MySQL 5.5 < 5.5.24 Security Bypass Vulnerability

The version of MySQL 5.5 installed on the remote host is earlier than 5.5.24 and is, therefore, affected by the following vulnerabilities : - Several errors exist related to 'GIS Extension', 'Server', 'InnoDB' and 'Server Optimizer' components that can allow denial of service attacks...

Threat Outbreak Alert: Fake Order Request Details Email Messages on May 16, 2012

Low Alert ID: 25938 First Published: 2012 May 16 14:32 GMT Version: 1 Summary Cisco Security has detected significant activity related to German-language spam e-mail messages that claim to contain order request details for the recipient. The text in the e-mail message attempts to convince the...

update for samba (important)

docs-xml: fix default name resolve order; bso7564. - s3-aio-fork: Fix a segfault in vfsaiofork; bso8836. - docs: remove whitespace in example samba.ldif; bso8789. - s3-smbd: move printbackendinit behind initsysteminfo; bso8845. - s3-docs: Prepend '/' to filename argument; bso8826. - Restrict self...

Security feature bypass

Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value and bypass the intended payment step via a modified URL, related to a "mass assignment" vulnerability...

CVE-2008-7310

CVE-2008-7310 involves Spree 0.2.0 where improper mass assignment allows an attacker to manipulate a hash to set the Order state via a modified URL, bypassing the intended payment step. The core issue is inadequate restrictions on model attribute assignment, enabling remote modification of order ...

Japan orders Google to remove auto-complete function over privacy complaint

Japan orders Google to remove auto-complete function over privacy complaint Google has been ordered to disable part of its autocomplete function in Japan after complaints it violates privacy. According to a report by The Japan Times, the court was acting on a petition accusing Google's autocomple...

Fedora Update for kanagram FEDORA-2011-13417

Check for the Version of kanagram OpenVAS Vulnerability Test Fedora Update for kanagram FEDORA-2011-13417 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

PRE PRINTING STUDIO - SQL Injection

Exploit Title: PRE PRINTING STUDIO Sql Injection Date: 16/03/2012 Author: r45c4l Email: [email protected] Script url: http://www.preprojects.com/preprojects/printing.asp Version: N/A CVE : ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::...

Wired: Courts Back Government After Tech Company Challenges National Security Letter Gag Rule

Wired’s ThreatLevel blog is digging into the story of technology companies pushing back against the government’s use of super-secret National Security Letters NSLs to collect information on “persons of interest” to the FBI earlier this year. According to the Wired account, an unnamed company – ve...

SquirrelMail: Multiple XSS flaws

Multiple cross-site scripting XSS vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to inject arbitrary web script or HTML via vectors involving 1 drop-down selection lists, 2 the greater than character in the SquirrelSpell spellchecking plugin, and 3 errors associated wit...

SquirrelMail: CSRF in the empty trash feature and in Index Order page

Multiple cross-site request forgery CSRF vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to hijack the authentication of unspecified victims via vectors involving 1 the empty trash implementation and 2 the Index Order aka optionsorder page, a different issue than...

TFTP Server 1.4 - ST 'RRQ' Remote Buffer Overflow

!/usr/bin/python --------------------------------------------------------------------------- Exploit: TFTP SERVER V1.4 ST RRQ Overflow OS: Windows XP PRO SP3 Author: b33f --------------------------------------------------------------------------- Smashing the stack for fun and practise... This tf...

India orders Net firms to censor themselves

India orders Net firms to censor themselves Some of the world's top websites will have to purge themselves of all content that is offensive to Indians by February 6. The companies must update their progress on the effort within two weeks, a court in New Delhi ordered on Saturday, the reports say...

Code injection

The PageListSort function in scripts/pagelist.php in PmWiki 2.x before 2.2.35 allows remote attackers to execute arbitrary code via PHP sequences in a crafted order parameter in a pagelist directive, leading to unintended use of the PHP createfunction function...

CVE-2011-4554

One Click Orgs before 1.2.3 allows remote authenticated users to trigger crafted SMTP traffic via 1 " double quote and newline characters in an org name or 2 " double quote characters in an e-mail address, related to a "2nd Order SMTP Injection" issue...

Sql injection

One Click Orgs before 1.2.3 allows remote authenticated users to trigger crafted SMTP traffic via 1 " double quote and newline characters in an org name or 2 " double quote characters in an e-mail address, related to a "2nd Order SMTP Injection" issue...

CVE-2011-4554

CVE-2011-4554 concerns the project’s One Click Orgs software (before version 1.2.3). The issue arises from input handling in org names (and in email addresses) that allows crafting SMTP traffic via the characters “ (double quote) and newline, and via quotes in email addresses. This is described a...

CVE-2011-4554

One Click Orgs before 1.2.3 allows remote authenticated users to trigger crafted SMTP traffic via 1 " double quote and newline characters in an org name or 2 " double quote characters in an e-mail address, related to a "2nd Order SMTP Injection" issue...

Directory traversal

Multiple directory traversal vulnerabilities in osCommerce 3.0.2 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the 1 set or 2 module parameter to a OM/Core/Site/Admin/Application/templatesmodules/pages/info.php, b...

Century wind enterprise website management system vulnerability-vulnerability warning-the black bar safety net

by Mr. DzY Century wind enterprise website management system of SME-oriented Web Site Management System,page fine,atmosphere. Having a stable set of strong,multi-function,Safety,code loading speed,web site content management, easy operation and other advantages. The use of div+css architecture,is...