OpenClassifieds 1.7.0.3 - Chained: Captcha Bypass SQL Injection Persistent Cross-Site Scripting on FrontPage

OpenClassifieds 1.7.0.3 - Chained: Captcha Bypass SQL Injection Persistent Cross-Site Scripting on FrontPage Author:Michael Brooks Rook Application:OpenClassifieds 1.7.0.3 download: http://open-classifieds.com/download/ Exploit chain:captcha bypass-sqliinsert-persistant xss on front page If...

Sightseeing Firm Overlooks Security, 110k Credit Card Numbers Stolen

CitySights owner Twin America says the credit card details of 110,000 customers were stolen in a Web based attack and suggests it wasn’t following Payment Card Industry guidelines for storing card data. The parent company of the CitySights sightseeing tours company, Twin America LLC, said in a...

Internal Memo Outlines Gawker's Security Plan

After a hack of systems belonging to online publishing giant Gawker Media that yielded more than one million passwords, the online media company’s chief technology officer has announced new defense strategies aimed at placating their users and preventing further humiliating data breaches. Gawker...

Security Worth Buying

I’m a dirty vendor. That may not be the best way to start a serious dialogue about security product effectiveness, but I hate to read a post on security theory by some insincere tie-wearing wonk only to discover afterwards that he or she is Lord High Poobah of Marketing at “Scaring You For Profit...

Adobe Investigating New Reader Flaw

Adobe is warning users about another new vulnerability in its Reader application that causes the software to crash and could possibly lead to remote code execution as well. The new Reader bug was disclosed on Thursday on the Full Disclosure mailing list and Adobe security officials said that...

Firefox 3.5 and 3.6 Vulnerability

Mozilla has released a blog entry indicating that it is aware of a critical vulnerability affecting Firefox 3.5 and Firefox 3.6. This vulnerability may allow an attacker to execute arbitrary code. The blog entry indicates that active exploitation of this vulnerability has been detected. Update: T...

Ability to Downgrade Encryption Weakens Kerberos

Significant weaknesses in the common configuration of Kerberos-based authentication servers could allow attackers to more easily circumvent security measures in networks that rely on the open authentication standard, according to research presented at Black Hat. Read the full article. Dark Readin...

Use google for beginners looking for exercise provided the right opportunity-vulnerability warning-the black bar safety net

Article author: wade821643 Use google for beginners looking for exercise provided the right opportunity Novices generally suffer no webshell, to practice providing the right skills. Online one by one to find the loopholes yourself in the upload webshell, very trouble, in case the sql to a query f...

HP Insight Control Server Migration crossite scripting

No description provided...

Spammers Outsource CAPTCHA Decoding

Faced with stricter Internet security measures like CAPTCHAS, some spammers have begun borrowing a page from corporate America’s playbook: they are outsourcing. Read the full article. The New York Times...

Microsoft Data Access Components ActiveX Data Objects Memory Corruption Vulnerability

Description Microsoft Data Access Components are prone to a remote memory-corruption vulnerability. An attacker can exploit this issue by enticing an unsuspecting user to view a malicious webpage. Successful exploits will allow the attacker to execute arbitrary code within the context of the...

Non compliant MySQL

...

Microsoft Excel Formula Parsing Remote Code Execution Vulnerability

Description Microsoft Excel is prone to a remote code-execution vulnerability. Attackers can exploit this issue by enticing victims into opening a specially crafted Excel '.xls' file. Successful exploits can allow attackers to execute arbitrary code with the privileges of the user running the...

Gumblar: Back and Better than Ever

One of the great things about the Internet is that things can live on indefinitely. Unfortunately, that long life expectancy applies to malware, as well. The Gumblar botnet, which has been active for several months now but had quieted down somewhat, is making a comeback in a big way. IBM ISS’s...

For the udf. dll mention the right-vulnerability warning-the black bar safety net

删除 udf.dll 和 langousterudf.dll new udf. dll and langousterudf. the dll is set to read-only,permissions, limit prevents all langousterudf. dll private network mA ! Program code program code net stop mysql del %SystemRoot%\system32\udf.dll /A/F/Q del %SystemRoot%\udf.dll /A/F/Q del...

CCProxy proxy software to hide the conspiracy-bug warning-the black bar safety net

AgentServerfor everyone to solve a lot of problems, such as blocking hackers and local area network to share Internet access, etc. This article we are going to discuss one out on the proxy server vulnerability, hope that the network can be given a certain attention. In order to reveal this...

Host Directory PRO 2.1.0 Password Changer

change password Host Directory PRO 2.1.0 Configuration Web Interface Password Admin Email Receive Authorize.Net On Off Authorize login Authorize transactionKey...

Registry and Group Policy Backdoor found letters-vulnerability warning-the black bar safety net

The measured record. Interested in the binding a bit, maybe get out of the back door placement tips Quiet import regedit /s . reg Method one, cancel sticky keys REG import with. reg Windows Registry Editor Version 5.00 HKEYCURRENTUSER\Control Panel\Accessibility\StickyKeys "Flags"="5 0 6"...

Port scanners settings

This plugin configures miscellaneous global variables for Nessus port scanners. It does not perform any security check. C Tenable Network Security, Inc. @PREFERENCES@ include"compat.inc"; ifdescription scriptid33812; scriptversion "$Revision: 1.7 $"; scriptcvsdate"$Date: 2011/03/21 18:19:28 $";...

Paper by Amit Klein (Trusteer): "PowerDNS Recursor DNS Cache Poisoning [pharming]"

Hello BugTraq Once again, a DNS cache poisoning against a popular DNS cache server. This time, it's PowerDNS the third most popular DNS server, servicing over 40 million users. The vendor coded several impressive security measures against DNS spoofing e.g. UDP source port randomization and spoofe...