Facebook Status Update With XFBML Injection

Facebook Status Update With XFBML Injection i Last week Acizninja DeadcOde share Tweaking Facebook Status with HTML button. Well today he is going to share another kind of cool tricks to tweak Facebook Status Update using XFBML Injection. With this tweak, we will do an injection on Facebook URL a...

Facebook Status Update With XFBML Injection

Facebook Status Update WithXFBML Injection i Last week Acizninja DeadcOde share Tweaking Facebook Status with HTML button. Well today he is going to share another kind of cool tricks to tweak Facebook Status Update using XFBML Injection. With this tweak, we will do an injection on Facebook URL an...

BSD compress LZW decoder buffer overflow

The LZW decompressor in 1 the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and 2 compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products,...

CVE-2011-2895

The LZW decompressor in 1 the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and 2 compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products,...

Buffer overflow

Buffer overflow in the Alternate Data Stream aka ADS or named stream functionality in the backup-archive client in IBM Tivoli Storage Manager TSM before 5.4.3.4, 5.5.x before 5.5.3, 6.x before 6.1.4, and 6.2.x before 6.2.2 on Windows allows local users to gain privileges via unspecified vectors...

CVE-2011-1223

CVE-2011-1223 describes a buffer overflow in the Alternate Data Stream (ADS) / named stream handling of the IBM Tivoli Storage Manager (TSM) backup-archive client on Windows. The vulnerability affects multiple product branches: TSM client versions before 5.4.3.4, 5.5.x before 5.5.3, 6.x before 6....

kernel: sctp: fix to calc the INIT/INIT-ACK chunk length correctly to set

net/sctp/smmakechunk.c in the Linux kernel before 2.6.34, when addipenable and authenable are used, does not consider the amount of zero padding during calculation of chunk lengths for 1 INIT and 2 INIT ACK chunks, which allows remote attackers to cause a denial of service OOPS via crafted packet...

SuSE9 Security Update : Postfix (YOU Patch Number 12707)

The following bugs have been fixed : - Remote attackers could potentially exploit a memory corruption issue in postfix' SASL implementation to execute arbitrary code. CVE-2011-1720 - Also Postfix did not clear the receive buffer after the STARTTLS command. A man-in-the middle could therefore inje...

BMC Dashboards 7.6.01 - Cross-Site Scripting / Information Disclosure

source: https://www.securityfocus.com/bid/47731/info BMC Dashboards is prone to to multiple information-disclosure and cross-site scripting issues because the application fails to properly sanitize user-supplied input. A remote attacker may leverage the cross-site scripting issues to execute...

Atlassian Confluence 2.x >= 2.7 / 3.x < 3.4.9 Multiple XSS

According to its self-reported version number, the instance of Atlassian Confluence on the remote host is a 2.x version that is 2.7 or later, or else version 3.x prior to 3.4.9. It is, therefore, affected by multiple cross-site scripting vulnerabilities. Errors in the validation of input data to...

PHP_5.3.x<5.3.3_phar_stream_flush代码执行漏洞

No description provided by source...

[SECURITY] Fedora 13 Update: libxml2-2.7.7-2.fc13

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...

kernel: sctp: a race between ICMP protocol unreachable and connect()

Race condition in the sctpicmpprotounreachable function in net/sctp/input.c in Linux kernel 2.6.11-rc2 through 2.6.33 allows remote attackers to cause a denial of service panic via an ICMP unreachable message to a socket that is already locked by a user, which causes the socket to be freed and...

PHP Stream组件远程拒绝服务漏洞

BUGTRAQ ID: 46970 CVE ID: CVE-2011-1469 PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。 PHP “OpenSSL”扩展在实现上存在拒绝服务漏洞，远程攻击者可利用此漏洞使应用程序崩溃，造成拒绝服务。 MandrakeSoft Corporate Server 4.0 x8664 MandrakeSoft Corporate Server 4.0 PHP PHP 5.x 厂商补丁： PHP --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.php.net ?php $uri...

CVE-2011-1465

The SPDY implementation in net/http/httpnetworktransaction.cc in Google Chrome before 11.0.696.14 drains the bodies from SPDY responses, which might allow remote SPDY servers to cause a denial of service application exit by canceling a stream...

PT-2011-5196 · Artifex +1 · Mupdf +1

Name of the Vulnerable Software and Affected Versions: SumatraPDF version 2.1.1 MuPDF version 1.0 Description: The issue allows remote attackers to cause an integer overflow in the lex number function via a corrupt PDF file. It is also caused by a signedness error in the pdf repair obj stm functi...

telepathy-gabble stream hijacking

It's possible to hijack media stream with google:jingleinfo packet...

Operation Freedom ( OpFreedom ) - Press Release By Anonymous Hackers !

Operation Freedom OpFreedom Press Release By Anonymous Hackers ! NOTE : One More Press Released By Anonymous Hackers on there official site/Facebook/Twitter. We are Publishing This news, just as the Media of "Hacking Field" . These is No relation b/w 'The Hacker News' & 'Anonymous Hackers'. We ar...

Oracle Java XGetSamplePtrFromSnd Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Java. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The flaw exists within jsound!XGetSamplePtrFromSnd...

ZDI-11-063: Microsoft Visio 2007 LZW Stream Decompression Exception Vulnerability

ZDI-11-063: Microsoft Visio 2007 LZW Stream Decompression Exception Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-063 February 8, 2011 -- CVE ID: CVE-2011-0092 -- Affected Vendors: Microsoft -- Affected Products: Microsoft Other -- Vulnerability Details: This vulnerability allo...