[Full-disclosure] Drupal Embedded Media Field Module Multiple XSS

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Details of this disclosure are posted at http://lampsecurity.org/drupal-6-embed-media-xss-vulnerability Vendor notified: 5/27/09 Vendor response: see below Description of Vulnerability: - ----------------------------- Drupal http://drupal.org is a...

CVE-2009-1800

Stack-based buffer overflow in the Chinagames CGAgent ActiveX control 1.x in CGAgent.dll, as distributed in Chinagames iGame 2009, allows remote attackers to execute arbitrary code via a long argument to the CreateChinagames method, as exploited in the wild in April and May 2009. NOTE: some of...

AMember 3.1.7 XSS / SQL Injection

AMember - Multiple Vulnerabilities Version Affected: 3.1.7 Apr-10-2009 newest Info: aMember is a flexible membership and subscription management PHP script. It has support for PayPal, BeanStream, 2Checkout, NoChex, VeriSign PayFlow, Authorize.Net, PaySystems, Probilling, Multicards, E-Gold and...

Password Hash Grabber

Added: 05/27/2009 Background This tool grabs the windows SAM file or password hashes of the target. The SAM file / password hashes can be viewed in the exploit tools previous results section. Results may be used with third party programs to obtain passwords in plain text. Limitations Password Has...

Password Hash Grabber

Added: 05/27/2009 Background This tool grabs the windows SAM file or password hashes of the target. The SAM file / password hashes can be viewed in the exploit tools previous results section. Results may be used with third party programs to obtain passwords in plain text. Limitations Password Has...

Password Hash Grabber

Added: 05/27/2009 Background This tool grabs the windows SAM file or password hashes of the target. The SAM file / password hashes can be viewed in the exploit tools previous results section. Results may be used with third party programs to obtain passwords in plain text. Limitations Password Has...

Directory traversal

Directory traversal vulnerability in plugins/ddb/foot.php in Strawberry 1.1.1 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the file parameter to example/index.php. NOTE: this was originally reported as an issue affecting the do parameter, but traversal...

Heap overflow

Multiple heap-based buffer overflows in the D-Link MPEG4 Viewer ActiveX Control csviewer.ocx 2.11.918.2006 allow remote attackers to execute arbitrary code via a long argument to the 1 SetFilePath and 2 SetClientCookie methods. NOTE: the provenance of this information is unknown; the details are...

[Full-disclosure] Drupal 6 CCK Module XSS Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Vendor Notified: 05/18/09 Vendor Response: Karoly Negyesi of Drupal security denies issue exists. Drupal security has responded to reports of CCK based XSS vulnerabilities in past with http://drupal.org/node/372836, which basically shirks the issue...

Input validation

Multiple unspecified vulnerabilities in CycloMedia CycloScopeLite 2.50.3.0 allow remote attackers to execute arbitrary code via the ReturnConnection method in 1 CMADOConnection.dll, 2 CMAddressInfoDBC.dll, and 3 CMRecordingLocationDBC.dll, related to improper dereferencing. NOTE: the provenance o...

CVE-2008-6807

PHP remote file inclusion vulnerability in ListRecords.php in osprey 1.0a4.1 allows remote attackers to execute arbitrary PHP code via a URL in the xmldir parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: the libdir...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Leap CMS 0.1.4 allow remote attackers to inject arbitrary web script or HTML via 1 the msg parameter aka the message in an article comment or 2 the searchterm parameter aka the search post form. NOTE: some of these details are obtained from thi...

Heap overflow

Multiple stack-based and heap-based buffer overflows in Dafolo DafoloControl ActiveX control DafoloFFControl.dll 1.108.6.195 allow remote attackers to execute arbitrary code via long 1 baseurl, 2 kommune, 3 felter, 4 afdeling, 5 Flags, 6 HelpURL, 7 caburl, or 8 filename properties; or 9 a long...

CVE-2009-1603

src/tools/pkcs11-tool.c in pkcs11-tool in OpenSC 0.11.7, when used with unspecified third-party PKCS11 modules, generates RSA keys with incorrect public exponents, which allows attackers to read the cleartext form of messages that were intended to be encrypted...

DEBIAN-CVE-2009-1603

src/tools/pkcs11-tool.c in pkcs11-tool in OpenSC 0.11.7, when used with unspecified third-party PKCS11 modules, generates RSA keys with incorrect public exponents, which allows attackers to read the cleartext form of messages that were intended to be encrypted...

Cross site scripting

Cross-site scripting XSS vulnerability in the web mail interface feature in AXIGEN Mail Server 6.2.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving e-mail messages. NOTE: the provenance of this information is unknown; the details are obtained sole...

CVE-2009-1481

SQL injection vulnerability in action.asp in PuterJam's Blog PJBlog3 3.0.6.170 allows remote attackers to execute arbitrary SQL commands via the cname parameter in a checkAlias action, as exploited in the wild in April 2009. NOTE: the provenance of this information is unknown; the details are...

CVE-2009-1446

Unrestricted file upload vulnerability in upload.php in Elkagroup Image Gallery 1.0 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in gallery/pictures/. NOTE: some of these details ar...

Virtualization security debate rages on

From SearchSecurity.com Robert Westervelt The debate around cloud security is quickly beginning to mirror the one that has followed virtualization security for the last few years. What begins as a philosophical discussion usually devolves into arguments about technology or vendor roles. In a pane...

Mozilla Foundation Security Advisory 2009-18

Mozilla Foundation Security Advisory 2009-18 Title: XSS hazard using third-party stylesheets and XBL bindings Impact: Low Announced: April 21, 2009 Reporter: Cefn Hoile Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 3.0.9 Description Web developer Cefn Hoile reported that sites which...