Paypal Bug Bounty #52 - SQL Injection Web Vulnerability

Document Title: =============== Paypal Bug Bounty 52 - SQL Injection Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=822 PayPal Security UID: qcm1fe0emw Release Date: ============= 2013-04-02 Vulnerability Laboratory ID VL-ID:...

Debian DSA-2656-1 : bind9 - denial of service

Matthew Horsfall of Dyn, Inc. discovered that BIND, a DNS server, is prone to a denial of service vulnerability. A remote attacker could use this flaw to send a specially crafted DNS query to named that, when processed, would cause named to use an excessive amount of memory, or possibly crash...

Ubuntu 8.04 LTS / 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : perl vulnerability (USN-1770-1)

Yves Orton discovered that Perl incorrectly handled hashing when using user-provided hash keys. An attacker could use this flaw to perform a denial of service attack against software written in Perl. Note that Tenable Network Security has extracted the preceding description block directly from th...

Retailer Challenges Visa $13.2M PCI Fine in Court

Genesco Inc., a Tennessee-based shoe retailer, is taking Visa to court in what is being reported as the first case challenging fines and penalties levied by the Payment Card Industry Data Security Standard PCI DSS under which Genesco was fined $13.3 million. In late 2010, attackers compromised...

DDIVRT-2013-51 DALIM Dialog Server 'logfile' Local File Inclusion

Title ----- DDIVRT-2013-51 DALIM Dialog Server 'logfile' Local File Inclusion Severity -------- High Date Discovered --------------- February 14, 2013 Discovered By ------------- Digital Defense, Inc. Vulnerability Research Team Credit: 0x00string, Ryan Oliver and r@b13$ Vulnerability Description...

TeamSHATTER Security Advisory: SQL Injection in Oracle EM (dBClone) (CVE-2013-0374)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 TeamSHATTER Security Advisory SQL Injection in Oracle Enterprise Manager dBClone February 20, 2013 Risk Level: High Affected versions: Oracle Enterprise Manager Database Control 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, 11.2.0.3 Remote...

TeamSHATTER Security Advisory: SQL Injection in Oracle EM (advReplicationAdmin) (CVE-2013-0372)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 TeamSHATTER Security Advisory SQL Injection in Oracle Enterprise Manager advReplicationAdmin February 20, 2013 Risk Level: High Affected versions: Oracle Enterprise Manager Database Control 11.1.0.7, 11.2.0.2, 11.2.0.3 Remote exploitable: Yes Credits:...

Sun Java JRE / Web Start Java Plug-in Untrusted Applet Privilege Escalation (Unix)

The remote host is using an unmanaged version of Sun Java Runtime Environment that has vulnerabilities in its Java Runtime Plug-in, a web browser add-on used to display Java applets. The JRE Plug-in security can be bypassed by tricking a user into viewing a maliciously crafted web page...

USN-1745-1 : linux-ti-omap4 vulnerability

Suleiman Souhlal, Salman Qazi, Aaron Durbin and Michael Davidson discovered a race condition in the Linux kernel's ptrace syscall. An unprivileged local attacker could exploit this flaw to run programs as an administrator. This script was automatically generated from Ubuntu Security Notice...

EasyWebScripts eBay Clone Script SQL Injection

/ / / \ / / / / / / / / / / / // / / / / / / // / // / / / / | // / / / / / // / / / // / /,// /////,// ///// , / // EasyWebScripts eBay Clone Script, Multiple Vulnerabilities Software Page: http://easywebscripts.com/productdetails.php?itemid=10 Script Demo: http://easywebscripts.com/ebay...

RTTucson Quotations Database - Multiple Vulnerabilities

RTTucson Quotations Database - Multiple Vulnerabilities / / / \ / / / / / / / / / / / // / / / / / / // / // / / / / | // / / / / / // / / / // / /,// /////,// ///// , / // RTTucson Quotations Database Script, Multiple Vulnerabilities Software Page: http://www.rttucson.com/index.html Script...

RTTucson Quotations Database Script XSS / SQL Injection

/ / / \ / / / / / / / / / / / // / / / / / / // / // / / / / | // / / / / / // / / / // / /,// /////,// ///// , / // RTTucson Quotations Database Script, Multiple Vulnerabilities Software Page: http://www.rttucson.com/index.html Script Demo: http://www.rttucson.com/quotations/default.php...

Scripts Genie Top Sites - 'out.php?id' SQL Injection

/ / / \ / / / / / / / / / / / // / / / / / / // / // / / / / | // / / / / / // / / / // / /,// /////,// ///// , / // Top Sites Script, SQL Injection Vulnerabilities Software Page: http://scriptsgenie.com/index.php?do=catalog&c=scripts&i=topsitescript Product Page:...

Scripts Genie Games Site Script SQL Injection Vulnerability

Exploit for php platform in category web applications / / / \ / / / / / / / / / / / // / / / / / / // / // / / / / | // / / / / / // / / / // / /,// /////,// ///// , / // Games Site Script, MySQL Injection Vulnerabilities Software Page:...

VMware Fixes Privilege Escalation Vulnerability

Virtualization software maker VMware issued an update last Thursday resolving a virtual machine communication interface VMCI vulnerability in its ESX Server, Workstation, Fusion and View products that could lead to a privilege escalation if unpatched. According to the VMware security advisory, a...

JVN#86040029: Weathernews Touch for Android stores location information in the system log file

Weathernews Touch provided by Weathernews Inc. is a weather forecast application. Weathernews Touch for Android contains a vulnerability that stores location information in the system log file. Impact Android applications with permissions to read system log files may obtain location information...

ViArt Shop Detection

The remote web server hosts ViArt Shop, a shopping cart application written in PHP. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid64292; scriptversion"1.4"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/06/01"; scriptnameenglish:"ViArt Shop...

Hunt CCTV Credential Disclosure

Hunt CCTV and generics brands Insufficient Authentication January 17, 2013 - A. Ramos -- CVE ID: CVE-2013-1391 reserved -- Affected Vendors: Hunt CCTV http://www.huntcctv.com/ generic brands from Hunt Capture CCTV http://www.capturecctv.ca/ NoVus CCTV http://www.novuscctv.com/ Well-Vision Inc...

SuSE 11 Security Update : GNOME screensaver (SAT Patch Number 2150)

When resuming a system, gnome-screensaver does not lock external displays that got connected while the system was suspended. CVE-2010-0285 - Pressing the 'Return' key repeatedly caused an X error that terminated gnome-screensaver. CVE-2010-0732 %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

SuSE 11.2 Security Update : dhcp (SAT Patch Number 6831)

This update to ISC dhcp-4.2.4-P2 release provides a security fix for an issue with the use of lease times. Making certain changes to the end time of an IPv6 lease could cause the server to abort. Thanks to Glen Eustace of Massey University, New Zealand for finding this issue. CVE-2012-3955 has be...