CVE-2012-6501

The KillProcess method in the HP PKI ActiveX control HPPKI.ocx before 1.2.0.1 allows remote attackers to cause a denial of service kill process via the partial or full name of a process...

RedHat Update for gtk2 RHSA-2013:0135-01

Check for the Version of gtk2 OpenVAS Vulnerability Test RedHat Update for gtk2 RHSA-2013:0135-01 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms o...

CVE-2012-4823

Unspecified vulnerability in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and earlier, Java 6 SR11 and earlier, Java 5 SR14 and earlier, and Java 142 SR13 FP13 and earlier; as used in IBM Rational Host On-Demand, Rational Change, Tivoli Monitoring, Smart Analytics System 5600,...

Ruby On Rails XML Processor YAML Deserialization Code Execution

This Metasploit module exploits a remote code execution vulnerability in the XML request processor of the Ruby on Rails application framework. This vulnerability allows an attacker to instantiate a remote object, which in turn can be used to execute any ruby code remotely in the context of the...

CVE-2012-4820

CVE-2012-4820 affects IBM Java Runtime used in IBM WebSphere Real Time and other IBM products. The issue arises when code runs under a security manager, allowing remote attackers to escalate privileges by abusing insecure use of java.lang.reflect.Method invoke(). Affected IBM JREs include release...

gtk2 security update

CentOS Errata and Security Advisory CESA-2013:0135 Updated gtk2 packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System CVS...

Ruby on Rails XML Processor YAML Deserialization Scanner

This module attempts to identify Ruby on Rails instances vulnerable to an arbitrary object instantiation flaw in the XML request processor. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Ruby ...

Mozilla: Address space layout leaked in XBL objects (MFSA 2013-11)

The XBL.proto.toString implementation in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 makes it easier for remote attackers to bypass the ASLR...

RHEL 5 : gtk2 (RHSA-2013:0135)

Updated gtk2 packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity ratin...

Ruby on Rails XML Processor YAML Deserialization Code Execution

This module exploits a remote code execution vulnerability in the XML request processor of the Ruby on Rails application framework. This vulnerability allows an attacker to instantiate a remote object, which in turn can be used to execute any ruby code remotely in the context of the application...

CVE-2012-4549

A flaw was found in JBoss Enterprise Application Platform. The processInvocation function within the org.jboss.as.ejb3.security.AuthorizationInterceptor component incorrectly authorizes all requests when no roles are defined for an Enterprise Java Beans EJB method invocation. This allows attacker...

YourPHP CMS several security vulnerabilities and repair method-vulnerability warning-the black bar safety net

YourPHP CMS now online also no, the official Demo is not yet up, but last night found that map, do not say The first place ! Linux root directory ! The amount of this is a bunch of sub-directories, you can next to the station to see ! Screenshot of the address the order, but does not affect the...

Linux/x86 - Bind TCP (1111/TCP) Shell + GetPC/Call/Ret Method + Null-Free Shellcode (89 bytes)

Linux/x86 - Bind TCP 1111/TCP Shell + GetPC/Call/Ret Method + Null-Free Shellcode 89 bytes. Shellcode exploit for Linuxx86 platform / Shell Bind TCP GetPC/Call/Ret Method - C Language Linux/x86 Written in 2013 by Geyslan G. Bem, Hacking bits http://hackingbits.com [email protected] This source is...

Netwin SurgeFTP Remote Command Execution Vulnerability

Exploit for multiple platform in category remote exploits This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framewor...

[WiFi Password Decryptor] Free Wireless Password Recovery Software

| WiFi Password Decryptor is the FREE software to instantly recover Wireless account passwords stored on your system. --- It automatically recovers all type of Wireless Keys/Passwords WEP/WPA/WPA2 etc stored by Windows Wireless Configuration Manager. For each recovered WiFi account, it displays...

Ruby on Rails find_by_* Methods Authlogic SQL Injection Bypass

Due to the way dynamic finders in Active Record extract options from method parameters, a method parameter can mistakenly be used as a scope. Carefully crafted requests can use the scope to inject arbitrary SQL...

JBoss Enterprise Application Platform 安全绕过漏洞(CVE-2012-4549)

Bugtraq ID:56990 CVE ID:CVE-2012-4549 JBOSS是一个基于J2EE的开放源代码的应用服务器。 在不允许任何角色调用EJB方法时，需要拒绝所有用户的调用。当允许角色列表为空时，org.jboss.as.ejb3.security.AuthorizationInterceptor中的processInvocation方法不正确授权方法调用，允许攻击者绕过安全限制执行未授权操作。 0 JBoss Enterprise Application Platform 6 厂商解决方案 JBoss Enterprise Application Platform...

Honeywell HMIWeb Browser ActiveX Control RequestDSPLoad Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Honeywell HMIWeb. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the ActiveX...

Struts2 vulnerability analysis of the Ongl code to perform the analysis-vulnerability warning-the black bar safety net

A, brief 2 0 1 0 year 7 on exploitdb broke the Struts2/XWork 2.2.0 Remote Command Execution Vulnerability action, can be called God-like vulnerability, an attacker would just construct the appropriate statement, there is a great chance to gain system permissions for System or root because tomcat ...

JBoss Enterprise Application Platform: org.jboss.as.ejb3: JBoss Enterprise Application Platform: Access restriction bypass via improper EJB method authorization

A flaw was found in JBoss Enterprise Application Platform. The processInvocation function within the org.jboss.as.ejb3.security.AuthorizationInterceptor component incorrectly authorizes all requests when no roles are defined for an Enterprise Java Beans EJB method invocation. This allows attacker...