SA-CONTRIB-2010-089 - Simplenews Content Selection - Cross Site Scripting

This module allows you to select content from your website and send a newsletter with the selected content. The module does not sanitize some of the user-supplied data before displaying it, leading to a Cross Site Scripting XSS vulnerability that may lead to a malicious user gaining full...

Joomla! Component com_equipment - SQL Injection

Joomla! Component comequipment - SQL Injection Exploit Title : Joomla "comequipment" Sql Injection Vulnerability Date : 16 - 8 - 2010 Author : Forza-Dz Vendor : http://joomlaequipment.com/ Version : All Versions Tested on : Win Sp2 and Mac Dork = inurl:"comequipment" --- SQL Injection Vulenrabili...

Joomla! Component com_fireboard - 'Itemid' SQL Injection

source: https://www.securityfocus.com/bid/42460/info The 'comfireboard' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the...

Researchers Release Capsicum, New Sandbox Framework

As applications have become more and more complex in recent years and Web browsers have evolved into operating systems unto themselves, the task of securing desktop environments has become increasingly difficult. And while there’s been quite a bit of innovation on Windows security, advances in Un...

Microsoft Windows Help HLP File Processing Memory Corruption

Microsoft Windows includes a standard Help system to assist the user working with applications. The WinHelp system, first introduced with Microsoft Windows 3.1, allows a developer to create a searchable document with a table of contents, images, hyper-links and other features. The developer may...

FuseTalk Forums 4.0 Cross Site Scripting

XSS vulnerability in FuseTalk Forums ------------------------------------- Vulnerability ID: Month Of Full Disclosure 1 = MOFD1 ------------------------------------ Product: FuseTalk ------------------------------------- Vendor: FuseTalk Inc...

Microsoft Visio Object Header Buffer Overflow (MS08-019; CVE-2008-1089)

Microsoft Visio is a diagramming application that is part of the Microsoft Office suite. Microsoft Office is a popular productivity application suite released by Microsoft Corporation. It includes a word processor, a spreadsheet application, a presentation editor, and a number of other applicatio...

Joomla Component (com_youtube) SQL Injection Vulnerability

No description provided by source. Exploit Title: Joomla "comyoutube" Sql Injection Vulnerability Date: 2010-07-24 Author: Forza-Dz Software Link: http://extensions.joomla.org/extensions/multimedia/ multimedia-channels/video-channels/12037 Version: 1.5 Tested on: windows-xp-sp2-fr :...

Safari AutoFill Feature Exposes User Data

A prominent security researcher is urging users of Apple’s Safari browser to immediately turn off the AutoFill feature to block hackers from stealing sensitive information. According to Jeremiah Grossman, founder and Chief Technology Officer of WhiteHat Security, the AutoFill Web Forms feature ca...

SnowFlake CMS 0.9.5 Beta - 'uid' SQL Injection

source: https://www.securityfocus.com/bid/41791/info SnowFlake CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify...

Oracle Secure Backup Administration selector Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to inject arbitrary commands on vulnerable installations of Oracle Secure Backup. Authentication is required to exploit this vulnerability but may be bypassed. The specific flaw exists in the handling of the 'selector0' variable to the script index.php...

Oracle Secure Backup Web Interface Various Post-Auth Command Injection Remote Code Execution Vulnerabilities

This vulnerability allows remote attackers to execute arbitrary commands on vulnerable installations of Oracle Secure Backup. Authentication is required to exploit these vulnerabilities. The specific flaws exist due to how the application passes CGI parameters to the internal obtool binary runnin...

Oracle Secure Backup Administration Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to inject arbitrary commands on vulnerable installations of Oracle Secure Backup. Authentication is required to exploit this vulnerability but may be bypassed. The specific flaw exists in the handling of the 'preauth' variable to the script index.php use...

EQdkp-Plus Gallery < v2.1.2 Blind SQL Injection Vulnerabilty

Exploit for php platform in category web applications ============================================================ EQdkp-Plus Gallery "EQDKP Plus" inurl:mypics.php greetz to : x2k, medison, x33, bl4ckn3ss, Luk ... / $x =...

WordPress Firestats Plugin <= 1.6.5 - Remote Configuration File Download

This Firestats plugin is prone to remote file-include vulnerability. It fails to clean user data sufficiently. The attacker may compromise the application and the other attacks are possible. Solution Update the plugin...

Хакеры получили доступ к базе данных пользователей The Pirate Bay

Аргентинский хакер Ch Russo сообщил, что он с двумя партнёрами обнаружил многочисленные уязвимости на thepiratebay.org, связанные с возможностью внедрения SQL-кода. С помощью этих уязвимостей они получили доступ к базе данных пользователей сайта и тем самым получили возможность создавать, удалять...

NTSOFT BBS E-Market Professional Cross Site Scripting

+================================================================================================+ + NTSOFT BBS E-Market Professional & XSS and Remote Execution Evil code + +================================================================================================+ Authors: Ivan Sanchez...

Bs General_Classifieds Script SQL Injection

1 1 0 I'm Sid3^effects member from Inj3ct0r Team 1 1 0 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1 Name : Bs GeneralClassifieds Script Sqli Vulnerability Date : july 5,2010 Critical Level : HIGH vendor URL :http://www.brotherscripts.com/ Price:$24.95 Author :...

Wiki Web Help <= 0.2.8 SQLi Vulnerability - Active Check

Wiki Web Help is prone to an SQL injection SQLi vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Copyright C 2010 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

Facebook Improves User Privacy Controls

In a move hailed by privacy advocates, Facebook deployed a feature that allows its users to better control what personal information can be accessed by third-party applications and websites. Read the full article. The Register...