CVE-2011-1829: Improper Input Validation

APT before 0.8.15.2 does not properly validate inline GPG signatures, which allows man-in-the-middle attackers to install modified packages via vectors involving lack of an initial clearsigned message...

Anonymous Shifts Attention to Big Oil, Monsanto

Just days after infiltrating military contractor Booz Allen Hamilton, hacktivist group Anonymous has confirmed they’ve set their next target: Big oil. In a post on the AnonNews website, the group has announced their intent to shift their ongoing Operation Green Rights initiative to “protest...

Amoy Royal Taobao guest security vulnerabilities and fixes-vulnerability warning-the black bar safety net

Official website: http://www.taodisoft.com 1, demo Station background turned out to have a place to upload pictures, does not prohibit the upload. 2, the upload image simple filtration, easy to break, Upload a php file, and can be executed. 3, the servervpsconfiguration severe lower, get a webshe...

CVE-2011-1765

Cross-site scripting XSS vulnerability in MediaWiki before 1.16.5, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .shtml at the end of the query string, in conjunction wit...

CVE-2011-1607

Directory traversal vulnerability in Cisco Unified Communications Manager aka CUCM, formerly CallManager 6.x before 6.15su3, 7.x before 7.15bsu3, 8.0 before 8.03asu1, and 8.5 before 8.51 allows remote authenticated users to upload files to arbitrary directories via a modified pathname in an uploa...

Cisco Unified Communications Manager Potential SQL Injection Vulnerability

Cisco Unified Communications Manager contains a vulnerability that could allow an unauthenticated, remote attacker to conduct SQL injection on a vulnerable system. The vulnerability is in a JavaServer Pages JSP script due to insufficient checks on user-supplied input. An unauthenticated, remote...

CVE-2011-1578

Cross-site scripting XSS vulnerability in MediaWiki before 1.16.3, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .html at the end of the query string, in conjunction with...

CVE-2011-1587

Cross-site scripting XSS vulnerability in MediaWiki before 1.16.4, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .html located before a ? question mark in a query string,...

CVE-2011-1578

Cross-site scripting XSS vulnerability in MediaWiki before 1.16.3, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .html at the end of the query string, in conjunction with...

CVE-2011-0701

wp-admin/async-upload.php in the media uploader in WordPress before 3.0.5 allows remote authenticated users to read 1 draft posts or 2 private posts via a modified attachmentid parameter...

Android 1.x / 2.x HTC Wildfire Local Root Exploit

/ android 1.x/2.x the real youdev feat. init local root exploit. Modifications to original exploit for HTC Wildfire Stage 1 soft-root c 2010 Martin Paul Eve Changes: -- Will not remount /system rw NAND protection renders this pointless -- Doesn't copy self, merely chmods permissions of original...

CVE-2011-0679

IBM WebSphere Portal 6.0.1.1 through 7.0.0.0, as used in IBM Lotus Web Content Management WCM and IBM Lotus Quickr for WebSphere Portal, allows remote attackers to obtain sensitive information via a "modified message."...

CVE-2011-0679: Exposure of Sensitive Information to an Unauthorized Actor

IBM WebSphere Portal 6.0.1.1 through 7.0.0.0, as used in IBM Lotus Web Content Management WCM and IBM Lotus Quickr for WebSphere Portal, allows remote attackers to obtain sensitive information via a "modified message."...

B-Cumulus Cross Site Scripting

Hello list! I want to warn you about Cross-Site Scripting vulnerability in b-cumulus. It's widget for Blogger, which is also using at separate sites. SecurityVulns ID: 11353. ------------------------- Affected products: ------------------------- Vulnerable are all versions of b-cumulus. ---------...

Web Site Crawler

Crawl a web site and store information about what was found This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Web Site Crawler', 'Description' = 'Crawl a web site and store information about what...

Security Update for Microsoft Office 2003 (KB2289187)

A security vulnerability exists in Microsoft Office 2003 that could allow arbitrary code to run when a maliciously modified file is opened. This update resolves that vulnerability...

Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2413381)

A security vulnerability exists in Microsoft Office PowerPoint Viewer 2007 that could allow arbitrary code to run when a maliciously modified file is opened. This update resolves that vulnerability...

Code injection

The Old Charts implementation in Bugzilla 2.12 through 3.2.8, 3.4.8, 3.6.2, 3.7.3, and 4.1 creates graph files with predictable names in graphs/, which allows remote attackers to obtain sensitive information via a modified URL...

PT-2010-5052

Name of the Vulnerable Software and Affected Versions Bugzilla versions 2.12 through 3.2.8 Bugzilla version 3.4.8 Bugzilla version 3.6.2 Bugzilla version 3.7.3 Bugzilla version 4.1 Description The issue allows remote attackers to obtain sensitive information via a modified URL, due to the...

CVE-2009-5008

Cisco Secure Desktop CSD, when used in conjunction with an AnyConnect SSL VPN server, does not properly perform verification, which allows local users to bypass intended policy restrictions via a modified executable file...