SQL Injection in Oracle Enterprise Manager (compareWizFirstConfig web page) (CVE-2012-0512)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 AppSecInc Team SHATTER Security Advisory SQL Injection in Oracle Enterprise Manager compareWizFirstConfig web page. Risk Level: High Affected versions: Oracle Enterprise Manager Database Control 11.1.0.7, 11.2.0.2 and previous patchsets Oracle...

Newscoop 3.5.3 XSS / RFI / SQL Injection

Exploit for php platform in category web applications Product: Newscoop Vendor: Sourcefabric o.p.s. Vulnerable Versions: 3.5.3 and probably prior, partially 4.0 RC3 Tested Version: 3.5.3 Vendor Notification: 28 March 2012 Vendor Patch: 5 April 2012 Public Disclosure: 18 April 2012 Vulnerability...

XOOPS 2.5.4 Cross Site Scripting

Advisory ID: HTB23062 Product: XOOPS Vendor: xoops.org Vulnerable Versions: 2.5.4 and probably prior Tested Version: 2.5.4 Vendor Notification: 7 December 2011 Vendor Patch: 22 February 2012 Public Disclosure: 18 April 2012 Vulnerability Type: XSS Cross Site Scripting CVE References: CVE-2012-098...

osCmax 2.5.0 Cross Site Scripting / SQL Injection

Advisory ID: HTB23081 Product: osCmax Vendor: osCMax.com Vulnerable Versions: 2.5.0 and probably prior Tested Version: 2.5.0 Vendor Notification: 14 March 2012 Vendor Patch: 30 March 2012 Public Disclosure: 4 April 2012 Vulnerability Type: Cross-Site Scripting XSS, SQL Injection CVE References:...

织梦(DedeCMS)后门远程代码执行漏洞

DEDECMS是织梦内容管理系统，国内一款基于PHP+MySQL的技术开发的，支持多种服务器平台的PHP网站内容管理系统。 DedeCMS某些版本/include/shopcar.class.php文件中，被添加后门代码，远程未验证的攻击者利用该后门可以执行任意命令。 0 dedecms 临时解决方法： 如果您不能立刻安装补丁或者升级，NSFOCUS建议您采取以下措施以降低威胁： 直接找到站点include目录下shopcar.class.php文件，去掉里面的代码 @evalfilegetcontents'php://input';即可。 厂商补丁： dedecms -------...

Symfony2 Local File Disclosure - Security Advisory - SOS-12-002

Sense of Security - Security Advisory - SOS-12-002 Release Date. 05-Mar-2012 Last Update. - Vendor Notification Date. 24-Feb-2012 Product. Symfony2 Platform. PHP Affected versions. 2.0.x - 2.0.10 Severity Rating. Medium Impact. Exposure of sensitive information Attack Vector. Remote without...

Aurora WebOPAC SQL Injection - Security Advisory - SOS-12-004

Sense of Security - Security Advisory - SOS-12-004 Release Date. 12-Mar-2012 Last Update. - Vendor Notification Date. 24-Nov-2011 Product. Aurora WebOPAC Platform. Independent Affected versions. 3.5.0e, 3.4.6a, 3.5.3, 3.5.0i, 3.4.7b, 3.5.2.2, 3.4.7b, possibly others Severity Rating. High Impact...

Multiple XSS in Chyrp

Advisory ID: HTB23073 Product: Chyrp Vendor: Chyrp Vulnerable Versions: 2.5b1 and probably prior Tested Version: 2.5b1 Vendor Notification: 1 February 2012 Vendor Patch: 2 February 2012 Public Disclosure: 22 February 2012 Vulnerability Type: Cross Site Scripting XSS CVE References: CVE-2012-1001...

Samba 3.x 'etc/mtab'文件附加本地拒绝服务漏洞

BUGTRAQ ID: 49939 CVE ID: CVE-2011-1678 Samba是一套实现SMB（Server Messages Block）协议、跨平台进行文件共享和打印共享服务的程序。 Samba 3.5.8及更早版本中的smbfs尝试使用mount.cifs附加到/etc/mtab文件，umount.cifs附加到/etc/mtab.tmp文件，而没有检查资源限制，可使本地用户通过small RLIMITFSIZE值相关进程破坏/etc/mtab文件。 0 Samba 3.x 厂商补丁： Samba -----...

Symfony 2 Unauthenticated Information Disclosure

Exploit for php platform in category web applications Vendor Notification Date. 24-Feb-2012 Product. Symfony2 Platform. PHP Affected versions. 2.0.x - 2.0.10 Severity Rating. Medium Impact. Exposure of sensitive information Attack Vector. Remote without authentication Solution Status. Vendor patc...

Symfony2 Local File Disclosure

Exploit for php platform in category web applications Release Date. 05-Mar-2012 Vendor Notification Date. 24-Feb-2012 Product. Symfony2 Platform. PHP Affected versions. 2.0.x - 2.0.10 Severity Rating. Medium Impact. Exposure of sensitive information Attack Vector. Remote without authentication...

Symfony 2 Unauthenticated Information Disclosure

Sense of Security - Security Advisory - SOS-12-002 Release Date. 05-Mar-2012 Last Update. - Vendor Notification Date. 24-Feb-2012 Product. Symfony2 Platform. PHP Affected versions. 2.0.x - 2.0.10 Severity Rating. Medium Impact. Exposure of sensitive information Attack Vector. Remote without...

Symfony2 - Local File Disclosure

Symfony2 - Local File Disclosure Sense of Security - Security Advisory - SOS-12-002 Release Date. 05-Mar-2012 Last Update. - Vendor Notification Date. 24-Feb-2012 Product. Symfony2 Platform. PHP Affected versions. 2.0.x - 2.0.10 Severity Rating. Medium Impact. Exposure of sensitive information...

FlashFXP v4.1.8.1701缓冲区溢出漏洞

FlashFXP是一款流行的FTP客户端 FlashFXP v4.1.8.1701在TListBox控件中使用固定长度缓冲区时缺少长度检查，在实现上存在缓冲区溢出漏洞，可导致控制进程、执行任意代码、系统控制 0 FlashFXP 4.1.8.1701 厂商补丁： FlashFXP -------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.flashfxp.com/...

Snom IP Phone Privilege Escalation - Security Advisory - SOS-12-001

Exploit for hardware platform in category web applications Snom IP Phone Privilege Escalation - Security Advisory - SOS-12-001 Product. Snom IP Phone series Platform. Hardware Affected versions. All versions prior to v8.4.35 Severity Rating. High Impact. Privilege escalation Attack Vector. Remote...

Snom IP Phone Privilege Escalation

Sense of Security - Security Advisory - SOS-12-001 Release Date. 23-Feb-2012 Last Update. - Vendor Notification Date. 27-Jan-2012 Product. Snom IP Phone series Platform. Hardware Affected versions. All versions prior to v8.4.35 Severity Rating. High Impact. Privilege escalation Attack Vector...

Sunway ForceControl SNMP NetDBServer Data Chunk Copy Buffer Overflow

Added: 02/22/2012 BID: 49747 OSVDB: 75798 Background Sunway ForceControl is a Chinese SCADA/HMI software application widely used in China to help run weapons systems, utilities and chemical plants. It is also used to a lesser extent in other countries, including the US. SNMP NetDBServer is one of...

SQL Injection Vulnerabilities in TestLink

------------------ Information ------------------ Name: SQL Injection Vulnerabilities in TestLink Software tested: TL v1.8.5b & checked in v1.9.3 prior version may be affected Vendor Homepage: http://www.teamst.org Vendor Notification: 27 January 2012 Vendor Patch: 4 February 2012 Public...

Sunway ForceControl SNMP NetDBServer Data Chunk Copy Buffer Overflow

Added: 02/22/2012 BID: 49747 OSVDB: 75798 Background Sunway ForceControl is a Chinese SCADA/HMI software application widely used in China to help run weapons systems, utilities and chemical plants. It is also used to a lesser extent in other countries, including the US. SNMP NetDBServer is one of...

LEPTON 1.1.3 SQL Injection / XSS / Local File Inclusion

Exploit for php platform in category web applications Vendor: LEPTON Project Vulnerable Versions: 1.1.3 and probably prior Tested Version: 1.1.3 Vendor Notification: 25 January 2012 Vendor Patch: 4 February 2012 Public Disclosure: 15 February 2012 Vulnerability Type: Local File Inclusion, SQL...