0Day Remote Password Reset Vulnerability in MSN Hotmail patched

Microsoft's MSN Hotmail Live email service currently hosts over 350 million unique users. A Vulnerability Laboratory senior researcher, Benjamin Kunz Mejri, identified a critical security vulnerability in Microsoft's official MSN Hotmail Live service. A critical vulnerability was found in the...

Nmap NSE net: hostmap

Tries to find hostnames that resolve to the target's IP address by querying the online database at http://www.bfk.de/bfkdnslogger.html. The script is in the 'external' category because it sends target IPs to a third party in order to query their database. SYNTAX: hostmap.prefix: If set, saves the...

Nmap NSE net: http-php-version

Attempts to retrieve the PHP version from a web server. PHP has a number of magic queries that return images or text that can vary with the PHP version. This script uses the following queries: '/?=PHPE9568F36-D428-11d2-A769-00AA001ACF42': gets a GIF logo, which changes on April Fool's Day...

[G-SEC 46-2009] Computer Associates multiple products arbritary code execution

Computer Associates CA Anti-Virus Multiple products - arbitrary code execution Release mode : Coordinated Reference : GSEC-46-2009 - Computer Associates multiple products RCE WWW : http://blog.g-sec.lu/2009/10/computer-associates-multiple-products.html Vendor : http://www.ca.com Status : Patched...

SQL Injection vulnerabilities in Subdreamer CMS

Background information: This report applies to Subdreamer newest stable release, 2.5.3.2 hotfix5. Subdreamer is a content management system, which is written in PHP and uses MySQL as its database backend. Subdreamer's home page is http://www.subdreamer.com Subdreamer can be integrated with...

Jose Nazario on botnets and DDoS defense

Few people in the world know more about the internal workings of botnets, DDoS attacks and defense than Jose Nazario, a senior security researcher at Arbor Networks. Don’t miss his thoughts on why DDoS attacks are more prevalent in some regions than others and how to react if you’re attacked...

[Full-Disclosure] Race conditions in security dialogs

I discovered arbitrary code execution holes in Mozilla, Internet Explorer, and Opera that involve human reaction time. One version of the attack works like this: the page contains a captcha displaying the word "only" and asks you to type the word to verify that you are a human. As soon as you typ...