UN Site Has 3-Year Old SQL Injection

Three years after the United Nations’ website was defaced by activist hackers using a SQL injection attack, the site still contains multiple instances of these vulnerabilities. Read the full article. Dark Reading...

HelixPlayer security update

CentOS Errata and Security Advisory CESA-2010:0094 An updated HelixPlayer package that fixes several security issues is now available for Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. HelixPlayer is a media player...

Unfixed XSS vulnerability at un-bg.bg

Security researcher TurKPoweR, has submitted on 12/06/2009 a cross-site-scripting XSS vulnerability affecting un-bg.bg, which at the time of submission ranked 10492229 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 08/07/2009. It is currently...

Microsoft issues PowerPoint zero-day warning

Microsoft has issued an advisory to warn about an under-attack zero-day vulnerability affecting its PowerPoint software. According to the pre-patch advisory, the flaw allows remote code execution if a user opens a booby-trapped PowerPoint file. The company described the attacks as “limited and...

DSA-1595-1 xorg-server - several vulnerabilities

Bulletin has no description...

Osprey <= 1.0 GetRecord.php Remote File Include Vulnerability

Exploit for unknown platform in category web applications ============================================================= Osprey = 1.0 GetRecord.php Remote File Include Vulnerability =============================================================...

net2ftp.txt

+-------------------------------------------------------------------- + + net2ftp: a web based FTP client : = Remote File Inclusion + +-------------------------------------------------------------------- + + Affected Software .: net2ftp: a web based FTP client + Venedor ...........:...

SpeedTouchXSS.txt

TITLE: Thomson SpeedTouch 500 series vulnerable to XSS CRITICAL: Less critical IMPACT: Cross Site Scripting SOFTWARE: SpeedTouch 5.3.2.6.0 DESCRIPTION: There consists a vulnerability in the SpeedTouch modems, which can be exploited by malicious people to conduct cross-site scripting attacks, and...

The zlib compression library is vulnerable to a denial-of-service condition

Overview Un-handled error conditions in the zlib compression library may allow an attacker to cause a denial-of-service condition. Description There is a vulnerability in the error handling mechanisms of the decompression functions in the zlib compression library. The decompression functions...

GLSA-200406-07 : Subversion: Remote heap overflow

The remote host is affected by the vulnerability described in GLSA-200406-07 Subversion: Remote heap overflow The svn protocol parser trusts the indicated length of a URI string sent by a client. This allows a client to specify a very long string, thereby causing svnserve to allocate enough memor...

CVE-2001-1241

Un-CGI 1.9 and earlier does not verify that a CGI script has the execution bits set before executing it, which allows remote attackers to execute arbitrary commands by directing Un-CGI to a document that begins with "!" and the desired program name...

CVE-2001-1242

Directory traversal vulnerability in Un-CGI 1.9 and earlier allows remote attackers to execute arbitrary code via a .. dot dot in an HTML form...

CVE-2001-1241

Un-CGI 1.9 and earlier fail to verify that a CGI script has execution bits set before executing it, allowing remote attackers to run arbitrary commands by pointing Un-CGI at a document that starts with "#!" and the target program name.

CVE-2001-1242

The CVE-2001-1242 entry concerns a directory traversal in Un-CGI 1.9 and earlier, where an attacker can trigger arbitrary code execution by supplying a .. (dot dot) in an HTML form. The vulnerability arises in the way path components are processed, enabling remote exploitation. Affected software:...

cnn_unsubscribe_bot.txt

CNN List Un-Subscribe bot Date: 8/22/01 Author: Jay Daniels PROBLEM: Anyone can Un-Subscribe other users from CNN's distribution list by placing a random number at the end of unsubscribe cgi URL's memberid. CAUSE: There is no confirmation request! I can't remember if there is a confirmation reque...

CVE-2001-1241

Un-CGI 1.9 and earlier does not verify that a CGI script has the execution bits set before executing it, which allows remote attackers to execute arbitrary commands by directing Un-CGI to a document that begins with "!" and the desired program name...

CVE-2001-1242

Directory traversal vulnerability in Un-CGI 1.9 and earlier allows remote attackers to execute arbitrary code via a .. dot dot in an HTML form...

pine4.10-remote.txt

Date: Mon, 8 Feb 1999 00:22:17 +0100 From: Michal Zalewski To: [email protected] Subject: remote exploit on pine 4.10 - neverending story? Affected systems: ----------------- Any Unx system running 'pine' up to version 4.10 latest. Compromise: ----------- Remote execution of arbitrary code whe...