PT-2011-14: SQL injection vulnerability in BoonEx Dolphin

Positive Research Center has discovered an SQL injection vulnerability in Dolphin 6.1. Application incorrectly validates input data. That allows attackers to conduct SQL injection attack. "SQL Injection" is a way to bypass network protection and attack the database. Settings transferred to the...

PT-2011-22: Buffer overflow in Adobe Flash Player

The specialists of the Positive Research center have revealed a buffer overflow vulnerability in Adobe Flash Player. The vulnerability allows remote attackers to execute arbitrary code. How to fix Update your software up to the latest version Advisory status 28.06.2011 - Vendor is notified...

PT-2011-13: Privilege Gaining in ManageEngine ServiceDesk Plus 8.0.0

The specialists of the Positive Research center have revealed privilege gaining vulnerability in ManageEngine ServiceDesk Plus. Insufficient privilege validation allows attackers with guest privileges account guest/guest to create a user with servicedesk administrator privileges via HTTP GET...

PT-2011-09: Arbitrary Command Execution in ManageEngine ServiceDesk Plus 8.0.0

The specialists of the Positive Research center have revealed an arbitrary code execution vulnerability in ManageEngine ServiceDesk Plus. If Microsoft SQL Server is used as application database server, insufficient validation of input settings for /CustomReporthandler.do script that is use to...

PT-2011-12: Information Disclosure in ManageEngine ServiceDesk Plus 8.0

Positive Research Center has discovered an information disclosure in ManageEngine ServiceDesk Plus. Incorrect privilege validation allows attackers with guest privileges account guest/guest to modify backup rights and use these new rights to create a backup copy in any folder. How to fix Update...

PT-2011-08: Multiple vulnerabilities in Dlink DPH 150SE/E/F1

Positive Research Center has discovered multiple vulnerabilities in Dlink DPH 150SE/E/F1 IP phone. 1. A vulnerability exists in web management interface of Dlink DPH 150SE and allows an unauthenticated user to obtain device configuration file with all the settings including administrator's...

PT-2011-11: Arbitary Files Reading in ManageEngine ServiceDesk Plus 8.0

The specialists of the Positive Research center have detected "Arbitary Files Reading" vulnerability in ManageEngine ServiceDesk Plus. Insufficient input filtering in file loading script allows unauthorized users to conduct traversal attack and load arbitrary files from a partition with ServiceDe...

PT-2011-10: Abritrary Files Loading in ManageEngine ServiceDesk Plus 8.0

The specialists of the Positive Research center have detected "Abritrary Files Loading" vulnerability in ManageEngine ServiceDesk Plus. Insufficient CSV file input filtering in user import script allows attackers with guest privileges account guest/guest overwrite an arbitrary file in bin folder ...

PT-2011-05: Cross-Site Scripting in Koha Library Software

Koha Library Software – library automation system. Vulnerability Description Positive Research Center detects XSS in Koha Library Software. Application insufficiently verifies incoming data from users in the following scripts: opac-downloadcart.pl opac-addbybiblionumber.pl opac-downloadshelf.pl...

Arachni v.0.2.3 - Open Source Web Application Security Scanner Framework

Arachni v.0.2.3 - Open Source Web Application Security Scanner Framework Arachni is a feature-full, modular, high-performance Ruby framework aimed towards helping penetration testers and administrators evaluate the security of web applications.Arachni is smart, it trains itself by learning from...

Samsung Keylogger Case Revealed As False Positive

The panic that arose yesterday about Samsung allegedly shipping laptops that contained a pre-installed keylogger turns out to have been a complete mistake after further investigation by security researchers and the company itself. In fact, the controversy was the result of a false positive from o...

PT-2011-45: Denial of Service in SAP

The specialists of the Positive Research center have detected "Denial of Service" vulnerability in SAP. A vulnerability has been reported in the SAP DIAG protocol parser, which can be exploited by attackers to cause a denial of service. How to fix Update your software up to the latest version...

PT-2011-44: Denial of Service in SAP

The specialists of the Positive Research center have detected "Denial of Service" vulnerability in SAP. A vulnerability has been reported in the SAP DIAG protocol parser, which can be exploited by attackers to cause a denial of service. How to fix Update your software up to the latest version...

PT-2011-46: Information disclosure in SAP

The specialists of the Positive Research center have detected "Information disclosure" vulnerability in SAP. An Information Leakage vulnerability exists in the way SAProuter works with dynamic memory. The cause of the leakage is that SAProuter does not clear the dynamically captured memory before...

PT-2011-47: Denial of Service in SAP

The specialists of the Positive Research center have detected "Denial of Service" vulnerability in SAP. A vulnerability has been reported in the SAP DIAG protocol parser, which can be exploited by attackers to cause a denial of service. How to fix Update your software up to the latest version...

Squid 3.1.6 DNS Reply Denial of Service

According to its banner, the version of the Squid proxy caching server installed on the remote host is 3.1.6. This version is affected by a denial of service vulnerability that is caused by an assertion failure when contacting IPv4-only DNS resolvers. Note that Nessus has relied only on the versi...

McAfee DAT 5958 Issues

US-CERT is aware of public reports indicating that McAfee DAT release 5958 is incorrectly identifying the valid system file, C:\Windows\system32\svchost.exe, as containing malicious code. Reports indicate that a false positive detection occurs on Windows XP Service Pack 3 systems. Symptoms includ...

ELDORADO CMS Multiple Vulnerabilities

---------------------------------------------------------------------- PT-2009-24 Positive Technologies Security Advisory ELDORADO CMS Multiple Vulnerabilities ---------------------------------------------------------------------- --- Affected Software ELDORADO CMS Versions up to 3.8.2 Product...

iNTERNET.cms Cross-Site Scripting vulnerability

---------------------------------------------------------------------- PT-2009-33 Positive Technologies Security Advisory iNTERNET.cms Cross-Site Scripting vulnerability ---------------------------------------------------------------------- --- Affected Software iNTERNET.cms Versions prior to...

UMI.CMS Cross-Site Scripting vulnerability

---------------------------------------------------------------------- PT-2009-12 Positive Technologies Security Advisory UMI.CMS Cross-Site Scripting vulnerability ---------------------------------------------------------------------- --- Affected Software UMI.CMS Versions 2.x prior to 2.7.1 bui...