CVE-2012-3497

1 TMEMCSAVEGETCLIENTWEIGHT, 2 TMEMCSAVEGETCLIENTCAP, 3 TMEMCSAVEGETCLIENTFLAGS and 4 TMEMCSAVEEND in the Transcendent Memory TMEM in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service NULL pointer dereference or memory corruption and host crash or possibly have other...

WordPress WP E-Commerce 3.8.9 SQL Injection / Cross Site Scripting

WordPress WP E-Commerce third party plugin version 3.8.9 suffers from cross site scripting and multiple remote SQL injection vulnerabilities. WordPress WP E-Commerce 3.8.9 SQL Injection / Cross Site Scripting Software: WP e-Commerce Software Language: PHP Version: 3.8.9 and below Vendor Status:...

Ad Manager Pro 4 - Local File Inclusion

-=--------------------ADVISORY-------------------=- Ad Manager Pro v. 4 Author: Corrado Liotta Aka CorryL [email protected] -=-----------------------------------------------=- -=+ Application: Ad Manager Pro -=+ Version: 4 -=+ Vendor's URL: http://www.phpwebscripts.com/ad-manager-pro/ -=+...

Fedora 16 : gallery3-3.0.4-1.fc16 (2012-9666)

Gallery 3.0.4 was released with the following release notes : After several extensive internal and external security audits which discovered 22 distinct vulnerabilities, we are releasing Gallery 3.0.4 as a security release. All of the issues require that someone with malicious intent either have ...

[SECURITY] Fedora 17 Update: sectool-0.9.5-7.fc17

sectool is a security tool that can be used both as a security audit and intrusion detection system. It consists of set of tests, library and command line interface tool. Tests are sorted into groups and security levels. Admins can run certain tests, groups or whole security levels. The library a...

WordPress 2-Click-Socialmedia-Buttons Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Wordpress Security audit 2-click-socialmedia-buttons 1. Cross-site scripting reflected Summary Severity: High Confidence: Certain Host: http://127.0.0.1 Path: /wp-content/plugins/2-click-socialmedia-buttons/libs/xing.php Issue detail The value of the...

WordPress Custom Contact Forms Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Wordpress Security audit Custom Contact Forms 1. Cross-site scripting reflected 1.1. http://127.0.0.1/wp-admin/options-general.php name of an arbitrarily supplied request parameter 1.2. http://127.0.0.1/wp-admin/options-general.php name of an...

WordPress Bad Behavior Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Wordpress Security audit bad-behavior plugin 1. Cross-site scripting reflected 1.1. http://127.0.0.1/wp-admin/options-general.php %3Cscript%3Ealert1%3C/script%3E parameter 1.2. http://127.0.0.1/wp-admin/options-general.php httpblkey parameter 1.3...

[SECURITY] Fedora 16 Update: sectool-0.9.5-7.fc16

sectool is a security tool that can be used both as a security audit and intrusion detection system. It consists of set of tests, library and command line interface tool. Tests are sorted into groups and security levels. Admins can run certain tests, groups or whole security levels. The library a...

ME Firewall Analyzer v7.2 - Cross Site Vulnerabilities

Document Title: =============== ME Firewall Analyzer v7.2 - Cross Site Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=437 Release Date: ============= 2012-03-31 Vulnerability Laboratory ID VL-ID: ==================================== 437...

YVS Image Gallery - SQL Injection

YVS Image Gallery - SQL Injection -=+ Application: YVS Image Gallery -=+ Version: 0.0.0.1 -=+ Vendor's URL: http://yvs.vacau.com/gallery.html -=+ Platform: Windows\Linux\Unix -=+ Bug type: Sql INJECTIONS -=+ Exploitation: Remote -=- -=+ Author: Corrado Liotta Aka CorryL corryl80atgmaildotcom -=+...

php source code audit of the cookies spoofing-vulnerability warning-the black bar safety net

ebycms is a mobile music cms system Direct codes admin 目录 下 的 in.php Judgment$AdminCookies is empty if not empty on landing into $AdminCookies the value of the source cookies adminnamevalue Modify cookies to bypass authentication ! !...

Security audits

A presentation on Project Basecamp was a highlight of the conference. The talk presented the findings of a volunteer-led security audit of leading programmable logic controllers PLCs. The audit found that decrepit hardware, buggy software and pitiful or nonexistent security features make thousand...

HP Facing Class Action Suit For Not Disclosing Printer Vulnerability

A class action lawsuit filed in U.S. District Court in California against Hewlett-Packard could have wide ranging implications for software makers, should the court agree with the plaintiff’s claim that the company violated the state’s consumer protection laws by failing to disclose a serious...

Issue key can be enumerated - Resolve Issue Feature

Security auditing tests performed on a Jira Bug Issue and Project Tracking Software locally running instance shown that the application is succeptible to horizontal privilege elevation attacks within the Resolve Issue feature, accessible through the given address:...

Another Dutch CA, KPN, Stops Issuing Certificates After Finding DDoS Tool On Server

Another Dutch certificate authority, KPN, has stopped issuing digital certificates after finding attack tools on a server in its Web infrastructures. The CA said that while it doesn’t have evidence right now that it’s CA infrastructure was compromised, it is taking the actions as a precaution. Th...

Mozilla Asks Firefox CAs to Audit Security Systems in Wake of DigiNotar Hack

Already having revoked trust in the root certificates issued by DigiNotar, Mozilla is taking steps to avoid having to repeat that process with any other certificate authority trusted by Firefox, asking all of the CAs involved in the root program to conduct audits of their PKIs and verify that...

Audit Report Shows Many Cracks in DigiNotar Security

A new report on the security of DigiNotar paints an ugly picture of the certificate authority’s safeguards and network infrastructure, showing that the company had all of its CA servers on one Windows domain and likely failed to separate the critical components on its network, making it easy for...

FreeBSD : nss/ca_root_nss -- fraudulent certificates issued by DigiNotar.nl (aa5bc971-d635-11e0-b3cf-080027ef73ec)

Heather Adkins, Google's Information Security Manager, reported that Google received ... reports of attempted SSL man-in-the-middle MITM attacks against Google users, whereby someone tried to get between them and encrypted Google services. The people affected were primarily located in Iran. The...

ME Firewall Analyzer v7.1 - Multiple Web Vulnerabilities

Document Title: =============== ME Firewall Analyzer v7.1 - Multiple Web Vulnerabilities Release Date: ============= 2011-09-06 Vulnerability Laboratory ID VL-ID: ==================================== 264 Product & Service Introduction: =============================== ManageEngine Firewall Analyze...