[SECURITY] Fedora 18 Update: freeipa-3.1.0-1.fc18

IPA is an integrated solution to provide centrally managed Identity machin e, user, virtual machines, groups, authentication credentials, Policy configuration settings, access control information and Audit events, logs, analysis thereof...

WordPress Simple Gmail Login Path Disclosure

Application- Wordpress Plugin Simple Gmail Login Exploit - Stack Trace Error URL- http://wordpress.org/extend/plugins/simple-gmail-login/ Author- Aditya Balapure Link - http://adityabalapure.blogspot.in/ CVE Assigned- CVE-2012-6313. Description Once you have installed this plugin you can login to...

JVN#23563149: KENT-WEB ACCESS REPORT vulnerable to cross-site scripting

ACCESS REPORT provided by KENT-WEB is a software to analyze web access logs. ACCESS REPORT contains a cross-site scripting vulnerability. This is caused by a particular method in which tags are embedded into the web page. Note that this vulnerability is different from JVN68830017. Impact An...

ThinkSNS某SNS功能极品XSS，通杀WEB和IOS客户端Ⅳ

简要描述： 一直缺少个Ⅳ，补上吧 详细说明： 这次出问题的地方仍然在主要的【日志功能】只是做了简单的字符过滤，效果不是很理想 我可以发表如下日志内容 zzR 轻松绕过 右键参看源码 红果果 漏洞证明： 然后说xsserme有个钓鱼功能就试试了 好像有点过于直白，还是说我没有使用好？ 测试是能够收到用户名密码的 不知道有没有上当的- - 接着还是不辞辛苦测试了IOS客户端 https://images.seebug.org/upload/201211/231155539c8af...

CVE-2012-0266

creationtimestamp| type| source ---|---|--- 2012-10-10 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/21841 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ntractivexcheckbof.rb 2025-02-06 03:13:40+00:00|...

CVE-2011-4640

Summary (CVE-2011-4640): A local file inclusion in WebTitan/SpamTitan prior to version 3.60 via logs-x.php (fname parameter in the view action) allows remote authenticated users to read arbitrary files by crafting a dot-dot (“..”) path. The Nuclei template confirms the vulnerability class and aff...

SourceForge Investigates Backdoor Code Found in Copy of phpMyAdmin

The popular open-source repository SourceForge is investigating how a corrupted copy of phpMyAdmin came to be served from a Korean-based mirror. Logs indicate 400 users downloaded the malicious file before it was removed from rotation today. “One of the SourceForge.net mirrors, namely...

Researcher Finds 100k IEEE.org Passwords Stored in Plain-Text on Public FTP Server

A Romanian computer scientist discovered that the Institute of Electrical and Electronics Engineers IEEE was storing its members’ usernames and passwords in plaint-text on a publically accessible file transfer protocol FTP server. Radu Drăgușin claims the collection of nearly 100,000 credentials...

Large-Scale Water Holing Attack Campaigns Hitting Key Targets

A new APT-style espionage campaign launched this summer targeting organizations tied to financial services, government agencies and the defense industry used a technique dubbed water holing to entice victims and silently redirect them to sites hosting zero-day exploits. Researchers at RSA Securit...

CVE-2012-3743

The System Logs implementation in Apple iOS before 6 does not restrict /var/log access by sandboxed apps, which allows remote attackers to obtain sensitive information via a crafted app that reads log files...

Information disclosure

The System Logs implementation in Apple iOS before 6 does not restrict /var/log access by sandboxed apps, which allows remote attackers to obtain sensitive information via a crafted app that reads log files...

CVE-2012-3743

The CVE-2012-3743 entry applies to Apple iOS prior to 6, where the System Logs implementation did not restrict sandboxed apps from reading /var/log. This allowed sandboxed apps to disclose sensitive information from system logs. The described vulnerability is an information disclosure issue with ...

CVE-2012-3743

The System Logs implementation in Apple iOS before 6 does not restrict /var/log access by sandboxed apps, which allows remote attackers to obtain sensitive information via a crafted app that reads log files...

Dr. Web Enterprise Server crossite scripting

Crossite scripting via logs...

DEBIAN-CVE-2012-2104

cgi-bin/munin-cgi-graph in Munin 2.x writes data to a log file without sanitizing non-printable characters, which might allow user-assisted remote attackers to inject terminal emulator escape sequences and execute arbitrary commands or delete arbitrary files via a crafted HTTP request...

CVE-2010-5080

The Security/changepassword URL action in SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 passes a token as a GET parameter while changing a password through email, which allows remote attackers to obtain sensitive data and hijack the session via the HTTP referer logs on a server, aka "HT...

CVE-2011-5104

Cross-site scripting XSS vulnerability in wpsc-admin/display-sales-logs.php in WP e-Commerce plugin 3.8.7.1 and possibly earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the customtext parameter. NOTE: some of these details are obtained from third party...

CVE-2011-5104

CVE-2011-5104 affects the WP e-Commerce plugin (WordPress) in the file wpsc-admin/display-sales-logs.php with a vulnerability in the custom_text parameter, allowing remote attackers to inject arbitrary script/HTML (XSS). The issue is observed in WP e-Commerce 3.8.7.1 and possibly earlier. Remedia...

ASEF Android Tool Analyzes App Security and Behavior

A researcher at Qualys has released a new tool designed to allow users–even non-technical ones–to evaluate the security and behaviors of the apps installed on their Android devices. Known as the Android Security Evaluation Framework, the tool not only looks at the general security of an app, but...

Black Hat: Phishing E-Mail Scare A False Alarm

The annual Black Hat Briefings hacker conference got off to a rocky start Sunday after thousands of registered attendees received a fishy smelling “account password reset” e-mail that contained a suspicious URL. But a message from conference organizers hours later said the errant e-mail was no...