CVE-2010-2692: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in 2daybiz Custom T-Shirt Design Script allows remote attackers to inject arbitrary web script or HTML via a review comment...

Fedora 12 : asterisk-1.6.1.17-1.fc12 (2010-3381)

Update to 1.6.1.17 AST-2010-003: Invalid parsing of ACL rules can compromise security AST-2010-002: This security release is intended to raise awareness of how it is possible to insert malicious strings into dialplans, and to advise developers to read the best practices documents so that they may...

Fedora 11 : asterisk-1.6.1.17-1.fc11 (2010-3724)

Update to 1.6.1.17 AST-2010-003: Invalid parsing of ACL rules can compromise security AST-2010-002: This security release is intended to raise awareness of how it is possible to insert malicious strings into dialplans, and to advise developers to read the best practices documents so that they may...

CVE-2009-4918

Cisco Adaptive Security Appliances ASA 5580 series devices with software before 8.12 allow remote attackers to cause a denial of service IKE process hang via malformed NAT-T packets, aka Bug ID CSCsr74439...

CVE-2009-4918

CVE-2009-4918 affects Cisco ASA 5580 series devices running software before 8.1(2). The issue allows remote attackers to trigger a denial of service by sending malformed NAT-T packets, causing the IKE process to hang. Root cause is tied to Bug ID CSCsr74439. The available information indicates th...

CVE-2009-4918: Improper Input Validation

Cisco Adaptive Security Appliances ASA 5580 series devices with software before 8.12 allow remote attackers to cause a denial of service IKE process hang via malformed NAT-T packets, aka Bug ID CSCsr74439...

2daybiz Custom T-Shirt SQL Injection / Cross Site Scripting

$------------------------------------------------------------------------------------------------------------------- $ 2daybiz custom T-shirt SQL Injection and Cross Site Scripting Vulnerabilities $ Author : Sangteamtham $ Home : Hcegroup.net $ Download...

2DayBiz - Multiple SQL Injections

2DayBiz - Multiple SQL Injections $------------------------------------------------------------------------------------------------------------------- $ 2daybiz custom T-shirt SQL Injection and Cross Site Scripting Vulnerabilities $ Author : Sangteamtham $ Home : Hcegroup.net $ Download...

AT&T Show How Not to Handle a Data Breach

There’s an ongoing argument in barrooms, pubs and wherever else soccer fans gather about who is the best player in the world. The general consensus right now is Lionel Messi, the Argentinian genius, but others can build a case for Wayne Rooney, Didier Drogba or even Cristiano Ronaldo. A similar...

Goatse Hacker Member Arrested on Drug Charges

A hacker in the Goatse Security group that discovered the AT&T iPad-related flaw was arrested following the execution of an FBI search warrant of his home in Arkansas. Read the full article. CNet...

Microsoft SQL Server Backup Restoring Memory Corruption (MS08-040; CVE-2008-0107)

Microsoft SQL Server is a relational database management system RDBMS. Microsoft SQL Server uses Transact-SQL T-SQL, a proprietary extension to Structured Query Language SQL, for querying and modifying data and managing databases. SQL Server can be remotely access via the Tabular Data Stream TDS...

AT&T iPad Hack May Be Worse Than Initially Thought

Researchers looking into the security of GSM phone networks are suggesting that the recent breach, which saw tens of thousands of e-mail addresses and ICC-IDs inadvertantly disclosed AT&T, could have far more significant implications than a bit of extra spam: attackers can use the information to...

The Pitfalls of Website Vulnerability Research and Disclosure

Vulnerability disclosure is in the spotlight again. First it was Tavis Ormandy disclosing a vulnerability in Microsoft Windows before Microsoft had a fix available. Now a group called Goatse Security has disclosed a vulnerability in an AT&T website that affects Apple iPad 3G owners. The Wall Stre...

FBI Probes AT&T iPad Goatse Email Leak

The U.S. Federal Bureau of Investigation has opened an investigation into the leak of an estimated 114,000 Apple iPad user e-mail addresses including those of Chief of Staff Rahm Emanuel, ABC ABC News anchor Diane Sawyer and NY Mayor Michael Bloomberg. Read the full article. IDG News Service...

CPA Lead Script SQL Injection

In The Name Of Allah The Mercifull Tybe: SQL Injection Vulnerabilities Vendor: www.v-eva.com + Software: CPA Lead Script + author: R3d-D3v!L + TEAM: ArAB!AN !NFORMAT!ON SeCuR!TY ----4.!.5 ? contact: Xathotmail.co.jp - ? Date: 14.Jan.2010 ? T!ME: 05:15 am GMT ? Home: © Offensive Security ?...

Press Release Script - 'page.php?id' SQL Injection

In The Name Of Allah The Mercifull Tybe: SQL Injection Vulnerabilities Vendor: www.v-eva.com + Software: Press Release Script + author: R3d-D3v!L + TEAM: ArAB!AN !NFORMAT!ON SeCuR!TY ----4.!.5 ? contact: Xathotmail.co.jp - ? Date: 14.Jan.2010 ? T!ME: 05:15 am GMT ? Home: © Offensive Security ?...

iPhone AT&T WiFi Settings Open to MiTM Attacks

A security researcher has discovered that any wireless network can pretend to be an AT&T Wi-Fi hot spot and thus lure unsuspecting iPhone users to an untrusted network connection. Read the full article. CNet...

Cisco Security Advisory: Cisco IOS Software IPsec Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco IOS Software IPsec Vulnerability Advisory ID: cisco-sa-20100324-ipsec Revision 1.0 For Public Release 2010 March 24 1600 UTC GMT +--------------------------------------------------------------------- Summary ======= A...

qscan NSE Script

Repeatedly probe open and/or closed ports on a host to obtain a series of round-trip time values for each port. These values are used to group collections of ports which are statistically different from other groups. Ports being in different groups or "families" may be due to network mechanisms...

CVE-2010-0963: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in dl Download Ticket Service before 0.7 allows remote attackers to inject arbitrary web script or HTML via the t parameter, related to an invalid ticket ID. NOTE: some of these details are obtained from third party information...