Rubinius Web表单哈希冲突拒绝服务漏洞

BUGTRAQ ID: 51196 Rubinius是一个运行Ruby程序的虚拟机，其带有Ruby的核心库。 Rubinius在哈希表单张贴和更新哈希表单时，哈希生成函数中存在错误，通过在HTTP POST请求中发送特制的表单，攻击者可利用此漏洞造成哈希冲突，导致较高的CPU消耗。 0 rubini 1.x 厂商补丁： rubini ------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://rubini.us/...

D-Link DNS-320 ShareCenter - Remote RebootShutdownReset (Denial of Service)

D-Link DNS-320 ShareCenter - Remote RebootShutdownReset Denial of Service !/usr/bin/perl Title: ShareCenter D-Link DNS-320 remote reboot/shutdown/reset DoS. Type: Hardware Remote: yes Author: rigan - imrigan sobachka gmail.com Tested on: Firmware : DNS320-v2.00b06 Security flaws: dskmgr.cgi allow...

HP Network Node Manager i 9.10 Cross Site Scripting

================ Cross-Site Scripting vulnerabilities in HP Network Node Manager i 9.10 Author: 0a29406d9794e4f9b30b3c5d6702c708 twitter.com/0a29 - 0a29.blogspot.com - GMail 0a2940 ================ Description: ================ Multiple XSS vulnerabilities exist within HP NNMi. In the case of GET...

Infoblox NetMRI 6.2.1 - Admin Login Page Multiple Cross-Site Scripting Vulnerabilities

Infoblox NetMRI 6.2.1 - Admin Login Page Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/50646/info Infoblox NetMRI is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in...

Infoblox NetMRI 6.2.1 - Admin Login Page Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/50646/info Infoblox NetMRI is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content. An attacker may leverage these issues to execute arbitrary...

Oracle GlassFish Server Invalid Username Cross Site Scripting (CVE-2011-2260)

A persistent cross-site scripting vulnerability has been reported in Oracle GlassFish Server. The vulnerability is due to insufficient input validation of username values. A remote attacker may exploit this vulnerability by sending a specially crafted POST request to an affected server. Successfu...

Assi website promotion system 4.0 injection vulnerability-vulnerability warning-the black bar safety net

Title: Assi website promotion system 4.0 injection vulnerability Time: 2011-10-29 Team:90sec Author: mer4en7y POST data is not filtered: if$post=="post" $dizhi=$POST'dizhi'; $youbian = $POST'youbian'; $qq = $POST'qq'; $dianhua = $POST'dianhua'; $shenfenzheng = $POST'shenfenzheng';...

Cross Site Request Forgery - Deleting User's Dashboards

Security auditing tests performed on a Jira Bug Issue and Project Tracking Software locally running instance shown that the application is succeptible to Cross-Site Request Forgery attacks within this URL:...

Cross Site Request Forgery - Deleting User's Dashboards

Security auditing tests performed on a Jira Bug Issue and Project Tracking Software locally running instance shown that the application is succeptible to Cross-Site Request Forgery attacks within this URL:...

Grand network SMS ddos attack vulnerabilities and fixes-vulnerability warning-the black bar safety net

Brief description: Grand online presence SMSddosattack vulnerability Detailed description: Grand online Forgot Password at will to the phone to send verification code, The URL: http://pwd.sdo.com/ptinfo/safecenter/getpwd/ChgPwdStepOldPwd.aspx?showbindmobile=1 Phone numbers can be arbitrarily...

IceWarp Mail Server 10.3.2 serverwebmail.php Soap Message Parsing - Arbitrary File Disclosure

IceWarp Mail Server 10.3.2 serverwebmail.php Soap Message Parsing - Arbitrary File Disclosure source: https://www.securityfocus.com/bid/49753/info IceWarp Web Mail is prone to multiple information-disclosure vulnerabilities. Attackers can exploit these issues to gain access to potentially sensiti...

IceWarp Mail Server 10.3.2 server/webmail.php Soap Message Parsing - Arbitrary File Disclosure

source: https://www.securityfocus.com/bid/49753/info IceWarp Web Mail is prone to multiple information-disclosure vulnerabilities. Attackers can exploit these issues to gain access to potentially sensitive information, and possibly cause denial-of-service conditions; other attacks may also be...

WordPress Plugin AllWebMenus 1.1.3 - Remote File Inclusion

Exploit Title: Allwebmenus Wordpress Menu Plugin Wordpress plugin RFI Google Dork: inurl:wp-content/plugins/allwebmenus-wordpress-menu-plugin Date: 09/19/2011 Author: Ben Schmidt supernothing AT spareclockcycles.org @supernothing Software Link:...

Important: Red Hat Security Advisory: JBoss Communications Platform 1.2.11 and 5.1.1 security update

An updated JBoss Web Services Native component for JBoss Communications Platform 1.2.11 and 5.1.1 that fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability...

Important: Red Hat Security Advisory: jbossws-common security update

An updated jbossws-common package that fixes one security issue is now available for JBoss Enterprise Application Platform 4.3 for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System...

Important: Red Hat Security Advisory: jbossws-common security update

An updated jbossws-common package that fixes one security issue is now available for JBoss Enterprise Web Platform 5.1.1 for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CV...

Important: Red Hat Security Advisory: jbossws-common security update

An updated jbossws-common.jar file for JBoss Enterprise Application Platform 5.1.1 that fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System...

Important: Red Hat Security Advisory: jbossws-common security update

An updated jbossws-common package that fixes one security issue is now available for JBoss Enterprise Application Platform 5.1.1 for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring...

LifeSize Room - Command Injection (Metasploit)

LifeSize Room - Command Injection Metasploit require 'msf/core' class Metasploit3 'LifeSize Room Command Injection', 'Description' = %q This module exploits a vulnerable resource in LifeSize Room versions 3.5.3 and 4.7.18 to inject OS commmands. LifeSize Room is an appliance and thus the...

CVE-2011-2720

The autocompletion functionality in GLPI before 0.80.2 does not blacklist certain username and password fields, which allows remote attackers to obtain sensitive information via a crafted POST request...