tomcat: large number of parameters DoS

Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial of service CPU consumption via a request that contains many parameters and parameter values, a different vulnerability...

Unfixed XSS vulnerability at www.jager-immobilier.com

Security researcher Atmon3r, has submitted on 30/01/2012 a cross-site-scripting XSS vulnerability affecting www.jager-immobilier.com, which at the time of submission ranked 9860565 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 13/02/2012. It ...

Revamped Pwn2Own to Offer $105K in Prizes, Cash From Google for Chrome 0-Days

The Pwn2Own contest at the CanSecWest conference has become one of the landmark events on the calendar each year, as researchers gather with nervous vendors in a tiny room to see who can own which browser on which platform and how quickly. But this year’s contest will have a much different look...

Unfixed XSS vulnerability at www.annuaire.journaldupirate.com

Security researcher Atmon3r, has submitted on 16/01/2012 a cross-site-scripting XSS vulnerability affecting www.annuaire.journaldupirate.com, which at the time of submission ranked 216205 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on...

CVE-2012-0695

Multiple unspecified vulnerabilities in Google Chrome before 17.0.963.27 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown impact and attack vectors...

Design/Logic Flaw

Multiple unspecified vulnerabilities in Google Chrome before 17.0.963.27 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown impact and attack vectors...

membase-brute NSE Script

Performs brute force password auditing against Couchbase Membase servers. Script Arguments membase-brute.bucketname if specified, password guessing is performed only against this bucket. creds.service, creds.global See the documentation for the creds library. smbdomain, smbhash, smbnoguest,...

Look411.com Cross Site Scripting

WhiteHatZone Vulnerable : http://www.look411.com/ Script : alert'XSS found by Girish Shrimali'; Vulnerable link : http://www.look411.com/?p=numbersearch&q=%3Cscript%3Ealert%28%27XSS+found+by+Girish+Shrimali%27%29%3B%3C%2Fscript%3E&country=US Greetz : Vidit Baxi, Sumit Pareek...

[SECURITY] [DSA 2376-1] ipmitool security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2376-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst December 30, 2011 http://www.debian.org/security/faq -...

EchoClient

This small handy tool uses raw IP packets in to establish a connection to the target in order to see if there is any response to a echo type of packet and determine if the connection or the channel is alive an properly established. Modified by JSacco - [email protected]...

dns-blacklist NSE Script

Checks target IP addresses against multiple DNS anti-spam and open proxy blacklists and returns a list of services for which an IP has been flagged. Checks may be limited by service category eg: SPAM, PROXY or to a specific service name. Script Arguments dns-blacklist.services string containing a...

Unfixed XSS vulnerability at www.napoleoncities.eu

Security researcher Atmon3r, has submitted on 26/12/2011 a cross-site-scripting XSS vulnerability affecting www.napoleoncities.eu, which at the time of submission ranked 7163956 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 28/12/2011. It is...

Stack overflow

Multiple stack-based buffer overflows in Final Draft 8 before 8.02 allow remote attackers to execute arbitrary code via a .fdx or .fdxt file with long 1 Word, 2 Transition, 3 Location, 4 Extension, 5 SceneIntro, 6 TimeOfDay, and 7 Character elements...

[SECURITY] [DSA 2371-1] jasper security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2371-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff December 24, 2011 http://www.debian.org/security/faq -...

Unfixed XSS vulnerability at www.wnet.co.il

Security researcher Codeshift3r, has submitted on 17/12/2011 a cross-site-scripting XSS vulnerability affecting www.wnet.co.il, which at the time of submission ranked 32143 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 18/12/2011. It is...

Unfixed XSS vulnerability at www.vokrugsveta.ru

Security researcher Atmon3r, has submitted on 17/12/2011 a cross-site-scripting XSS vulnerability affecting www.vokrugsveta.ru, which at the time of submission ranked 29109 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 18/12/2011. It is...

CVE-2011-4719

Multiple unspecified vulnerabilities in Google Chrome before 16.0.912.63 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown impact and attack vectors...

tomcat: security manager restrictions bypass

Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service infinite lo...

[SECURITY] [DSA 2355-1] clearsilver security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2355-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff November 30, 2011 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2353-1] ldns security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2353-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff November 24, 2011 http://www.debian.org/security/faq -...