The All-Decade Interview Team

It occurred to me recently that I’ve been covering the security industry for just about 10 years. That’s a long time to be doing anything, and especially to be writing about one topic. But it’s hard to think of something that would have been much more interesting to cover this decade, given the...

ZDI-09-072: Microsoft Windows GDI+ TIFF Parsing Code Execution Vulnerability

ZDI-09-072: Microsoft Windows GDI+ TIFF Parsing Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-072 October 13, 2009 -- CVE ID: CVE-2009-2503 -- Affected Vendors: Microsoft -- Affected Products: Microsoft Windows Vista Microsoft Windows XP Microsoft Windows Server...

ZDI-09-069: Microsoft Windows Media Player Audio Voice Sample Rate Memory Corruption Vulnerability

ZDI-09-069: Microsoft Windows Media Player Audio Voice Sample Rate Memory Corruption Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-069 October 13, 2009 -- CVE ID: CVE-2009-0555 -- Affected Vendors: Microsoft -- Affected Products: Microsoft Windows Media Player 11 Microsoft...

Vulnerability in OpenSSL CVE-2009-0591

The function CMSverify does not correctly handle an error condition involving malformed signed attributes. This will cause an invalid set of signed attributes to appear valid and content digests will not be checked...

Inside the OLPC security story

One of my favorite talks on computer security is this one by Ivan Krstic, the former head of security development for the ambitious One Laptop per Child project:...

ZDI-08-056: Microsoft Windows GDI+ GIF Parsing Code Execution Vulnerability

ZDI-08-056: Microsoft Windows GDI+ GIF Parsing Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-08-056 September 9, 2008 -- CVE ID: CVE-2008-3013 -- Affected Vendors: Microsoft -- Affected Products: Microsoft Windows Server 2008 Microsoft Windows XP Microsoft Windows...

hordekrono-xss.txt

+==========================================================================+ + Horde & Kronolith Calendar Application & XSS Vulnerabilities + +==========================================================================+ Authors: Ivan Sanchez Product: Kronolith Calendar Application Web:...

hordeturba-xss.txt

+==========================================================================+ + Horde & Turba Contact Manager & XSS Vulnerabilities + +==========================================================================+ Authors: Ivan Sanchez Product: Turba Contact Manager Web: http://www.horde.org Versions...

geocarts-xssrfi.txt

+==========================================================================================+ + Powered By GeeCarts = ALL VERSIONS XSS & RFI Multiple Remote Vulnerabilities + +==========================================================================================+ Authors: Ivan Sanchez Product:...

SA-2007-031 - Drupal core - SQL Injection possible when certain contributed modules are enabled

The function taxonomyselectnodes directly injects variables into SQL queries instead of using placeholders. While taxonomy module itself validates the input passed to taxonomyselectnodes, this is a weakness in Drupal core. Several contributed modules, such as taxonomymenu, ajaxLoader, and ubrowse...

blabchat-xss.txt

+==================================================================+ + BlaB! Chat 3.3 XSS Multiple Remote Vulnerabilities + +==================================================================+ Authors: Ivan Sanchez & Maximiliano Soler Product: BlaB! Chat Web: http://hot-things.net/ Versions: 3.3...

fusetalkautherror-xss.txt

Hello everyone, After trying to report a SQL bug autherror.cfm to FuseTalk, and seeing them providing patches to customers dropping new fixed .cfm files in a private place reserved to customers without giving proper credits and without reporting them publicly we were following the Full Disclosure...

fusetalk CSS (comfinish.cfm)

Hello everyone, After trying to report a SQL bug autherror.cfm to FuseTalk, and seeing them providing patches to customers dropping new fixed .cfm files in a private place reserved to customers without giving proper credits and without reporting them publicly we were following the Full Disclosure...

fusetalk SQL (autherror.cfm)

Hello everyone, After trying to report bugs to FuseTalk, and seeing them providing patches to customers dropping new fixed .cfm files in a private place reserved to customers without giving proper credits and without reporting them publicly we were following the Full Disclosure Policy v2.0, we...

Arbitrary file deletion

PHP file inclusion vulnerability in index.php in Ivan Peevski gallery 0.3 in Simple PHP Scripts sphp allows remote attackers to execute arbitrary PHP code via a UNC share pathname or a local file pathname in the gallery parameter, which is accessed by the fileexists function. NOTE: the provenance...

CVE-2007-2679

PHP file inclusion vulnerability in index.php in Ivan Peevski gallery 0.3 in Simple PHP Scripts sphp allows remote attackers to execute arbitrary PHP code via a UNC share pathname or a local file pathname in the gallery parameter, which is accessed by the fileexists function. NOTE: the provenance...

CVE-2007-2679

Summary: CVE-2007-2679 is a PHP file inclusion vulnerability in Ivan Peevski gallery 0.3 (Simple PHP Scripts, sPHP). Affected component: index.php; vulnerability arises from using a user-supplied gallery parameter as input to file_exists, enabling inclusion of arbitrary PHP code through UNC or lo...

CVE-2007-2679

PHP file inclusion vulnerability in index.php in Ivan Peevski gallery 0.3 in Simple PHP Scripts sphp allows remote attackers to execute arbitrary PHP code via a UNC share pathname or a local file pathname in the gallery parameter, which is accessed by the fileexists function. NOTE: the provenance...

CVE-2007-2679: Undefined Security Weakness

PHP file inclusion vulnerability in index.php in Ivan Peevski gallery 0.3 in Simple PHP Scripts sphp allows remote attackers to execute arbitrary PHP code via a UNC share pathname or a local file pathname in the gallery parameter, which is accessed by the fileexists function. NOTE: the provenance...

Remote file inclusion

PHP remote file inclusion vulnerability in index.php in Ivan Gallery Script 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the dir parameter. NOTE: this issue has been disputed by third party researchers for 0.3, stating that the dir variable is properly initialized before...