JBoss Enterprise Application Platform: JBoss EAP: JBEAP: JBoss Enterprise Application Platform: Unauthorized EJB access via authorization module bypass

A flaw was found in JBoss Enterprise Application Platform. When role-based authorization is used for Enterprise Java Beans EJB access, the system does not correctly call the necessary authorization modules. This prevents Java Authorization Contract for Containers JACC permissions from being...

JBoss Enterprise Application Platform: JBoss EAP: JBEAP: JBoss Enterprise Application Platform: Unauthorized EJB access via authorization module bypass

A flaw was found in JBoss Enterprise Application Platform. When role-based authorization is used for Enterprise Java Beans EJB access, the system does not correctly call the necessary authorization modules. This prevents Java Authorization Contract for Containers JACC permissions from being...

Joomla modules - pm_advancedsearch4 Arbitrary File Upload Vulnerabilit

Exploit for php platform in category web applications ------------------------------------------------------------------------------- Joomla modules - pmadvancedsearch4 Arbitrary File Upload Vulnerability -------------------------------------------------------------------------------- Author =...

Multiple critical vulnerabilities in Maxthon and Avant browsers

Hi, Below you can find a short summary of discovered vulnerabilities in Maxthon and Avant browsers. Such vulnerabilities were demonstrated during HITBAMS2012 security conference and more recently at HackPra. Affected Products - Maxthon www.maxthon.com - Avant Browser www.avantbrowser.com Security...

[VSD] (Virtual Section Dumper) Just another Virtual Section Dumper for Windows Processes

What's VSD? VSD Virtual Section Dumper is intented to be a tool to visualize and dump the memory regions of a running 32 bits or a 64 bits process in many ways. For example, you can dump the entire process and fix the PE Header , dump a given range of memory or even list and dump every virtual...

CVE-2012-5909

SQL injection vulnerability in admin/modules/user/users.php in MyBB aka MyBulletinBoard 1.6.6 allows remote attackers to execute arbitrary SQL commands via the conditionsusergroup parameter in a search action to admin/index.php...

CVE-2012-5908: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/modules/user/users.php in MyBB aka MyBulletinBoard 1.6.6 allows remote attackers to inject arbitrary web script or HTML via the conditionsusergroup parameter in a search action to admin/index.php...

CVE-2012-5909: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/modules/user/users.php in MyBB aka MyBulletinBoard 1.6.6 allows remote attackers to execute arbitrary SQL commands via the conditionsusergroup parameter in a search action to admin/index.php...

dotProject <= 2.1.6 Remote File Inclusion Vulnerability

Exploit for php platform in category web applications Discovered by dun \ posdubatgmail.com 2012-11-13 dotProject = 2.1.6 Remote File Inclusion Vulnerability Script: "PHP web-based project management framework that includes modules for companies, projects, tasks with Gantt charts, forums, files,...

[BeEF 0.4.3.8] Browser Exploitation Framework

The Browser Exploitation Framework BeEF is a powerful professional security tool. It is a penetration testing tool that focuses on the web browser. BeEF is pioneering techniques that provide the experienced penetration tester with practical client side attack vectors. Unlike other security...

VLC Media Player TiVo Demuxer Double Free Vulnerability (Mac OS X)

This host is installed with VLC Media Player and is prone to double free vulnerability. OpenVAS Vulnerability Test $Id: gbvlcmediaplayerdemuxerdoublefreevulnmacosx.nasl 5988 2017-04-20 09:02:29Z teissa $ VLC Media Player TiVo Demuxer Double Free Vulnerability Mac OS X Authors: Antu Sanadi...

Double free

Double free vulnerability in the getchunkheader function in modules/demux/ty.c in VideoLAN VLC media player 0.9.0 through 1.1.12 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted TiVo TY file...

CVE-2011-5214

CVE-2011-5214 concerns multiple cross-site scripting (XSS) vulnerabilities in BrowserCRM, affecting version 5.100.01 and earlier. The issue allows remote attackers to inject arbitrary script or HTML via: (1) PATH_INFO to index.php, (2) modules/admin/admin_module_index.php, (3) modules/calendar/cu...

CVE-2011-5213: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in BrowserCRM 5.100.01 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 loginusername parameter to index.php, 2 parentid parameter to modules/Documents/versionlist.php, or 3 contactid parameter to modules/Documents/index.php...

Ubuntu 8.04 LTS : python2.5 vulnerabilities (USN-1613-1)

It was discovered that Python would prepend an empty string to sys.path under certain circumstances. A local attacker with write access to the current working directory could exploit this to execute arbitrary code. CVE-2008-5983 It was discovered that the audioop module did not correctly perform...

USN-1613-2: Python 2.4 vulnerabilities

USN-1613-1 fixed vulnerabilities in Python 2.5. This update provides the corresponding updates for Python 2.4. Original advisory details: It was discovered that Python would prepend an empty string to sys.path under certain circumstances. A local attacker with write access to the current working...

[SECURITY] Fedora 17 Update: dracut-018-105.git20120927.fc17

Dracut contains tools to create a bootable initramfs for 2.6 Linux kernels. Unlike existing implementations, dracut does hard-code as little as possible into the initramfs. Dracut contains various modules which are driven by the event-based udev. Having root on MD, DM, LVM2, LUKS is supported as...

Novell File Reporter NFRAgent.exe VOL tag buffer overflow

Added: 10/12/2012 BID: 55268 OSVDB: 85503 Background Novell File Reporter is software that allows network administrators to identify files stored on the network and generates reports regarding the size of individual files, file type, when files were last accessed, and where duplicates exist...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Fork CMS before 3.2.7 allow remote attackers to inject arbitrary web script or HTML via the term parameter to 1 autocomplete.php, 2 search/ajax/autosuggest.php, 3 livesuggest.php, or 4 save.php in frontend/modules/search/ajax...

CVE-2012-5164: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Fork CMS before 3.2.7 allow remote attackers to inject arbitrary web script or HTML via the term parameter to 1 autocomplete.php, 2 search/ajax/autosuggest.php, 3 livesuggest.php, or 4 save.php in frontend/modules/search/ajax...