to image, which pops up on the Chrome Web browser every time you, say, lose your Internet connection. It’s colorless and two dimensional and its size and shape not so subtly recall the beloved GUI of early vintage Macs. Google made...

Google Books Whale Fail

Some years ago – never mind how long precisely– having little or no money in our pocket and nothing particular to interest us online, we went in search of some digitized copyright-free reading material, only to run smack into Google’s stylized, Eric-Carle inspired Whale Fail page. It tasks me! It...

Tumblr's Tumbeasts

Blogging site Tumblr recently made news with the introduction of its custom Tumbeasts cartoon, which received favorable write ups on Mashable.com and – wait for it – CNN when it was introduced earlier this month. The Tumbeasts, depicted ravaging Tumblr’s data center, were the creation of Oatmeal...

AOL Lifestream's Fail Bunny

The thing about the Twitter Fail Whale was that it was just so darned festive looking that you could hardly find it in yourself to be angry at Twitter for crashing yet again. AOL seems to be playing up the “we’re too cute to be mad at” angle big time for Lifestream, a social network aggregation...

Welcome to the Zoo

Everybody knows the Twitter Fail Whale, but Twitter’s hardly the only flaky Web service out there, and the Fail Whale is just one creature in a whole Fail menagerie that’s sprung up in recent years to soothe hacked off Web users. Check out Threatpost’s Fail Zoo: a collection of the strangest fail...

UBUNTU-CVE-2010-3192

Certain run-time memory protection mechanisms in the GNU C Library aka glibc or libc6 print argv0 and backtrace information, which might allow context-dependent attackers to obtain sensitive information from process memory by executing an incorrect program, as demonstrated by a setuid program tha...

FreeBSD Security Advisory FreeBSD-SA-10:03.zfs

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-10:03.zfs Security Advisory The FreeBSD Project Topic: ZFS ZIL playback with insecure permissions Category: contrib Module: zfs Announced: 2010-01-06 Credits: Paw...

Zabbix Server/Agent Detection (TCP)

TCP based detection of the ZABBIX Server/Agent. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

UPDATE: Twitter Suffers DoS Attack

Twitter was the target of a sustained denial-of-service attack Thursday morning, an attack that took the site offline for several hours. Twitter’s service went down around 9 a.m. EDT and was back up around noon, while Facebook’s site also experienced problems that may have been the result of a Do...

[SECURITY] Fedora 10 Update: device-mapper-multipath-0.4.8-9.fc10

device-mapper-multipath provides tools to manage multipath devices by instructing the device-mapper multipath kernel module what to do. The tools are : multipath : Scan the system for multipath devices and assemble them. multipathd : Detects when paths fail and execs multipath to update thing s...

Softbiz Image Gallery - 'suggest_image.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/30546/info Softbiz Photo Gallery is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecti...

CGI RESCUE WebFORM allows unauthorized email transmission

Overview WebFORM from CGI RESCUE is software which delivers the HTML form inputs via email. WebFORM fails to check the mail headers properly, allowing a remote attacker to send email to arbitrary addresses. According to the vendor's information, FORM2MAIL also contains a similar vulnerability, an...

Moderate: kernel security and bug fix update

2.6.9-67.0.7.0.1.EL - fix skb alignment that was causing sendto to fail with EFAULT Olaf Kirch orabug 6845794 - fix entropy flag in bnx2 driver to generate entropy pool John Sobecki orabug 5931647 - fix enomem due to larger mtu size page alloc Zach Brown orabug 5486128 - fix percpu api bugon with...

Coppermine Photo Gallery 1.4.9 - SQL Injection

Coppermine Photo Gallery 1.4.9 - SQL Injection !/usr/bin/php ?php / Coppermine Photo Gallery 1.4.9 Remote SQL Injection Vulnerability Note: Requires a valid user account. Usage: php script.php host path table prefix user id username password Usage Example: php script.php domain.com /coppermine/...

CVE-2006-0600

elog before 2.5.7 r1558-4 allows remote attackers to cause a denial of service infinite redirection via a request with the fail parameter set to 1, which redirects to the same request...

DEBIAN-CVE-2004-0986

Iptables before 1.2.11, under certain conditions, does not properly load the required modules at system startup, which causes the firewall rules to fail to load and protect the system from remote attackers...

security flaw

lppasswd in CUPS 1.1.22 does not remove the passwd.new file if it encounters a file-size resource limit while writing to passwd.new, which causes subsequent invocations of lppasswd to fail...

Sygate Personal Firewall Pro 5.5 - Local Fail-Close Bypass

Sygate Personal Firewall Pro 5.5 - Local Fail-Close Bypass source: https://www.securityfocus.com/bid/10540/info A vulnerability is reported to affect the Sygate Personal Firewall fail-closed functionality. It is reported that the kernel-space NDIS driver does not verify the origin of messages tha...