WinZip FileView ActiveX control unsafe method

Added: 11/27/2006 CVE: CVE-2006-5198 BID: 21060 OSVDB: 30433 Background WinZip includes the FileView ActiveX control which provides a user interface similar to the file view pane in Windows Explorer. Problem The FileView ActiveX control is marked "safe for scripting" and exposes several unsafe...

WinZip FileView ActiveX control unsafe method

Added: 11/27/2006 CVE: CVE-2006-5198 BID: 21060 OSVDB: 30433 Background WinZip includes the FileView ActiveX control which provides a user interface similar to the file view pane in Windows Explorer. Problem The FileView ActiveX control is marked "safe for scripting" and exposes several unsafe...

FreeBSD : plone -- unprotected MembershipTool methods (b6c18956-5fa3-11db-ad2d-0016179b2dd5)

The Plone Team reports : Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the : - changeMemberPortrait - deletePersonalPortrait - testCurrentPassword methods, which allows remote attackers to modify portraits. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text...

CVE-2006-4982

Cisco NAC maintains an exception list that does not record device properties other than MAC address, which allows physically proximate attackers to bypass control methods and join a local network by spoofing the MAC address of a different type of device, as demonstrated by using the MAC address o...

Compilation“free kill”the basics detailed explanation-vulnerability warning-the black bar safety net

A. Machine code,also called machine code. ultraedit open,edit exe file you will see Many by 0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F consisting of digital,these digital Is machine code. Modify the program must be by modifying the machine code to modify the exe file. II. Need to master the entire compilati...

Technical note by Amit Klein: "Sending arbitrary HTTP requests with Flash 7/8 (+IE 6.0)"

Sending arbitrary HTTP requests with Flash 7/8 +IE 6.0 Amit Klein, August 2006 The trick ========= In 1, I showed how to forge parts of HTTP requests containing CRs and LFs using Flash. In that write-up, the data was part of the HTTP body section. However, combining the Content-Length overriding...

FreeBSD : postgresql -- encoding based SQL injection (17f53c1d-2ae9-11db-a6e2-000e0c2e438a)

The PostgreSQL development team reports : An attacker able to submit crafted strings to an application that will embed those strings in SQL commands can use invalidly-encoded multibyte characters to bypass standard string-escaping methods, resulting in possible injection of hostile SQL commands...

Ruby Safe Level security bypass

"alias" can be exploited to replace safe function, directory access protection bypass. Few potentially dangerous methods are not limited...

Mozilla Thunderbird: Multiple vulnerabilities

Background The Mozilla Thunderbird mail client is a redesign of the Mozilla Mail component. The goal is to produce a cross-platform stand-alone mail application using XUL XML User Interface Language. Description The following vulnerabilities have been reported: Benjamin Smedberg discovered that...

security flaw

Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allows remote attackers to hijack native DOM methods from objects in another domain and conduct cross-site scripting XSS attacks using DOM methods of the top-level object...

security flaw

Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allows remote attackers to hijack native DOM methods from objects in another domain and conduct cross-site scripting XSS attacks using DOM methods of the top-level object...

DEBIAN-CVE-2006-3802

Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allows remote attackers to hijack native DOM methods from objects in another domain and conduct cross-site scripting XSS attacks using DOM methods of the top-level object...

CVE-2006-3802

Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allows remote attackers to hijack native DOM methods from objects in another domain and conduct cross-site scripting XSS attacks using DOM methods of the top-level object...

security flaw

Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allows remote attackers to hijack native DOM methods from objects in another domain and conduct cross-site scripting XSS attacks using DOM methods of the top-level object...

WMNews 0.2a - 'base_datapath' Remote File Inclusion

Advisory: WMNews Remote File Include Vulnerability Release Date: 2006/07/26 Author: uNfz Critical Level: High Contact: [email protected] Vendor: Warta Mikael -------------------- -------------------- Searching / Dork: allinurl: .php?Artid= allinurl: .php?ArtCat= allinurl: wmprint.php allinurl:...

Security Best Practice: Familiarize Yourself with the HTTP Methods Protection

The HTTP RFC allows a restricted set of HTTP methods. However, even some of the standard methods are unsafe, because they can be used to exploit vulnerabilities on a web server. Many of the non-standard methods have a very bad security record. Microsoft WebDAV methods, for example, have certain...

ruby -- multiple vulnerabilities

Secunia reports: Two vulnerabilities have been reported in Ruby, which can be exploited by malicious people to bypass certain security restrictions. An error in the handling of the "alias" functionality can be exploited to bypass the safe level protection and replace methods called in the trusted...

No smoke of war: a network is disabled with the breakthrough limit-vulnerability warning-the black bar safety net

Now, in order to improve work efficiency, many units want to do, including 网禁 stop users use QQ, MSN, lianzhong and other chat software; at the same time, lonely users also find ways to deal with these measures. The two-phase contest, who stands where. it? For QQ, MSN, ourgame such as chat and...

USN-303-1: MySQL vulnerability

An SQL injection vulnerability has been discovered when using less popular multibyte encodings such as SJIS, or BIG5 which contain valid multibyte characters that end with the byte 0x5c the representation of the backslash character ''''''...

How to let someone in Trojan－Trojan a commonly used trick Daguan-vulnerability warning-the black bar safety net

How to let others in the Trojan horse? It is the users who ask the most questions, sketchy answers there are some, but always very little, so the small fish decided to collect everyone's wisdom and Next a little experience to write a feature article. Hope that you get to the floor, perfect this...