Sablog-X V2. X admin permissions spoofing and arbitrary variable overwrite vulnerability-vulnerability warning-the black bar safety net

Sablog-X is a PHP and MySQL build a blog system. Affected version:Sablog-X-2. x Said First admin permission spoofing vulnerability Due to the Sablog-x v2. x the back-end authentication process there is a serious logical problem, and leads to the special structure of the cookie log in directly to...

Signing in with username with different case creates new user

We currently utilize LDAP for our user repository and allow users to be automatically added to crucible if they can successfully authenticate. We have recently received complaints from users that their names were showing up two times in reviews. After some analysis we saw that there were 2...

Java Mini Web Server 1.0 - Directory Traversal Cross-Site Scripting

Java Mini Web Server 1.0 - Directory Traversal Cross-Site Scripting Exploit Title: Java Mini Web Server | www.DigitalWhisper.co.il Software Link: http://www.jibble.org/miniwebserver/ Version: YOURXSSHEREWork?Index of %00"Work?Index of %00"Work? Work?SimpleWebServer.jar SimpleWebServer...

Java Mini Web Server 1.0 - Directory Traversal / Cross-Site Scripting

Exploit Title: Java Mini Web Server | www.DigitalWhisper.co.il Software Link: http://www.jibble.org/miniwebserver/ Version: YOURXSSHEREWork?Index of %00"Work?Index of %00"Work? Work?SimpleWebServer.jar SimpleWebServer http://www.jibble.org/ Path Traversal: A Path Traversal attack aims to access...

Java Mini Web Server <= 1.0 Path Traversal and Cross Site Scripting

Exploit for multiple platform in category remote exploits =================================================================== Java Mini Web Server | www.DigitalWhisper.co.il Software Link: http://www.jibble.org/miniwebserver/ Version: YOURXSSHEREWork?Index of %00"Work?Index of %00"Work? Work?...

Uebimiau Webmail 2.7.2 Cross Site Scripting / Path Disclosure

Exploit Title: Uebimiau Webmail | www.DigitalWhisper.co.il Software Link: http://www.uebimiau.org/ Version: = 2.7.2 Tested on: PHP Cross Site Scripting Cross-Site Scripting attacks are a type of injection problem, in which malicious scripts are injected into the otherwise benign and trusted web...

Uebimiau Webmail 2.7.2 - Multiple Vulnerabilities

Exploit Title: Uebimiau Webmail | www.DigitalWhisper.co.il Software Link: http://www.uebimiau.org/ Version: = 2.7.2 Tested on: PHP Cross Site Scripting Cross-Site Scripting attacks are a type of injection problem, in which malicious scripts are injected into the otherwise benign and trusted web...

MS10-015 Restart Issues Are the Result of Rootkit Infection

Microsoft on Thursday confirmed that the blue screen of death issues that affected a slew of users after the latest batch of Patch Tuesday updates is the result of an existing infection by the Alureon rootkit. There was widespread speculation after the patch release that simply installing the...

MOJOs IWms 7 - SQL Injection Cross-Site Scripting

MOJOs IWms 7 - SQL Injection Cross-Site Scripting Exploit Title: MOJO's IWMS | www.DigitalWhisper.co.il Software Link: http://www.mojo.co.il Version: YourXSSHere SQL Injection A SQL injection attack consists of insertion or "injection" of a SQL query via the input data from the client to the...

Researcher Warns of Twitter Security Flaw

A flaw in Twitter’s website has left the login credentials of its users vulnerable to hackers, according to a security researcher who has asked the social media company to fix the problem. Read the full story Reuters...

CVE-2009-4488

Varnish 2.0.6 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator. NOTE: the vendo...

Novell Netware CIFS / AFP Remote Memory Consumption

Application: Novell Netware CIFS And AFP Remote Memory Consumption DoS Platforms: Novell Netware 6.5 SP8 Crash: YES Exploitation: Remote DoS Date: 2009-12-21 Author: Francis Provencher Protek Research Lab's Blog: http://protekresearch.blogspot.com/ 1 Introduction 2 Report Timeline 3 Technical...

IBM Db2 db2pd Denial Of Service Vulnerability - Windows

IBM Db2 and is prone to a denial of service vulnerability. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:ibm:db2"; ifdescriptio...

3Com OfficeConnect Routers DoS (Content-Type)

Exploit for unknown platform in category dos / poc ============================================= 3Com OfficeConnect Routers DoS Content-Type ============================================= Title: 3Com OfficeConnect Routers DoS Content-Type CVE-ID: OSVDB-ID: Author: Alberto Ortega Published:...

3Com OfficeConnect Routers - 'Content-Type' Denial of Service

Model - Tested on 3Com OfficeConnect ADSL Wireless 11g Firewall Router 3CRWDR100A-72 and 3CRWDR100Y-72 Software Version - Tested on 2.06T13 Apr 2007, last version for these routers Attacker - Tested from GNU/Linux Sidux and Ubuntu and Windows 7 Exploit languaje - Ruby Type - Remote Denial of...

OpenJDK JPEG Image Writer quantization problem (6862968)

The JPEG Image Writer in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, and SDK and JRE 1.4.x before 1.4.224 allows remote attackers to gain privileges via a crafted image file, related to a "quantization problem," aka Bug Id 6862968...

OpenJDK JPEG Image Writer quantization problem (6862968)

The JPEG Image Writer in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, and SDK and JRE 1.4.x before 1.4.224 allows remote attackers to gain privileges via a crafted image file, related to a "quantization problem," aka Bug Id 6862968...

jruby-openssl Gem for JRuby fails to do proper certificate validation

A security problem involving peer certificate verification was found where failed verification silently did nothing, making affected applications vulnerable to attackers. Attackers could lead a client application to believe that a secure connection to a rogue SSL server is legitimate. Attackers...

Black Screen of Death Not Related to Microsoft Patch

The mysterious black screen of death problem that some Windows users have been experiencing in the last few days turns out not to be related to the latest round of Microsoft patches after all. Microsoft spent several days investigating claims by security vendor PrevX that the company’s latest...

Mafiaboy, Botnets and You

The botnet problem has grown to epidemic proportions, and in this video Threatpost editor Dennis Fisher talks about the roots of the problem and how it evolved into one of the larger threats on the Web...