Qwik SMTP 0.3 - Remote Root Format String Exploit

No description provided by source. / qwik-smtp Remote Root Exploit ------------------------------- Bug found by: Dark Eagle darkeagle at list d0t ru Exploit coded by: Carlos Barros barros at barrossecurity d0t com Home Page: http://www.barrossecurity.com Exploitation techinique: This bug is a...

Microsoft Internet Explorer 5 Zone Spoofing Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/3420/info Microsoft Internet Explorer contains a security-setting feature that can be modified according to a user's preferences. These settings control what actions a web site can take on a user's system. A vulnerability...

Hosting Controller <= 6.1 HotFix 2.2 Add Domain without Quota Exploit

No description provided by source. !-- Change url /str0ke -- form method=post name=addform action=http://url/admin/iis/IISActions.asp?ActionType=AddSite&hostcustid=1&hostingplans=1 table tr class=looplistingDark td width=19% class=ContentsWebsite Name : /td td width=73% class=contents input...

Edimax AR-7084GA Router CSRF + Persistent XSS Exploit

No description provided by source. ?php / Edimax AR-7084GA Router CSRF + Persistent XSS Exploit Firmware version: 2.9.8.1RUE0.C2A3.7.6.1 Vulnerable page: http://xx.xx.xx.xx/advanced/advnatvirsvr.htm Author: l3D Sites: http://xraysecurity.blogspot.com, http://nullbyte.org.il IRC: irc://irc.nix.co....

Alteon AceDirector Half-Closed HTTP Request IP Address Revealing Vulnerabililty

No description provided by source. source: http://www.securityfocus.com/bid/3964/info Alteon ACEdirector is a hardware solution distributed by Nortel Networks. ACEdirector runs the Nortel WebOS operating system. It is possible to retrieve the real IP addresses of webservers that are managed by an...

Thomson TWG87OUIR - POST Password CSRF Vulnerability

Exploit for hardware platform in category web applications Author: nopesled Date: 24/06/14 Vulnerability: POST Password Reset CSRF Tested on: Thomson TWG87OUIR Hardware Version Thomson TWG87OUIR CSRF document.exploit.submit; 0day.today 2018-03-01...

Dramatic Drop in Vulnerable NTP Servers Used in DDoS Attacks

While patching of webservers vulnerable to the Heartbleed OpenSSL bug may have stalled, the same cannot be said about repairs to NTP servers that could be leveraged in devastating amplification attacks. A spate of distributed denial-of-service attacks DDoS tore through companies in January and...

openSUSE Security Update : kdelibs4 (openSUSE-SU-2011:0281-1)

KSSL did not properly verify the host name of a certificate if the certificate was issued for an IP address CVE-2011-1094. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update kdelibs4-4225. The te...

PT-2016-5688 · Openssl +3 · Polarssl +4

Name of the Vulnerable Software and Affected Versions: cURL and libcurl versions prior to 7.49.0 Description: The issue allows remote attackers to spoof servers via an arbitrary valid certificate when using SSLv3 or making a TLS connection to a URL that uses a numerical IP address. This occurs...

Fail2ban: Multiple vulnerabilities

Background Fail2ban is a tool for parsing log files and banning IP addresses which show suspicious behavior. Description Multiple vulnerabilities have been discovered in Fail2ban. Please review the CVE identifiers referenced below for details. Impact A remote attacker could send a crafted URL to ...

python-django: MySQL typecasting

The 1 FilePathField, 2 GenericIPAddressField, and 3 IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, relate...

python-django: MySQL typecasting

The 1 FilePathField, 2 GenericIPAddressField, and 3 IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, relate...

PYSEC-2014-3

The 1 FilePathField, 2 GenericIPAddressField, and 3 IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, relate...

CVE-2014-2522

curl and libcurl 7.27.0 through 7.35.0, when running on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP...

Code injection

curl and libcurl 7.27.0 through 7.35.0, when running on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP...

CVE-2014-2522

curl and libcurl 7.27.0 through 7.35.0, when running on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP...

Warning: Malware Campaign targeting Jailbroken Apple iOS Devices

A new piece of malicious malware infection targeting jailbroken Apple iOS devices in an attempt to steal users’ credentials, has been discovered by Reddit users. The Reddit Jailbreak community discovered the malicious infection dubbed as ‘Unflod Baby Panda’, on some jailbroken Apple iOS devices o...

CVE-2014-2869

PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to obtain sensitive information via requests to unspecified URIs, as demonstrated by pathname, SQL server, e-mail address, and IP address information...

Information disclosure

PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to obtain sensitive information via requests to unspecified URIs, as demonstrated by pathname, SQL server, e-mail address, and IP address information...

CVE-2014-2869

PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to obtain sensitive information via requests to unspecified URIs, as demonstrated by pathname, SQL server, e-mail address, and IP address information...