NSFOCUS SA2009-03 : Windows Kernel Malformed PE File Remote DoS Vulnerability

NSFOCUS Security Advisory SA2009-03 Windows Kernel Malformed PE File Remote DoS Vulnerability Release Date: 2009-10-16 CVE ID: CVE-2009-2516 http://www.nsfocus.com/en/advisories/0903.html Affected system: ============== Microsoft Windows XP Microsoft Windows 2000 Microsoft Windows 2003 Microsoft...

SA-CONTRIB-2009-066 - Organic Groups - Cross Site Scripting

The Organic Groups OG module provides a way to organize users and content into groups. When displaying group nodes, the module does not properly sanitize all user-entered text, leading to a cross-site scripting XSS vulnerability. Users with permission to create or edit groups nodes which may be a...

SA-CONTRIB-2009-067 Dex module - Cross Site Scripting, no longer maintained

The Dex: Contact Information Manager module enables contact information management with Google Maps and Yahoo Maps compatible geocoding. The module suffers from a Cross Site Scripting XSS vulnerability. Such an attack may lead to a malicious user gaining full administrative access. This module is...

SA-CONTRIB-2009-063 - XML sitemap - Cross Site Scripting

The XML sitemap module creates a sitemap that conforms to the sitemaps.org specification. It also allows users with the 'administer site configuration' permission to add additional custom links to be included in the sitemap. In the additional links interface, the module does not properly sanitize...

SA-CONTRIB-2009-065 - Browscap - Cross Site Scripting

The Browscap module provides a way to identify the visitors to your site based on the user agent in their browser. It can also record these user agent strings and provide reports about them. When displaying reports about visitors, the module does not properly sanitize the user agent strings befor...

[ONSEC-09-017] Blogolet PHP including

ONSEC-09-017 Blogolet PHP including Цель: Blogolet CMS Тип: PHP инъекция Угроза: Высокая Дата обнаружения: 21.09.2009 Дата оповещения разработчика: 21.09.2009 Дата выхода исправления: 21.09.2009 Автор: Vladimir Vorontsov OnSec Russian Security Group onsec dot ru Описание: Уязвимость существует...

SA-CONTRIB-2009-060 - Meta tags (Nodewords) - Access bypass

The Meta tags also known as Nodewords module provides meta tags based on node titles. In certain conditions, the node meta tags were not respecting access permissions, potentially exposing content not available otherwise. Versions affected Meta tags for Drupal 6.x before Meta tags 6.x-1.1 Drupal...

SA-CONTRIB-2009-062 - Devel - Cross Site Scripting

The Devel module contains many useful developer functions, such as a query log and the display of variables. When using the variable editor, the module does not properly sanitize the output of the variable name before display, leading to a cross-site scripting XSS vulnerability. Such an attack ma...

Fedora 10 : drupal-6.14-1.fc10 (2009-9751)

Fixes SA-CORE-2009-008 http://drupal.org/node/579482 Remember to log in to your site as the admin user before upgrading this package. After upgrading the package, browse to http://host/drupal/update.php to run the upgrade script. Multiple vulnerabilities and weaknesses were discovered in Drupal...

Linux Kernel PER_CLEAR_ON_SETID personality bypass

No description provided by source. / 14.08.2009, babcia padlina vulnerability discovered by google security team some parts of exploit code borrowed from vmsplice exploit by qaaz persvr4 mmap zero technique developed by Julien Tinnes and Tavis Ormandy:...

Soritong MP3 Player 1.0 Overflow

""""""""""""""""""""""""""""""""""""""""""""""""""""""""""" """ :::::: :: :: :: :: :: :::: """ """ :: :: :: :: :::::: .. :::: :: """ """ ::::: ::: ::::: :: :: :: :: :: :::: """ """ :: :: :: :: : :: :: :: :: :: :: """ """ :::::: :: :: ::::: :: :::::: :: :: :::: rs.ir """ """ :: """ """ """...

Linux Kernel < 2.6.19 udp_sendmsg Local Root Exploit

No description provided by source. / hoagieudpsendmsg.c LOCAL LINUX KERNEL ROOT EXPLOIT 2.6.19 - CVE-2009-2698 udpsendmsg bug exploit via output callback function used in dstentry / rtable Bug reported by Tavis Ormandy and Julien Tinnes of the Google Security Team Tested with Debian Etch r0 $ cat...

Linux Kernel 2.6.19 (Debian 4) - udp_sendmsg Local Privilege Escalation (3)

Linux Kernel 2.6.19 Debian 4 - udpsendmsg Local Privilege Escalation 3 / hoagieudpsendmsg.c LOCAL LINUX KERNEL ROOT EXPLOIT include include include include include include include include / this code will be called from NFHOOK via output callback in kernel mode / void setcurrenttaskuidsgidstozero...

RedHat Security Advisory RHSA-2009:1233

The remote host is missing updates announced in advisory RHSA-2009:1233. The kernel packages contain the Linux kernel, the core of any Linux operating system. These updated packages fix the following security issues: a flaw was found in the SOCKOPSWRAP macro in the Linux kernel. This macro did no...

RedHat Security Advisory RHSA-2009:1222

The remote host is missing updates announced in advisory RHSA-2009:1222. The kernel packages contain the Linux kernel, the core of any Linux operating system. These updated packages fix the following security issues: a flaw was found in the SOCKOPSWRAP macro in the Linux kernel. This macro did no...

RedHat Security Advisory RHSA-2009:1223

The remote host is missing updates announced in advisory RHSA-2009:1223. The kernel packages contain the Linux kernel, the core of any Linux operating system. These updated packages fix the following security issues: a flaw was found in the SOCKOPSWRAP macro in the Linux kernel. This macro did no...

Discuz! Plugin JiangHu 1.1 - 'id' SQL Injection

========================================================= Discuz! Plugin JiangHu = 1.1 Sql injection Vulnerability ========================================================= ========================Author========================= + Founded : ZhaoHuAn + Contact : ZhengXingatshandagamesdotcom + Blog...

Linux Kernel < 2.6.19 (Debian 4) - 'udp_sendmsg' Local Privilege Escalation (3)

/ hoagieudpsendmsg.c LOCAL LINUX KERNEL ROOT EXPLOIT include include include include include include include include / this code will be called from NFHOOK via output callback in kernel mode / void setcurrenttaskuidsgidstozero asm"push %eax\n" "movl $0xffffe000, %eax\n" "andl %esp, %eax\n" "movl...

Discuz! Plugin JiangHu 1.1 - id SQL Injection

Discuz! Plugin JiangHu 1.1 - id SQL Injection ========================================================= Discuz! Plugin JiangHu = 1.1 Sql injection Vulnerability ========================================================= ========================Author========================= + Founded : ZhaoHuAn +...

Linux Kernel < 2.6.19 udp_sendmsg Local Root Exploit

Exploit for linux platform in category local exploits ==================================================== Linux Kernel include include include include include include include...