HP OpenView Network Node Manager ovalarm.exe Accept-Language buffer overflow

Added: 12/22/2009 CVE: CVE-2009-4179 BID: 37261 OSVDB: 60930 Background HP OpenView Network Node Manager is network availability and performance management software. Problem A buffer overflow in the ovalarm.exe CGI program allows command execution when an attacker sends an HTTP request to this...

Simplicity oF Upload 1.3.2 - Arbitrary File Upload

Exploit Title: Simplicity oF Upload 1.3.2 Remote File Upload Vulnerability Date: 20-12-2009 Author: Master Mind Software Link: http://www.phpsimplicity.com/scripts.php?id=3 Version: 1.3.2 CVE : N/A Tested on: Windows 2003 Server...

kmod, kvm security update

CentOS Errata and Security Advisory CESA-2009:1659 Updated kvm packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. KVM Kernel-based Virtual...

CVE-2009-4310

Stack-based buffer overflow in the Intel Indeo41 codec for Windows Media Player in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to execute arbitrary code via crafted compressed video data in an IV41 stream in a media file, leading to many loop iterations...

CVE-2009-4309

Heap-based buffer overflow in the Intel Indeo41 codec for Windows Media Player in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to execute arbitrary code via a large size value in a movi record in an IV41 stream in a media file, as demonstrated by an AVI...

CVE-2009-4310

Stack-based buffer overflow in the Intel Indeo41 codec for Windows Media Player in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to execute arbitrary code via crafted compressed video data in an IV41 stream in a media file, leading to many loop iterations...

CVE-2009-4313

ir3232.dll 3.24.15.3 in the Indeo32 codec in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to cause a denial of service heap corruption or execute arbitrary code via malformed data in a stream in a media file, as demonstrated by an AVI file...

Microsoft Windows ADFS服务单次登录功能认证欺骗漏洞（MS09-070）

BUGTRAQ ID: 37215 CVE ID: CVE-2009-2508 Microsoft Windows是微软发布的非常流行的操作系统。 Windows的ADFS服务没有充分地验证会话管理，如果攻击者能够访问目标用户近期所使用的用于访问提供单次登录站点的工作站和Web浏览器，就可能允许攻击者扮演为通过认证的用户。 攻击者必须可以访问终端上之前用户所使用的认证令牌才可以利用这个漏洞。在启用了HTTPS服务器的情况下，认证令牌在传输中是受保护的，攻击者必须能够访问受害者的计算机（如自助终端机）才可以利用这个漏洞。在自助终端机上，用户可能登录到ADFS SSO...

Remote code execution

Active Directory Federation Services ADFS in Microsoft Windows Server 2003 SP2 and Server 2008 Gold and SP2 does not properly validate headers in HTTP requests, which allows remote authenticated users to execute arbitrary code via a crafted request to an IIS web server, aka "Remote Code Execution...

Integer overflow

Integer overflow in the text converters in Microsoft Office Word 2002 SP3 and 2003 SP3; Works 8.5; Office Converter Pack; and WordPad in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to execute arbitrary code via a DOC file with an invalid number of property names ...

CVE-2009-3675

LSASS.exe in the Local Security Authority Subsystem Service LSASS in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote authenticated users to cause a denial of service CPU consumption via a malformed ISAKMP request over IPsec, aka "Local Security Authority Subsystem...

CVE-2009-2509

Active Directory Federation Services ADFS in Microsoft Windows Server 2003 SP2 and Server 2008 Gold and SP2 does not properly validate headers in HTTP requests, which allows remote authenticated users to execute arbitrary code via a crafted request to an IIS web server, aka "Remote Code Execution...

CVE-2009-3677

CVE-2009-3677 describes an elevation-of-privilege bypass in the Internet Authentication Service (IAS) used by Microsoft Windows products. The issue arises because MS-CHAP v2 authentication requests sent over PEAP are not properly validated, allowing remote attackers to gain access to network reso...

CVE-2009-2506

The CVE-2009-2506 issue is a memory corruption/heap overflow vulnerability in WordPad and Office text converters when parsing the DocumentSummaryInformation stream of a specially crafted Word 97 DOC file. A remote attacker could execute arbitrary code with the privileges of the logged-on user by ...

CVE-2009-2509

Active Directory Federation Services ADFS in Microsoft Windows Server 2003 SP2 and Server 2008 Gold and SP2 does not properly validate headers in HTTP requests, which allows remote authenticated users to execute arbitrary code via a crafted request to an IIS web server, aka "Remote Code Execution...

Moderate: Red Hat Security Advisory: kvm security and bug fix update

Updated kvm packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. KVM Kernel-based Virtual Machine is a full virtualization solution for Linux on...

Microsoft Security Bulletin MS09-069 - Important Vulnerability in Local Security Authority Subsystem Service Could Allow Denial of Service (974392)

Microsoft Security Bulletin MS09-069 - Important Vulnerability in Local Security Authority Subsystem Service Could Allow Denial of Service 974392 Published: December 08, 2009 Version: 1.0 General Information Executive Summary This security update resolves a privately reported vulnerability in...

Microsoft Security Advisory (954157) Security Enhancements for the Indeo Codec

Microsoft Security Advisory 954157 Security Enhancements for the Indeo Codec Published: December 08, 2009 Version: 1.0 General Information Executive Summary Microsoft is announcing the availability of an update that provides security mitigations to the Indeo codec on supported editions of Microso...

Microsoft Security Bulletin MS09-070 - Important Vulnerabilities in Active Directory Federation Services Could Allow Remote Code Execution (971726)

Microsoft Security Bulletin MS09-070 - Important Vulnerabilities in Active Directory Federation Services Could Allow Remote Code Execution 971726 Published: December 08, 2009 Version: 1.0 General Information Executive Summary This security update resolves two privately reported vulnerabilities in...

Microsoft Windows Active Directory Single Sign On Authentication Spoofing Vulnerability

Description Microsoft Windows Active Directory Federation Services ADFS is prone to an authentication-spoofing vulnerability affecting single sign-on SSO websites because it fails to properly implement session management. Successful exploits will allow attackers to authenticate to trusted servers...