Tough Road Ahead for Adobe on Security

Microsoft and its endless portfolio of products have been the favorite targets of attackers for more than a decade now. But if the events of the past year or so are any indication, it looks like that dubious distiniction now belongs to Adobe. The last 12 months have been rough for Adobe, the make...

Sql injection

Multiple SQL injection vulnerabilities in TheHockeyStop HockeySTATS Online 2.0 Basic and Advanced allow remote attackers to execute arbitrary SQL commands via the 1 id parameter in the viewpage action to the default URI, probably index.php, or 2 divid parameter in the schedule action to index.php...

Adobe gets its own quarterly Patch Day

Borrowing a few pages from Microsoft’s playbook, Adobe today announced plans for a quarterly Patch Day for its Reader/Acrobat product lines and new initiatives to beef up its code hardening and security response processes. Starting this summer, Adobe Reader and Acrobat security patches will be...

JVN#83428818 La!cooda WIZ and LacoodaST vulnerable to cross-site request forgery

La!cooda WIZ from System Consultants Co., Ltd. and LacoodaST from SpaceTag, Inc. are groupware providing schedule and task managements, etc. La!cooda WIZ and LacoodaST contain a cross-site request forgery vulnerability. Impact Password or other configurations may be changed if the logged in user...

JVN#31723154 LacoodaST from SpaceTag, Inc. session fixation vulnerability

LacoodaST from SpaceTag, Inc. is groupware providing schedule and task managements, etc. LacoodaST contains a session fixation vulnerability. Impact A remote attacker impersonating a logged in user could manipulate the operation with the user's privilege. As a result, disclosure or alteration of...

Secunia Research: Blue Coat K9 Web Protection Response Handling Buffer Overflows

====================================================================== Secunia Research 31/07/2008 - Blue Coat K9 Web Protection Response Handling Buffer Overflows - ====================================================================== Table of Contents Affected...

JVN#18405927 Multiple Cybozu products vulnerable to cross-site request forgery

Multiple Cybozu products contain a cross-site request forgery vulnerability. Impact If a user views a malicious web page while logged onto the Cybozu web interface, the user's schedules and other configuration settings may be altered. Solution Update the Software Apply the latest updates provided...

Groupmax Collaboration Schedule Information Disclosure Vulnerability

Overview The Schedule component in Groupmax Collaboration contains an information disclosure vulnerability where non-disclosable information can be displayed on a schedule portlet. Impact Unintended information diasclosure could occur, which an attacker could exploit for further attack. Solution...

Unfixed XSS vulnerability at www.historychannel.com.tr

Security researcher CiCoSz, has submitted on 11/08/2007 a cross-site-scripting XSS vulnerability affecting www.historychannel.com.tr, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 21/08/2007. It is...

Code injection

Unspecified vulnerability in the Groupmax Collaboration - Schedule component in Hitachi Groupmax Collaboration Portal 07-30 through 07-30-/F and 07-32 through 07-32-/C, uCosminexus Collaboration Portal 06-30 through 06-30-/F and 06-32 through 06-32-/C, and Groupmax Collaboration Web Client -...

CVE-2007-5808

Unspecified vulnerability in the Groupmax Collaboration - Schedule component in Hitachi Groupmax Collaboration Portal 07-30 through 07-30-/F and 07-32 through 07-32-/C, uCosminexus Collaboration Portal 06-30 through 06-30-/F and 06-32 through 06-32-/C, and Groupmax Collaboration Web Client -...

CVE-2007-5808

The CVE-2007-5808 entry concerns an information-disclosure vulnerability in the Schedule component of Hitachi Groupmax Collaboration Portal (and related uCosminexus/Groupmax Web Client components). The non-disclosable information could be exposed via schedule portlets, allowing remote attackers t...

CVE-2007-5808

Unspecified vulnerability in the Groupmax Collaboration - Schedule component in Hitachi Groupmax Collaboration Portal 07-30 through 07-30-/F and 07-32 through 07-32-/C, uCosminexus Collaboration Portal 06-30 through 06-30-/F and 06-32 through 06-32-/C, and Groupmax Collaboration Web Client -...

Design/Logic Flaw

Hitachi Groupmax Collaboration - Schedule, as used in Groupmax Collaboration Portal 07-32 through 07-32-/B, uCosminexus Collaboration Portal 06-32 through 06-32-/B, and Groupmax Collaboration Web Client - Mail/Schedule 07-32 through 07-32-/A, can assign schedule data to the wrong user under...

CVE-2007-4204

Hitachi Groupmax Collaboration - Schedule, as used in Groupmax Collaboration Portal 07-32 through 07-32-/B, uCosminexus Collaboration Portal 06-32 through 06-32-/B, and Groupmax Collaboration Web Client - Mail/Schedule 07-32 through 07-32-/A, can assign schedule data to the wrong user under...

CVE-2007-4204

Hitachi Groupmax Collaboration components (Schedule) across Groupmax Collaboration Portal 07-32, uCosminexus Collaboration Portal 06-32, and Groupmax Collaboration Web Client - Mail/Schedule 07-32 are affected. The issue described is that schedule data can be assigned to the wrong user under unsp...

CVE-2007-4204

Hitachi Groupmax Collaboration - Schedule, as used in Groupmax Collaboration Portal 07-32 through 07-32-/B, uCosminexus Collaboration Portal 06-32 through 06-32-/B, and Groupmax Collaboration Web Client - Mail/Schedule 07-32 through 07-32-/A, can assign schedule data to the wrong user under...

CVE-2005-4323

Unspecified vulnerability in Hitachi Cosminexus Collaboration Portal 06-00 through 06-10-/B, Groupmax Collaboration Portal 07-00 through 07-10-/B, and Groupmax Collaboration Web Client 07-00 through 07-10-/A allow remote attackers to cause a denial of service of unspecified impact via repeated...

CVE-2005-4323

CVE-2005-4323 describes an unspecified vulnerability in Hitachi Cosminexus Collaboration Portal (versions 06-00 through 06-10-/B), Groupmax Collaboration Portal (07-00 through 07-10-/B), and Groupmax Collaboration Web Client (07-00 through 07-10-/A) that allows remote attackers to cause a denial ...

PeteFinnigan.com - Oracle security advisory

Hi I have just created a security advisory for the issue I found that is fixed in Oracle latest security patch. The issue is with abuse of DIRECTORY objects and can be found here http://www.petefinnigan.com/directorytraversal.pdf - I have also updated my Oracle security alerts page to link to thi...