Parallels Plesk v9.0.2b - Cross Site Scripting Vulnerability

Document Title: =============== Parallels Plesk v9.0.2b - Cross Site Scripting Vulnerability Release Date: ============= 2011-06-12 Vulnerability Laboratory ID VL-ID: ==================================== 153 Product & Service Introduction: =============================== Parallels Plesk Panel ist...

VUPEN Security Research - Oracle Java ICC Profile "ncl2" Tag Integer Overflow Code Execution Vulnerability

VUPEN Security Research - Oracle Java ICC Profile "ncl2" Tag Integer Overflow Code Execution Vulnerability http://www.vupen.com/english/research.php I. BACKGROUND --------------------- "Java is a programming language and computing platform released by Sun Microsystems now Oracle. It is the...

VUPEN Security Research - Oracle Java ICC Profile "bfd" Tag Integer Overflow Code Execution Vulnerability

VUPEN Security Research - Oracle Java ICC Profile "bfd" Tag Integer Overflow Code Execution Vulnerability http://www.vupen.com/english/research.php I. BACKGROUND --------------------- "Java is a programming language and computing platform released by Sun Microsystems now Oracle. It is the...

VUPEN Security Research - Oracle Java ICC Profile "mluc" Tag Integer Overflow Code Execution Vulnerability

VUPEN Security Research - Oracle Java ICC Profile "mluc" Tag Integer Overflow Code Execution Vulnerability http://www.vupen.com/english/research.php I. BACKGROUND --------------------- "Java is a programming language and computing platform released by Sun Microsystems now Oracle. It is the...

ZDI-11-188: Oracle Java ICC Profile ncl2 Count Tag Parsing Remote Code Execution Vulnerability

ZDI-11-188: Oracle Java ICC Profile ncl2 Count Tag Parsing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-188 June 8, 2011 -- CVE ID: CVE-2011-0862 -- CVSS: 9, AV:N/AC:L/Au:N/C:P/I:P/A:C -- Affected Vendors: Oracle -- Affected Products: Oracle Java Runtime ...

On the PHP multi-character set encoding vulnerability research-exploit warning-the black bar safety net

| First, do an experiment,in the local environment in the establishment of such a php file ? php header"Content-Type:text/html;Charset=gb2312"; echo $GET"str"; echi "br/"; echo addslashes$GET"str"; ?& gt; Here my php environment has opened the Magicquotesgpc,contemporary code inside also made to...

Time to Focus on Results-Oriented Security

The security industry is full of pernicious problems with no easy solutions. Take spam, for example. The current best defense is filtering out the obvious spam messages. Yet, the countermeasure is not a solution: As anti-spam technology gets better, spammers merely churn out more spam and achieve...

Animal husbandry star php web site management system of 0day-vulnerability warning-the black bar safety net

A small program in the holding Station is discovered this app, then across to see the source code. Tragedy just happened! admin/login.php source: ? php sessionstart; include "../include/databaseConfig.inc.php"; $admin = $POST'admin'; $pass = md5$POST'pass'; $codes = $POST'codes'; if$GET'action'...

Cross-site Scripting (XSS) Vulnerability in FanUpdate

High-Tech Bridge SA Security Research Lab has discovered vulnerability in FanUpdate which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerability in FanUpdate The vulnerability exists due to input sanitation error in the "pageTitle" parameter in...

Easewe FTP ActiveX Control Multiple Insecure Methods

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Easewe FTP OCX ActiveX Control, which can be exploited to potentially compromise a user's system. 1 Insecure methods in Easewe FTP ActiveX Control 1.1 The vulnerability is caused due to the EaseWeFtp.FtpLibrary...

RHEL 5 : gimp (RHSA-2011:0838)

Updated gimp packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

Moderate: Red Hat Security Advisory: gimp security update

Updated gimp packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

PT-2011-05: Cross-Site Scripting in Koha Library Software

Koha Library Software – library automation system. Vulnerability Description Positive Research Center detects XSS in Koha Library Software. Application insufficiently verifies incoming data from users in the following scripts: opac-downloadcart.pl opac-addbybiblionumber.pl opac-downloadshelf.pl...

ExtCalendar 2.0b2 (cal_search.php) SQL Injection Vulnerability

No description provided by source. Vulnerability ID: HTB22986 Reference: http://www.htbridge.ch/advisory/sqlinjectioninextcalendar2.html Product: ExtCalendar 2 Vendor: http://sourceforge.net/projects/extcal/ Vulnerable Version: 2.0b2 Vendor Notification: 05 May 2011 Vulnerability Type: SQL...

Extcalendar 2.0b2 - cal_search.php SQL Injection

Extcalendar 2.0b2 - calsearch.php SQL Injection Vulnerability ID: HTB22986 Reference: http://www.htbridge.ch/advisory/sqlinjectioninextcalendar2.html Product: ExtCalendar 2 Vendor: http://sourceforge.net/projects/extcal/ Vulnerable Version: 2.0b2 Vendor Notification: 05 May 2011 Vulnerability Typ...

VUPEN Security Research - 7T Interactive Graphical SCADA System (IGSS) Remote Memory Corruption

VUPEN Security Research - 7T Interactive Graphical SCADA System ODBC Remote Memory Corruption http://www.vupen.com/english/research.php I. BACKGROUND --------------------- 7T Interactive Graphical SCADA System IGSS is a state-of-the art SCADA system used for monitoring and controlling industrial...

NGS00054 Patch Notification: Lumension Device Control (formerly Sanctuary) remote memory corruption

Lumension Device Control formerly Sanctuary remote memory corruption 24/05/2011 Andy Davis of NGS Secure has discovered a high risk vulnerability in Lumension Device Control. Sending a specially crafted packet to a TCP service running on the Lumension Application Server results in a memory...

ExtCalendar 2.0b2 (cal_search.php) SQL Injection Vulnerability

Exploit for php platform in category web applications Product: ExtCalendar 2 Vendor: http://sourceforge.net/projects/extcal/ Vulnerable Version: 2.0b2 Vendor Notification: 05 May 2011 Vulnerability Type: SQL Injection Risk level: Medium Credit: High-Tech Bridge SA Security Research Lab...

Cross-site Scripting Vulnerabilities in N-13 News

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in N-13 News, which can be exploited to perform cross-site scripting attacks. 1 Cross-site scripting vulnerabilities in N-13 News 1.1 Input passed via the GET "id" parameter to index.php is not properly sanitised...

Multiple Vulnerabilities in Free Simple CMS

High-Tech Bridge SA Security Research Lab has discovered vulnerabilities in Free Simple CMS which could be exploited to perform cross-site scripting attacks and compromise vulnerable system. 1 Cross-site scripting XSS vulnerabilities in Free Simple CMS 1.1 The vulnerability exists due to input...