xorg-server -- use-after-free

Alan Coopersmith reports: Pedro Ribeiro pedrib at gmail.com reported an issue to the X.Org security team in which an authenticated X client can cause an X server to use memory after it was freed, potentially leading to crash and/or memory corruption...

PoC

Pedro Ribeiro @pedrib Exploit Dum...

http-huawei-hg5xx-vuln NSE Script

Detects Huawei modems models HG530x, HG520x, HG510x and possibly others... vulnerable to a remote credential and information disclosure vulnerability. It also extracts the PPPoE credentials and other interesting configuration values. Attackers can query the URIs "/Listadeparametros.html" and...

[CORE-2010-0825] Apple OS X ATSServer CFF CharStrings INDEX Sign Mismatch

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://corelabs.coresecurity.com/ Apple OS X ATSServer CFF CharStrings INDEX Sign Mismatch 1. Advisory Information Title: Apple OS X ATSServer CFF CharStrings INDEX Sign Mismatch Advisory Id: CORE-2010-08...

Core Security Technologies Advisory 2010.0608

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://corelabs.coresecurity.com/ HP OpenView NNM OvJavaLocale Buffer Overflow Vulnerability 1. Advisory Information Title: HP OpenView NNM OvJavaLocale Buffer Overflow Vulnerability Advisory Id:...

CubeCart PHP (shipkey parameter) <= 4.3.x Remote SQL Injection

Exploit for php platform in category web applications ============================================================== CubeCart PHP shipkey parameter = 4.3.x Remote SQL Injection ============================================================== SQL Injection in CubeCart PHP Free & Commercial Shopping...

Multiple XSS and Injection Vulnerabilities in TestLink Test Management and Execution System

Advisory ID Internal CORE-2009-1013 1. Advisory Information Advisory Id: CORE-2009-1013 Advisory URL:http://www.coresecurity.com/content/testlink-multiple-injection-vulnerabilities Date published: 2009-12-09 Date of last update: 2009-12-09 Vendors contacted: TestLink Community Release mode:...

XOR Encoder

Mips Web server exploit friendly xor encoder This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasm' class MetasploitModule 'XOR Encoder', 'Description' = %q Mips Web server exploit friendly xor encoder ,...

Sql injection

SQL injection vulnerability in login.php in Pedro Santana Codice CMS allows remote attackers to execute arbitrary SQL commands via the username field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-0651

SQL injection vulnerability in login.php in Pedro Santana Codice CMS allows remote attackers to execute arbitrary SQL commands via the username field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-0651

The CVE-2008-0651 entry refers to a SQL injection vulnerability in login.php of Codice CMS, where the username field allows remote attackers to execute arbitrary SQL commands. The provided documents consistently describe this same issue, including the root cause (injection in login handling) and ...

CVE-2008-0651

SQL injection vulnerability in login.php in Pedro Santana Codice CMS allows remote attackers to execute arbitrary SQL commands via the username field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

orkutfun-xss.txt

Greetings! Doing hard searches and working hard seeking for xss holes we finally found! The new hole is in the description of the pic, you can put html encode chars like this. & l t ; meta http-equiv="refresh" content="0;url=http://suafakeaqui" & g t ; means more or close tag. So you can build...

[Full-disclosure] 0day Orkut XSS [ NEW! ]

Greetings! Doing hard searches and working hard seeking for xss holes we finally found! The new hole is in the description of the pic, you can put html encode chars like this. & l t ; meta http-equiv="refresh" content="0;url=http://suafakeaqui" & g t ; means minus or open tag. means more or close...

CVE-2006-6682

Pedro Lineu Orso chetcpasswd 2.3.3 provides a different error message when a request with a valid username fails, compared to a request with an invalid username, which allows remote attackers to determine valid usernames on the system...

CVE-2006-6680

Pedro Lineu Orso chetcpasswd before 2.3.1 does not document the need for 0400 permissions on /etc/chetcpasswd.allow, which might allow local users to gain sensitive information by reading this file...

CVE-2006-6683

Pedro Lineu Orso chetcpasswd 2.4.1 and earlier verifies and updates user accounts via custom code that processes /etc/shadow and does not follow the PAM configuration, which might allow remote attackers to bypass intended restrictions implemented through PAM...

CVE-2006-6684

The CVE-2006-6684 entry relates to a heap-based buffer overflow in Pedro Lineu Orso chetcpasswd prior to version 2.4. The vulnerability can be triggered by a long X-Forwarded-For HTTP header, allowing remote attackers to cause an application crash and, per the description, possibly execute arbitr...

CVE-2002-2220

The CVE-2002-2220 issue concerns the chetcpasswd utility in Pedro Lineu Orso’s project, where a buffer overflow affects versions before 1.12 when configured to accept connections from 0.0.0.0. The documented impact is local privilege escalation by authenticated or local users via unspecified vect...

CVE-2006-6682

Pedro Lineu Orso chetcpasswd 2.3.3 provides a different error message when a request with a valid username fails, compared to a request with an invalid username, which allows remote attackers to determine valid usernames on the system...