4399 matches found
Actions doeditpage,domovepage,docreatepage do not require XSRF token
When checking the application for security leaks, I found that the actions doeditpage, domovepage and docreatepage explicitly set the requireSecurityToken=false in the xwork.xml. This could be a possible leak in an attack scenario. Is there a reason, why these actions should not require the...
SEC Says Public Companies May Need to Disclose Attacks
The Securities and Exchange Commission has issued new guidance to help public companies determine when they may need to disclose an attack–or even a potential attack–in order to make potential investors aware of possible risks to the company’s business. The guidance, which does not constitute a...
shopex password retrieve at the newly generated password may predict vulnerability-vulnerability warning-the black bar safety net
Brief description: shopex in the password place, there are some logic design problems, the cause can be predicted the newly-generated password may be used to attack acquiring others passwords Detailed description: The relevant code /core/shop/controller/ctl. passport. php: function sendPSW...
A2CMS - index.php Local File Disclosure
A2CMS - index.php Local File Disclosure source: https://www.securityfocus.com/bid/49883/info A2CMS is prone to a local file-disclosure vulnerability because it fails to adequately validate user-supplied input. Exploiting this vulnerability would allow an attacker to obtain potentially sensitive...
Я.Инцидент: Почему я читал ваши СМС?
События прошедшего лета, связанные с утечками конфиденциальных данных в поисковые системы, прямо или косвенно коснулись каждого, кто следит за новостями, любезно предоставляемыми СМИ. Под «системный нож» попали поисковые роботы и персональные данные гражданина РФ. Копнем немного глубже и выясним,...
A2CMS - 'index.php' Local File Disclosure
source: https://www.securityfocus.com/bid/49883/info A2CMS is prone to a local file-disclosure vulnerability because it fails to adequately validate user-supplied input. Exploiting this vulnerability would allow an attacker to obtain potentially sensitive information from local files on computers...
DZ forum to blast a path summary-vulnerability warning-the black bar safety net
1, The manyou/admincp. php? mysuffix=%0A%0DSlhack 2, the ucenter/control/admin/db.php 3, the ucserver/control/admin/db.php 4, the forum.php/admin.php’/XXXXXXX.php 5, the source/class/classcore.php Excerpt from: Little Dragon blog...
Secure Boot in Windows 8 Worries Researchers
Windows 8, like Windows 7 and Vista before it, is being touted as the most secure version of Windows ever. In past releases, many of the security improvements have come through exploit mitigations such as ASLR and DEP and better software security practices during development. In Windows 8, howeve...
[20111003] - Core - Information Disclosure
Weak encryption causes potential information disclosure...
dovecot security update
1:2.0.9-2.1 - fix potential crash when parsing header names that contain NUL characters 728672...
CentOS Update for seamonkey CESA-2009:1134 centos3 i386
The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...
Huddles and Muddles
Google+’s new Huddle function is a group messaging platform that allows Google+ friends who have the G+ application to communicate en masse – Twitter-like. Beware, though: there’s a fine line between huddling and spamming. For one thing, starting a Huddle will send a text message to all your...
HP-UX Update for Java HPSBUX02685
Check for the Version of Java OpenVAS Vulnerability Test HP-UX Update for Java HPSBUX02685 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms of the G...
Unfixed Redirect vulnerability at www.milffox.com
Security researcher SaMTHG, has submitted on 06/02/2011 a Redirect vulnerability affecting www.milffox.com, which at the time of submission ranked 17473 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 11/12/2011. It is currently unfixed. If you...
Slackware current : sudo upgrade fixes a potential vulnerability
New sudo packages are available to fix a security problem which may allow users to become root, or to execute arbitrary code as root. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the associated Slackware Security Advisory. The text...
DEBIAN-CVE-2011-1492
steps/utils/modcss.inc in Roundcube Webmail before 0.5.1 does not properly verify that a request is an expected request for an external Cascading Style Sheets CSS stylesheet, which allows remote authenticated users to trigger arbitrary outbound TCP connections from the server, and possibly obtain...
ESA-2011-012: Security update for EMC NetWorker Module for Microsoft Applications
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2011-012: Security update for EMC NetWorker Module for Microsoft Applications. EMC Identifier: ESA-2011-012 CVE Identifier: CVE-2011-0647 Severity Rating: CVSS v2 Base Score: 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C Affected products: EMC NetWorker Module f...
Unfixed XSS vulnerability at doguskoleji.k12.tr
Security researcher VirtualSystEm, has submitted on 03/03/2011 a cross-site-scripting XSS vulnerability affecting doguskoleji.k12.tr, which at the time of submission ranked 26301791 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 13/12/2011. It...
Diy-Page v8. 2 two injection vulnerabilities analysis(reference EXP)-vulnerability warning-the black bar safety net
DiY-Page was founded in 2 0 0 5 year 2 the end of the month, is a new concept of a custom portal system, using which, you can easily turn the forum into a quasi-portal site. Initially it is by the software authors on the site since the creation of the home program improved, and through continuous...