Hackers are exploiting a vulnerability in Microsoft Word to plant malware on Windows !

The bug in Microsoft Word 2002, 2003, 2007 and 2010 was patched Nov. 9 as part of Microsoft's monthly security update. Word 2008 and 2011 for the Mac have also been patched, but Microsoft has not yet issued a fix for the same flaw in the older Word 2004. The circulating attacks affect only Window...

MS10-087 Microsoft Word RTF pFragments Stack Buffer Overflow (File Format)

This module exploits a stack-based buffer overflow in the handling of the 'pFragments' shape property within the Microsoft Word RTF parser. All versions of Microsoft Office 2010, 2007, 2003, and XP prior to the release of the MS10-087 bulletin are vulnerable. This module does not attempt to explo...

Diggersolutions Newsletter 2.7.1 SQL Injection

Author: L0rd CrusAd3r aka VSN [email protected] Exploit Title: Diggersolutions Newsletter SQL injection Version:2.7.1 Vendor url:http://diggersolutions.com Published: 2010-11-02 Thanx to:r0073r inj3ct0r.com, Sid3^effects, MaYur, MA1201, Sonic, M4n0j,SeeMe, gunslinger, Th3 RDX. Greetz to :...

Digger Solutions NewsLetter Open Source - SQL Injection

Digger Solutions NewsLetter Open Source - SQL Injection Author: L0rd CrusAd3r aka VSN [email protected] Exploit Title: Diggersolutions Newsletter SQL injection Vulnerability Version:2.7.1 Vendor url:http://diggersolutions.com Published: 2010-11-02 Thanx to:r0073r inj3ct0r.com, Sid3^effects,...

Digger Solutions NewsLetter Open Source - SQL Injection

Author: L0rd CrusAd3r aka VSN [email protected] Exploit Title: Diggersolutions Newsletter SQL injection Vulnerability Version:2.7.1 Vendor url:http://diggersolutions.com Published: 2010-11-02 Thanx to:r0073r inj3ct0r.com, Sid3^effects, MaYur, MA1201, Sonic, M4n0j,SeeMe, gunslinger, Th3 RDX...

iDefense Security Advisory 08.10.10: Microsoft Office RTF Parsing Engine Memory Corruption Vulnerability

iDefense Security Advisory 08.10.10 http://labs.idefense.com/intelligence/vulnerabilities/ Aug 10, 2010 I. BACKGROUND Microsoft Word is a word processing application from Microsoft Office. For more information about Microsoft Word, see the following website:...

Microsoft Word RTF Data Parsing Buffer Overflow (MS10-056; CVE-2010-1902)

Microsoft Word is a popular word processing software. A remote code execution vulnerability has been identified in Microsoft Word. The vulnerability is due to insufficient data validation by Microsoft Office Word when handling rich text data. A remote attacker could trigger this flaw by convincin...

Microsoft Word RTF Parsing Engine Memory Corruption (MS10-056; CVE-2010-1901)

Microsoft Word is a popular word processing software. A remote code execution vulnerability has been identified in Microsoft Word. The vulnerability is due to insufficient data validation by Microsoft Office Word when handling rich text data. A remote attacker could trigger this flaw by convincin...

HTML 5 Comes With SQL Injection Risks

Internet Explorer 9 and Firefox 4 will support it, and Microsoft recently touted its advantages. But the upcoming version of HTML, which builds rich Internet application features into the Web programming language and shifts more Web functions to the client machine, also could open up new Web atta...

Rich Mogull on Database Security and Encryption

Dennis Fisher talks with analyst Rich Mogull of Securosis about his new report on database encryption, the value and danger of storing credit-card data and why more companies don’t get rid of sensitive data more quickly. Podcast audio courtesy of sykboy65 Subscribe to the Digital Underground...

Mandriva Update for kdepim4 MDVA-2010:013 (kdepim4)

Check for the Version of kdepim4 OpenVAS Vulnerability Test Mandriva Update for kdepim4 MDVA-2010:013 kdepim4 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under...

Rich Mogull and Mike Rothman on Security Research and Metrics

Dennis Fisher talks with Rich Mogull, Mike Rothman, David Mortman and Adrian Lane about the merger of Securosis and Security Incite, the need for better metrics in security and improving security research. Podcast audio courtesy of sykboy65 Subscribe to the Digital Underground podcast on...

PSnews Database Disclosure

======================================================================================== | Title : PSnews DB Download Vulnerability | | Author : indoushka | | email : [email protected] | | Home : Souk Naamane - 04325 - Oum El Bouaghi - Algeria -00213771818860 | | Web Site : www.iq-ty.com | |...

Design/Logic Flaw

Sophos PureMessage for Microsoft Exchange 3.0 before 3.0.2 allows remote attackers to cause a denial of service EdgeTransport.exe termination via a TNEF-encoded message with a crafted rich text body that is not properly handled during conversion to plain text. NOTE: this might be related to...

Practical Advice for Super Safe Web Browsing

By Rich Mogull Macworld As a security analyst and researcher, I often find myself exploring some of the darker corners of the Internet. In the course of staying current on security issues, I frequently must browse the sorts of Web sites no average person should go anywhere near; I’m also far more...

Rich Mogull on the Conficker Response and DLP Adoption

Dennis Fisher talks with Rich Mogull, founder of Securosis, about the behind-the-scenes effort by the Honeynet Project and others to identify Conficker-infected PCs, as well as the hype surrounding the DLP market and the level of DLP adoption. Subscribe to the Digital Underground podcast on Podca...

Qip ICQ Message Denial Of Service Vulnerability

This host is installed with QIP and is prone to denial of service vulnerability. OpenVAS Vulnerability Test $Id: gbqipicqmessagedosvuln.nasl 4869 2016-12-29 11:01:45Z teissa $ Qip ICQ Message Denial Of Service Vulnerability Authors: Nikita MR Copyright: Copyright c 2009 Greenbone Networks GmbH,...

Qip ICQ Message Denial Of Service Vulnerability

QIP is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

NextApp Echo < 2.1.1 - XML Injection

SEC Consult Security Advisory ======================================================================== title: NextApp Echo XML Injection Vulnerability program: NextApp Echo vulnerable version: Echo2 2.1.1 homepage: http://echo.nextapp.com/site/echo2 found: Feb. 2008 by: Anonymous / SEC Consult...

Design/Logic Flaw

QIP 2005 build 8082 allows remote attackers to cause a denial of service CPU consumption and application hang via a crafted Rich Text Format RTF ICQ message, as demonstrated by an \rtf\pict&& message. NOTE: the vulnerability may be in Sergey Tkachenko TRichView. If so, then this should not be...