CVE-2009-3304

GForge 4.5.14, 4.7 rc2, and 4.8.2 allows local users to overwrite arbitrary files via a symlink attack on authorizedkeys files in users' home directories, related to deb-specific/sshdumpupdate.pl and cronjobs/cvs-cron/sshcreate.php...

Unfixed XSS vulnerability at www.fcs.uga.edu

Security researcher Rohit Bansal, has submitted on 12/02/2009 a cross-site-scripting XSS vulnerability affecting www.fcs.uga.edu, which at the time of submission ranked 8879 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 21/12/2011. It is...

CVE-2009-2626

The zendrestoreinientrycb function in zendini.c in PHP 5.3.0, 5.2.10, and earlier versions allows context-specific attackers to obtain sensitive information memory contents and cause a PHP crash by using the iniset function to declare a variable, then using the inirestore function to restore the...

CVE-2009-2626

The zendrestoreinientrycb function in zendini.c in PHP 5.3.0, 5.2.10, and earlier versions allows context-specific attackers to obtain sensitive information memory contents and cause a PHP crash by using the iniset function to declare a variable, then using the inirestore function to restore the...

[SECURITY] [DSA-1940-1] New php5 packages fix several issues

------------------------------------------------------------------------ Debian Security Advisory DSA-1940-1 [email protected] http://www.debian.org/security/ Stefan Fritsch November 25, 2009 http://www.debian.org/security/faq -...

Unfixed XSS vulnerability at www.melbournecup.com

Security researcher Tipidy, has submitted on 23/11/2009 a cross-site-scripting XSS vulnerability affecting www.melbournecup.com, which at the time of submission ranked 172255 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 16/12/2011. It is...

google hacking advanced applications-vulnerability warning-the black bar safety net

Commonly used google keyword: foo1 foo2 which is associated, such as search xx company xx beauty operator:foo filetype:1 2 3 Type site:foo.com relatively straightforward to see the website more interesting, you can get many unexpected information intext:foo intitle: fooltitle title Oh allinurl:fo...

CVE-2009-3933

WebKit before r50173, as used in Google Chrome before 3.0.195.32, allows remote attackers to cause a denial of service CPU consumption via a web page that calls the JavaScript setInterval method, which triggers an incompatibility between the WTF::currentTime and base::Time functions...

[SECURITY] [DSA 1928-1] New Linux 2.6.24 packages fix several vulnerabilities

---------------------------------------------------------------------- Debian Security Advisory DSA-1928-1 [email protected] http://www.debian.org/security/ Dann Frazier November 5, 2009 http://www.debian.org/security/faq - ----------------------------------------------------------------------...

CVE-2009-3864

The Java Update functionality in Java Runtime Environment JRE in Sun Java SE in JDK and JRE 5.0 before Update 22 and JDK and JRE 6 before Update 17, when a non-English version of Windows is used, does not retrieve available new JRE versions, which allows remote attackers to leverage vulnerabiliti...

proc File Descriptors Directory Permissions bypass

Exploit for unknown platform in category local exploits ================================================== proc File Descriptors Directory Permissions bypass ================================================== Title: proc File Descriptors Directory Permissions bypass CVE-ID: OSVDB-ID: Author: Pave...

[SECURITY] [DSA 1915-1] New Linux 2.6.26 packages fix several vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ---------------------------------------------------------------------- Debian Security Advisory DSA-1915-1 [email protected] http://www.debian.org/security/ dann frazier October 22, 2009 http://www.debian.org/security/faq -...

/proc Filesystem Directory Permission Bypass

Hi! This is forward from lkml, so no, I did not invent this hole. Unfortunately, I do not think lkml sees this as a security hole, so... Jamie Lokier said: a the current permission model under /proc/PID/fd has a security hole which Jamie is worried about I believe its bugtraq time. Being able to...

[SECURITY] [DSA 1909-1] New postgresql-ocaml packages provide secure escaping

------------------------------------------------------------------------ Debian Security Advisory DSA-1909-1 [email protected] http://www.debian.org/security/ Steffen Joeris October 14, 2009 http://www.debian.org/security/faq -...

SLES9: Security update for XFree86-server

The remote host is missing updates to packages that affect the security of your system. One or more of the following packages are affected: XFree86-Xnest XFree86-Xvfb XFree86-server More details may also be found by searching for keyword 5012942 within the SuSE Enterprise Server 9 patch database...

Dialysis hacking techniques of penetration of the firewall to the Shellcode-exploit warning-the black bar safety net

Summary 1. Remote shellcode several ways 2. Reuse the current connection technology of some of the issues and advantages 3. Win32 platform-specific implementation 4. Linux x86 platform specific implementation 5. AIX PowerPC platform-specific implementation Implementation introduction 1...

Unfixed XSS vulnerability at www.usenet.to

Security researcher Viper.aT, has submitted on 09/01/2009 a cross-site-scripting XSS vulnerability affecting www.usenet.to, which at the time of submission ranked 45128 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 01/02/2009. It is currently...

Unfixed XSS vulnerability at phd.deis.unibo.it

Security researcher Dark.Man, has submitted on 29/08/2009 a cross-site-scripting XSS vulnerability affecting phd.deis.unibo.it, which at the time of submission ranked 10056 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 05/07/2010. It is...

Unfixed XSS vulnerability at www.comsult.co.za

Security researcher Gamoscu, has submitted on 08/11/2009 a cross-site-scripting XSS vulnerability affecting www.comsult.co.za, which at the time of submission ranked 26252129 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 05/07/2010. It is...

Unfixed XSS vulnerability at www.watheefteuropagedaan.be

Security researcher Mystick, has submitted on 08/04/2009 a cross-site-scripting XSS vulnerability affecting www.watheefteuropagedaan.be, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 14/06/2010. It is...