Foxit Reader 4.1.1 - Stack Overflow

Foxit Reader 4.1.1 is subject to a stack overflow vulnerability when parsing overly long unicode titles resulting in a SEH overwrite. The included PoC results in a SEH overwrite. The exception must be passed twice in order to reach the overwritten handler. This vulnerability was reported to the...

Microsoft Windows Mobile 6.1/6.5 - Double-Free Denial of Service

Vendor: Microsoft Product: Windows Mobile 6.1 and 6.5 Vulnerability: Double Free Denial of Service Tested vulnerable versions: Windows Mobile 6.1 and 6.5 Tested on : HTC Touch WM 6.1, HTC Touch2 WM 6.5 CREDITS: Celil Ünüver from SecurityArchitect.Org CONTACT: celilunuvern0sp4mgmail.com...

AIX 530010 : U837893

The remote host is missing AIX PTF U837893 which is related to the security of the package bos.rte.cron You should install this PTF for your system to be up-to-date. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if ! definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc';...

Unofficial Patch Released for Adobe Reader Bug

As users await the Oct. 4 release of a patch for the CoolType.dll vulnerability in Adobe Reader, a software and security company has published an unofficial patch for the bug that essentially replaces the vulnerable DLL with a patched one. The patch was published Wednesday by RamzAfzar, a softwar...

Touch22 Image22 ActiveX Control Buffer Overflow

Added: 09/13/2010 BID: 41547 Background Touch22 Software Image22 ActiveX enables dynamic graphic creation and image manipulation from within an application. Problem Touch22 Software Image22 ActiveX Control 1.1.1 is vulnerable to buffer overflow due to a boundary error when handling the function...

Touch22 Image22 ActiveX Control Buffer Overflow

Added: 09/13/2010 BID: 41547 Background Touch22 Software Image22 ActiveX enables dynamic graphic creation and image manipulation from within an application. Problem Touch22 Software Image22 ActiveX Control 1.1.1 is vulnerable to buffer overflow due to a boundary error when handling the function...

Linux kernel 2.6.x keyctl_session_to_parent()函数空指针引用漏洞

BUGTRAQ ID: 42932 CVE ID: CVE-2010-2960 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的security/keys/keyctl.c文件中的keyctlsessiontoparent函数存在空指针应用错误，本地用户可以以KEYCTLSESSIONTOPARENT调用keyctl来触发这个漏洞，导致拒绝服务的情况。 Linux kernel 2.6.x 厂商补丁： Linux ----- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

AIX 610004 : U834974

The remote host is missing AIX PTF U834974 which is related to the security of the package X11.compat.lib.X11R6motif You should install this PTF for your system to be up-to-date. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if ! definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc...

Heap Offset Overflow in Citrix ICA Clients

===============================ADVISORY=============================== Systems Affected: Citrix ICA Client Severity: High Category: Heap Offset Overflow Author: Context Information Security Ltd Reported to vendor: 20th February 2008 Advisory Issued: 4th August 2010...

BlueCMS v1.6 sp1 ad_js.php SQL注入漏洞

缺陷文件：adjs.php 漏洞成因： 12: $adid = !empty$GET'adid' ? trim$GET'adid' : ''; //根目录下其他文件都做了很好的过滤，对数字型变量几乎都用了intval做限制，唯独漏了这个文件，居然只是用了trim去除头尾空格。。 19: $ad = $db-getone"SELECT FROM ".table'ad'." WHERE adid =".$adid; //直接代入查询 BlueCMS v1.6 sp1 SEBUG临时解决办法： $adid = !empty$GET'adid' ? intval$GET'adid' : '';...

Secunia Research: Autonomy KeyView wosr.dll Data Block Parsing Buffer Overflow

====================================================================== Secunia Research 28/07/2010 - Autonomy KeyView wosr.dll Data Block Parsing Buffer Overflow - ====================================================================== Table of Contents Affected...

Wiki Web Help 'uploadimage.php' Arbitrary File Upload Vulnerability

Wiki Web Help is prone to an arbitrary-file-upload vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable...

BBSGood论坛程序labelsave.asp页面SQL注入漏洞

BBSGOOD是国内首创使用缓存技术的论坛，BBSGOOD的帖子和列表首页是可以生成静态HTML文件的。 在文件labelsave.asp中： sql="select top 1 Admin,UserName,Password from BBSGoodAdmin where UserName='"&Request.Cookiesbbsinfo&"adminuser"&"' " //第115行 程序没有验证用户是否登陆，导致cookies的值没有过滤而产生注入漏洞。 BBSGood 5.0/5.0.2 厂商补丁： BBSGood.Speed -------...

TitanFtp Server 8.10.1125 Arbitrary File Download / Delete

Accensus Security Advisory L-01 TitanFtp Server Arbitrary File Download/Delete Details ============= Product: TitanFTPd Security-Risk: high Remote-Exploit: maybe, assuming anonymous ftp access Local-Exploit: yes Vendor URL: http://www.southrivertech.com/ Found By: Bill Finlayson...

BBSGood论坛程序bottom.asp页面SQL注入漏洞

BBSGOOD是国内首创使用缓存技术的论坛，BBSGOOD的帖子和列表首页是可以生成静态HTML文件的。 在文件bottom.asp中： key=trimRequest"key" //第25行 key2=key key3=key select case mode case 1 if instr1,key," "0 then str=Splitkey," " key="" key3="" For ii=0 to UBoundstr key=key+"Subject LIKE '%"&strii&"%' and " key3=key3+""&strii&" - " Next...

AIX 610002 : U831158

The remote host is missing AIX PTF U831158 which is related to the security of the package bos.rte.edit You should install this PTF for your system to be up-to-date. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if ! definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc';...

AIX 610003 : U831222

The remote host is missing AIX PTF U831222 which is related to the security of the package bos.net.tcp.server You should install this PTF for your system to be up-to-date. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if ! definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc';...

ZDI-10-074: Sun Microsystems Directory Server Enterprise ASN.1 Parsing Remote Code Execution Vulnerability

ZDI-10-074: Sun Microsystems Directory Server Enterprise ASN.1 Parsing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-074 April 13, 2010 -- CVE ID: CVE-2010-0897 -- Affected Vendors: Sun Microsystems -- Affected Products: Sun Microsystems Directory Server -...

ZDI-10-067: Apple QuickTime Pict BkPixPat Remote Code Execution Vulnerability

ZDI-10-067: Apple QuickTime Pict BkPixPat Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-067 April 6, 2010 -- CVE ID: CVE-2010-0529 -- Affected Vendors: Apple -- Affected Products: Apple Quicktime -- TippingPointTM IPS Customer Protection: TippingPoint IPS...

ZDI-10-051: Sun Java Runtime RMIConnectionImpl Privileged Context Remote Code Execution Vulnerability

ZDI-10-051: Sun Java Runtime RMIConnectionImpl Privileged Context Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-051 April 5, 2010 -- CVE ID: CVE-2010-0094 -- Affected Vendors: Sun Microsystems -- Affected Products: Sun Microsystems Java Runtime --...