kdebase kdm local file reading vulnerability

New kdebase packages are available for Slackware 10.0, 10.1, 10.2, and -current to fix a security issue with KDM the KDE login manager which could be exploited by a local attacker to read any file on the system. The official KDE security advisory may be found here:...

Update Protection against Apache Header Injection Vulnerability

A flaw has been identified in Apache 1.3.34/2.0.57/2.2.1. The flaw specifically exists in the Expect header. Attackers can exploit This flaw by appending malformed Expect headers in outgoing HTTP requests and redirect users to Web sites of their choice...

[slackware-security] mysql

New mysql packages are available for Slackware 9.1, 10.0, 10.1, 10.2 and -current to fix security issues. The MySQL packages shipped with Slackware 9.1, 10.0, and 10.1 may possibly leak sensitive information found in uninitialized memory to authenticated users. This is fixed in the new packages,...

Hidden in the conspiracy behind the browser hijack attack and Defense-bug warning-the black bar safety net

“Browser hijacking”, the popular point said is deliberately misleading browser the route of a phenomenon, a common browser hijacker phenomenon:to access the normal site is diverted to a malicious Web page, when input the wrong URL was transferred to the hijacking software the specified website,...

Cross site scripting

Microsoft Internet Explorer 5.01 through 6 does not always correctly identify the domain that is associated with a browser window, which allows remote attackers to obtain sensitive cross-domain information and spoof sites by running script after the user has navigated to another site...

CVE-2006-1191

Microsoft Internet Explorer 5.01 through 6 does not always correctly identify the domain that is associated with a browser window, which allows remote attackers to obtain sensitive cross-domain information and spoof sites by running script after the user has navigated to another site...

Microsoft Internet Explorer 5 - Address Bar Spoofing

Microsoft Internet Explorer 5 - Address Bar Spoofing source: https://www.securityfocus.com/bid/17404/info Internet Explorer is prone to address-bar spoofing. An attacker can exploit this issue to display the URI of a trusted and known site in the address bar, while running an attacker-supplied...

[Full-disclosure] SUSE Security Announcement: RealPlayer security problems (SUSE-SA:2006:018)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUSE Security Announcement Package: RealPlayer Announcement ID: SUSE-SA:2006:018 Date: Thu, 23 Mar 2006 12:00:00 +0000 Affected Products: Novell Linux Desktop 9 SUSE LINUX 10.0 SUSE LINUX 9.3 SUSE LINUX 9.2 Vulnerability Type: remote code execution...

Remote file inclusion

PHP remote file inclusion vulnerability in index.php in Top sites de PixelArtKingdom allows remote attackers to include and execute arbitrary files via the page parameter...

CVE-2006-0969

The CVE-2006-0969 entry concerns a PHP remote file inclusion vulnerability in the page parameter of index.php within Top sites de PixelArtKingdom. The underlying issue is unsafely using the page parameter in an include/require operation, enabling remote attackers to cause arbitrary file inclusion...

Adobe Macromedia Shockwave Player ActiveX installer buffer overflow vulnerability

Overview The ActiveX installer for Adobe Macromedia Shockwave contains a buffer overflow, which may allow a remote unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Shockwave Player Adobe Macromedia Shockwave Player is software that plays active web content...

phpBB2.0.19.txt

Orginal Source: http://securityreason.com/achievementsecurityalert/31 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 phpBB 2.0.19 Cross Site Request Forgeries and XSS Admin Author: Maksymilian Arciemowicz cXIb8O3 Date: 3.2.2006 from SecurityReason.Com CVE-2006-0437 for the XSS issues CVE-2006-0438...

Fee resources my methods（invasion）-vulnerability warning-the black bar safety net

In the previous article we have introduced the idea of the article, the techniques article search article and receive a new friends good feedback, the friends actively reflect the problems, the features proposed in this series of articles 末篇 then increase the Q & A article in to one reply. Below ...

CVE-2005-4481

Cross-site scripting XSS vulnerability in Polopoly 9 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters. NOTE: the vendor has disputed this vulnerability, stating that the "XSS flaw was only part of the custom implementation of the polopol...

[KAPDA::#14] - PHPPost XSS and HTML Injection

KAPDA New advisory Vendor: http://www.php-post.co.uk/ Vulnerable Version: v1.0 Bug: XSS and HTML Injection Exploitation: Remote with browser Description: -------------------- PHPP is a free message board powered by PHP and MySQL. Vulnerability: -------------------- HTML Injection: The software do...

CVE-2005-3649

jumpto.php in Moodle 1.5.2 allows remote attackers to redirect users to other sites via the jump parameter...

CVE-2002-2181

The CVE-2002-2181 entry describes a vulnerability in SonicWall Content Filtering where local users can access prohibited web sites by sending requests to a site’s IP address rather than using the domain name. The connected SonicWall PSIRT entry (SNWLID-2002-0001) mirrors this by stating that IP a...

File Including In PBLang

Class: Input Validation Error CVE: CVE-MAP-NOMATCH Remote: Yes Local: Yes Credit: Abducter [email protected] Or [email protected] Vulnerable: File Including In PBLang 4.65 ALL VERSION info PBLang IS POWER PHP SITES SUPPORT HERE http://pblang.drmartinus.de/ expliot...

File Including In FLAT NUKE

Class: Input Validation Error CVE: CVE-MAP-NOMATCH Remote: Yes Local: No Credit: Abducter [email protected] Or [email protected] Vulnerable: File Including In FLAT NUKE ALL VERSION info FLAT NUKE IS POWER PHP SITES SUPPORT HERE http://flatnuke.sourceforge.net/flatnuke expliot...

Slackware 9.0 : mod_ssl RSA blinding fixes (SSA:2003-141-05)

An upgrade for modssl to version 2.8.141.3.27 is now available. This version provides RSA blinding by default which prevents an extended timing analysis from revealing details of the secret key to an attacker. Note that this problem was already fixed within OpenSSL, so this is a 'double fix'. Wit...