VMware ESXi/ESX updates to third party library and ESX Service Console (VMSA-2012-0001)

The remote ESXi is missing one or more security related Updates from VMSA-2012-0001. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Safari < 5.1.4 Multiple Vulnerabilities

Binary data 800987.prm...

UBUNTU-CVE-2012-0640

WebKit in Apple Safari before 5.1.4 does not properly implement "From third parties and advertisers" cookie blocking, which makes it easier for remote web servers to track users via a cookie...

Ubuntu: Security Advisory (USN-1385-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-1385-1: APT vulnerability

Simon Ruderich discovered that APT incorrectly handled repositories that use InRelease files. The default Ubuntu repositories do not use InRelease files, so this issue only affected third-party repositories. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could...

Threats From Third Party Vendors Demand Vigilance

by B.K. DeLong Wikileaks’ decision this week to post the first of five million emails from Texas-based strategic intelligence firm Stratfor shone a spotlight on what experts say is a serious and growing problem: lax data, network and physical security at third party vendors and service providers...

Loophole in iOS Allows Developers Access to Users' Photos

A recently discovered hole in Apple’s iOS allows third-party developers access to users’ iPhone, iPad or iPod Touch photos by exploiting the device’s location data, according to a report from the New York Times’ Nick Bilton on the Bits blog yesterday. The loophole lies in the way that application...

Information disclosure vulnerabilities in extension "Front End User Registration" (sr_feuser_register)

It has been discovered that the extension "Front End User Registration" srfeuserregister is vulnerable to information disclosure Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 2.6.1 and below Vulnerability Type:...

Several vulnerabilities in third party extensions

Several vulnerabilities have been found in the following third-party TYPO3 extensions: tkcropthumbs, t3extplorer, tcbeuser, anpredigten, solr, pdfcontroller, cc20, jwplayer Release Date: February 23, 2012 Please read first: This Collective Security Bulletin CSB is a listing of vulnerable extensio...

Microsoft Says Google Bypassing Users' IE Privacy Settings

The relations among Microsoft, Apple and Google, which are testy in the best of circumstances, are being pressured even more of late as the controversy surrounding Google’s actions with cookies and user tracking grows. In the latest installment, Microsoft has said that it has found that Google “i...

CVE-2012-1219

Multiple cross-site scripting XSS vulnerabilities in freelancerKit 2.35 allow remote attackers to inject arbitrary web script or HTML via the 1 ticket parameter to tickets.php, 2 title parameter to notes.php, or 3 task parameter to todo.php. NOTE: some of these details are obtained from third par...

Facebook NYClubs Cross Site Scripting / SQL Injection

Title: ====== Facebook NYClubs - Multiple Web Vulnerabilities Date: ===== 2012-02-17 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=440 VL-ID: ===== 440 Introduction: ============= The application is currently included and viewable by all facebook users. The service is...

Facebook View My Calendar SQL Injection

Title: ====== Facebook view my calendar - SQL Injection Vulnerability Date: ===== 2012-02-14 References: =========== http://www.Ninja-Sec.com Introduction: ============= The application is currently included and viewable by all facebook users. The service is an external 3rd party application...

ECShop v2. 7. 2 wap page storm path 0day-vulnerability warning-the black bar safety net

Google: inurl:mobile/goods. php? act=viewimg&id=1 2 3 Search to After in page plus&id=5 That is, http://www. badguest. cn/mobile/goods. php? act=viewimg&id=1 2 3&id=5 For example, for many forums, submitted a non-existent file request, or submit a There is no output file of the request, the serve...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Symphony CMS 2.2.3 and possibly other versions before 2.2.4 allow remote authenticated users with Author privileges to inject arbitrary web script or HTML via 1 the profile parameter to extensions/profiledevkit/content/content.profile.php, as...

CVE-2012-1004

Multiple cross-site scripting XSS vulnerabilities in UI/Register.pm in Foswiki before 1.1.5 allow remote authenticated users with CHANGE privileges to inject arbitrary web script or HTML via the 1 text, 2 FirstName, 3 LastName, 4 OrganisationName, 5 OrganisationUrl, 6 Profession, 7 Country, 8...

Facebook Profile Sticker SQL Injection

Title: ====== Facebook Profile Sticker - SQL Injection Vulnerability Date: ===== 2012-02-03 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=409 VL-ID: ===== 409 Introduction: ============= The application is currently included and viewable by all facebook users. The...

Apple OS X multiple security vulnerabilities

Graphics, Video, Audio and documents parsing vulnerabilities. Information leakage, code execution via DNS resolver. Privilege escalation. Vulnerabilities in 3rd party packages...

Oracle Outside In Library OOXML Overflow

Added: 02/03/2012 CVE: CVE-2012-0110 BID: 51452 OSVDB: 78411 Background Oracle Outside In is a a suite of software development kits that allows developers with a comprehensive solution to access, transform, and control the contents of over 500 unstructured file formats. Problem Outside In version...

Oracle Outside In Library OOXML Overflow

Added: 02/03/2012 CVE: CVE-2012-0110 BID: 51452 OSVDB: 78411 Background Oracle Outside In is a a suite of software development kits that allows developers with a comprehensive solution to access, transform, and control the contents of over 500 unstructured file formats. Problem Outside In version...