Barracuda Backup 2.0 Cookie Manipulation

Title: ====== Barracuda Backup v2.0 - Multiple Web Vulnerabilities Date: ===== 2011-09-28 References: =========== Barracuda Backup Application v2.0 VL-ID: ===== 31 Introduction: ============= Barracuda Networks - Worldwide leader in email and Web security. Barracuda Backup Service is a complete a...

Traq 2.2 Cross Site Scripting / SQL Injection

Vulnerability ID: HTB23046 Reference: https://www.htbridge.ch/advisory/multiplevulnerabilitiesintraq.html Product: Traq Vendor: Jack Polgar http://traqproject.org/ Vulnerable Version: 2.2 and probably prior Tested Version: 2.2 Vendor Notification: 07 September 2011 Vulnerability Type: XSS, SQL...

ServersCheck Monitoring 8.8.10 - Multiple Vulnerabilities

Document Title: =============== ServersCheck Monitoring 8.8.10 - Multiple Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=93 FULL: Discl. Date OSVDB ID CVE ID Creditees Title 2011-09-27 76035 Benjamin Kunz Mejri ServersCheck Monitoring...

Let's Play a Game of Cyber Security at CSAW CTF 2011

Let's Play a Game of Cyber Security at CSAW CTF 2011 Ready for a little game of capture the flag? What if you weren't running around a field like a crazy person trying to grab a flag out of someone's belt, but instead were navigating around a network overcoming technical challenges to find marker...

Let's Play a Game of Cyber Security at CSAW CTF 2011

Let's Play a Game of Cyber Security at CSAW CTF 2011 Ready for a little game of capture the flag? What if you weren't running around a field like a crazy person trying to grab a flag out of someone's belt, but instead were navigating around a network overcoming technical challenges to find marker...

U.S. Geological Survey Website SQL Injection

Title: ====== U.S. Geological Survey Website - SQL Injection Vulnerability Date: ===== 2011-09-21 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=278 VL-ID: ===== 278 Introduction: ============= The United States Geological Survey USGS is a scientific agency of the Unit...

U.S. Geological Survey Website - SQL Injection Vulnerability

Document Title: =============== U.S. Geological Survey Website - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=278 Release Date: ============= 2011-09-21 Vulnerability Laboratory ID VL-ID: ===================================...

Facebook BugBounty #2 - Persistent Web Vulnerabilities

Document Title: =============== Facebook BugBounty 2 - Persistent Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=239 http://www.vulnerability-lab.com/getcontent.php?id=277 Release Date: ============= 2011-09-19 Vulnerability Laborato...

Toko Lite CMS 1.5.2 (EditNavBar.php) Multiple Parameters XSS POST Injection

Summary Toko Web Content Editor cms is a compact, multi language, open source web editor and content management system CMS. It is advanced easy to use yet fully featured program that can be integrated with any existing site. It takes 2 minuets to install even for non technical users. Description...

Toko Lite CMS 1.5.2 (edit.php) HTTP Response Splitting Vulnerability

Summary Toko Web Content Editor cms is a compact, multi language, open source web editor and content management system CMS. It is advanced easy to use yet fully featured program that can be integrated with any existing site. It takes 2 minuets to install even for non technical users. Description...

iGallery Plugin v1.0.0 (dir) Remote Cross-Site Scripting Vulnerability

Summary iGallery uses MooTools - image resizing done dynamically using phpThumb - resized images are cached. Description iGallery suffers from a XSS vulnerability when parsing user input to the 'dir' parameter via GET method in '/scripts/pthumb/demo/phpThumb.demo.random.php'. Attackers can exploi...

iManager Plugin v1.2.8 (dir) Remote Cross-Site Scripting Vulnerability

Summary With iManager you can manage your files/images on your webserver, and it provides user interface to most of the phpThumb functions. It works either stand-alone or as a plugin to WYSIWYG editors like tinyMCE, SPAW, htmlAREA, Xinha and FCKeditor. Description iManager suffers from a XSS...

iBrowser Plugin v1.4.1 (lang) Local File Inclusion Vulnerability

Exploit for php platform in category web applications iBrowser Plugin v1.4.1 lang Local File Inclusion Vulnerability Vendor: net4visions.com Product web page: http://www.net4visions.com Affected version: lang.'.php' ; 70: $this - charset = $langcharset; 71: $this - dir = $langdirection; 72: $this...

iBrowser Plugin v1.4.1 (lang) Local File Inclusion Vulnerability

Summary iBrowser is an image browser plugin for WYSIWYG editors like tinyMCE, SPAW, htmlAREA, Xinha and FCKeditor developed by net4visions. It allows image browsing, resizing on upload, directory management and more with the integration of the phpThumb image library. Description iBrowser suffers...

iManager Plugin v1.2.8 (d) Remote Arbitrary File Deletion Vulnerability

Summary With iManager you can manage your files/images on your webserver, and it provides user interface to most of the phpThumb functions. It works either stand-alone or as a plugin to WYSIWYG editors like tinyMCE, SPAW, htmlAREA, Xinha and FCKeditor. Description Input passed to the 'd' paramete...

SiT! Support Incident Tracker 3.64 XSS / XSRF / SQL Injection

Vulnerability ID: HTB23043 Reference: https://www.htbridge.ch/advisory/multiplevulnerabilitiesinsitsupportincidenttracker.html Product: SiT! Support Incident Tracker Vendor: The Support Incident Tracker Project http://sitracker.org/ Vulnerable Version: 3.64 and probably prior Tested Version: 3.64...

Argus Surveillance DVR v2.3 & 4.x - Multiple Vulnerabilities

Document Title: =============== Argus Surveillance DVR v2.3 & 4.x - Multiple Vulnerabilities Release Date: ============= 2011-09-12 Vulnerability Laboratory ID VL-ID: ==================================== 227 Abstract Advisory Information: ============================== Vulnerability Lab Team...

GeoVision DVR Remote View - Multiple Web Vulnerabilities

Document Title: =============== GeoVision DVR Remote View - Multiple Web Vulnerabilities Release Date: ============= 2011-09-12 Vulnerability Laboratory ID VL-ID: ==================================== 51 Product & Service Introduction: =============================== Geovision is a very famous...

La Poste FR Website - Local File Include Vulnerability

Document Title: =============== La Poste FR Website - Local File Include Vulnerability Release Date: ============= 2011-09-10 Vulnerability Laboratory ID VL-ID: ==================================== 266 Product & Service Introduction: =============================== La Poste is the mail service of...

[slackware-security] httpd

Not long ago, httpd package updates were issued to clamp down on a denial of service bug that's seen some action in the wild. New packages are available for Slackware 12.0, 12.1, 12.2, 13.0, 13.1, 13.37, and -current. Here are the details from the Slackware 13.37 ChangeLog:...