ZDI-11-137: Oracle Application Server Authentication Bypass Remote Code Execution Vulnerability

ZDI-11-137: Oracle Application Server Authentication Bypass Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-137 April 19, 2011 -- CVE ID: CVE-2011-0807 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: Oracle -- Affected Products: Oracle Applicati...

ZDI-11-132: CA Total Defense Suite UNC Management Console DeleteReportLayout SQL Injection Vulnerability

ZDI-11-132: CA Total Defense Suite UNC Management Console DeleteReportLayout SQL Injection Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-132 April 13, 2011 -- CVE ID: CVE-2011-1653 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: CA -- Affected Products: CA Total...

ZDI-11-129: CA Total Defense Suite UnassignAdminRoles Stored Procedure SQL Injection Vulnerability

ZDI-11-129: CA Total Defense Suite UnassignAdminRoles Stored Procedure SQL Injection Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-129 April 13, 2011 -- CVE ID: CVE-2011-1653 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: CA -- Affected Products: CA Total Defense...

ZDI-11-133: CA Total Defense Suite UNC Management Console DeleteReports SQL Injection Vulnerability

ZDI-11-133: CA Total Defense Suite UNC Management Console DeleteReports SQL Injection Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-133 April 13, 2011 -- CVE ID: CVE-2011-1653 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: CA -- Affected Products: CA Total Defense...

ZDI-11-127: CA Total Defense Suite UNCWS Web Service getDBConfigSettings Credential Disclosure Vulnerability

ZDI-11-127: CA Total Defense Suite UNCWS Web Service getDBConfigSettings Credential Disclosure Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-127 April 13, 2011 -- CVE ID: CVE-2011-1655 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: CA -- Affected Products: CA Tota...

ZDI-11-122: RealNetworks RealPlayer OpenURLInDefaultBrowser Remote Code Execution Vulnerability

ZDI-11-122: RealNetworks RealPlayer OpenURLInDefaultBrowser Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-122 April 12, 2011 -- CVE ID: CVE-2011-1426 -- CVSS: 9.7, AV:N/AC:L/Au:N/C:C/I:P/A:C -- Affected Vendors: RealNetworks -- Affected Products:...

ZDI-11-119: (Pwn2Own) Microsoft Internet Explorer onPropertyChange Remote Code Execution Vulnerability

ZDI-11-119: Pwn2Own Microsoft Internet Explorer onPropertyChange Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-119 April 12, 2011 -- CVE ID: CVE-2011-1345 -- CVSS: 9, AV:N/AC:L/Au:N/C:P/I:P/A:C -- Affected Vendors: Microsoft -- Affected Products: Microsoft...

ZDI-11-120: Microsoft Office Excel RealTimeData Record Parsing Remote Code Execution Vulnerability

ZDI-11-120: Microsoft Office Excel RealTimeData Record Parsing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-120 April 12, 2011 -- CVE ID: CVE-2011-0101 -- CVSS: 9, AV:N/AC:L/Au:N/C:P/I:P/A:C -- Affected Vendors: Microsoft -- Affected Products: Microsoft...

ZDI-11-108: Mac OS X Compact Font Format Decoder Remote Code Execution Vulnerability

ZDI-11-108: Mac OS X Compact Font Format Decoder Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-108 March 22, 2011 -- CVE ID: CVE-2011-0176 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: Apple -- Affected Products: Apple Preview --...

Legacy Browser Exploit Whitespace Obfuscation

Although various security products provide coverage against many web vulnerabilities known exploits could potentially bypass security products by using JavaScript obfuscation techniques. An example of such a technique is the whitespace obfuscation. Such techniques obfuscate known exploits so they...

Symantec LiveUpdate Administrator Cross-Site Request Forgery

SUMMARY Symantecs LiveUpdate Administrator LUA is susceptible to a cross-site request forgery vulnerability which could result in the execution of HTML or script code in the context of the admins browser. AFFECTED PRODUCTS Product | Version | Solution ---|---|--- Symantec LiveUpdate Administrator...

Tumblr security flaw, Clarification by Tumblr official staff !

Tumblr security flaw, Clarification by Tumblr official staff ! On our yesterday post about Tumblr security flaw : server IPS, API keys, passwords, etc were leaked, Finally Tumblr official staff gives a statement to all their users as below : A human error caused some sensitive server configuratio...

SmarterMail 8.0 - Multiple Cross-Site Scripting Vulnerabilities

Author: Hoyt LLC Research Target: SmarterMail Version 8.0.4086.25048 Tools: Burp Suite Pro 1.3.09, FuzzDB Description: XSS, Cross Site Scripting in SmarterMail 8.0.4086.25048, CWE-79, CAPEC-86 Keywords: Stored XSS, Reflected XSS, Cross Site Scripting, SmarterMail 8.0.4086.25048, xss.cx, hoyt llc...

ZDI-11-094: (0 day) Hewlett-Packard StorageWorks File Migration Agent Remote Archive Tampering Vulnerability

ZDI-11-094: 0 day Hewlett-Packard StorageWorks File Migration Agent Remote Archive Tampering Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-094 February 28, 2011 -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P -- Affected Vendors: Hewlett-Packard -- Affected Products: Hewlett-Packard...

ZDI-11-101: Apple iPhone Webkit Library Javascript Array sort Method Remote Code Execution Vulnerability

ZDI-11-101: Apple iPhone Webkit Library Javascript Array sort Method Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-101 March 2, 2011 -- CVE ID: CVE-2011-0154 -- CVSS: 9, AV:N/AC:L/Au:N/C:P/I:P/A:C -- Affected Vendors: Apple -- Affected Products: Apple WebK...

ZDI-11-097: Apple Webkit setOuterText Memory Corruption Remote Code Execution Vulnerability

ZDI-11-097: Apple Webkit setOuterText Memory Corruption Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-097 March 2, 2011 -- CVE ID: CVE-2011-0116 -- CVSS: 9, AV:N/AC:L/Au:N/C:P/I:P/A:C -- Affected Vendors: Apple -- Affected Products: Apple WebKit --...

ZDI-11-100: Apple Webkit Root HTMLBRElement Style Remote Code Execution Vulnerability

ZDI-11-100: Apple Webkit Root HTMLBRElement Style Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-100 March 2, 2011 -- CVE ID: CVE-2011-0149 -- CVSS: 9, AV:N/AC:M/Au:N/C:C/I:P/A:C -- Affected Vendors: Apple -- Affected Products: Apple WebKit -- TippingPointT...

ZDI-11-093: CA Internet Security Suite HIPS XML Security Database Parser Class Remote Code Execution Vulnerability

ZDI-11-093: CA Internet Security Suite HIPS XML Security Database Parser Class Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-093 February 23, 2011 -- CVE ID: CVE-2011-1036 -- CVSS: 9.3, AV:N/AC:M/Au:N/C:C/I:C/A:C -- Affected Vendors: CA -- Affected Product...

ZDI-11-091: (0day) Cisco Secure Desktop CSDWebInstaller Remote Code Execution Vulnerability

ZDI-11-091: 0day Cisco Secure Desktop CSDWebInstaller Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-091 February 23, 2011 -- CVE ID: CVE-2011-0926 -- CVSS: 9, AV:N/AC:L/Au:N/C:P/I:P/A:C -- Affected Vendors: Cisco -- Affected Products: Cisco Secure Desktop ...

ZDI-11-092: (0day) Cisco Secure Desktop CSDWebInstaller ActiveX Control Cleaner.cab Remote Code Execution Vulnerability

ZDI-11-092: 0day Cisco Secure Desktop CSDWebInstaller ActiveX Control Cleaner.cab Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-092 February 23, 2011 -- CVE ID: CVE-2011-0925 -- CVSS: 8.3, AV:N/AC:M/Au:N/C:P/I:P/A:C -- Affected Vendors: Cisco -- Affected...