Microsoft Says No to Paying Bug Bounties

Microsoft has no plans to follow in the footsteps of Mozilla and Google and pay researchers cash rewards for the bugs that they find in Microsoft’s products. In the wake of both Mozilla and Google significantly increasing their bug bounties to the $3,000 range, there have been persistent rumors i...

New Study Sees Need for Better Software Integrity Controls

Software security has become one of the more widely discussed and debated topics in the security industry in the last few years, as many software vendors and enterprises both large and small have begun to to focus considerable attention on improving the processes they have in place for producing...

Multiple Vendors AgentX receive_agentx Integer Overflow (CVE-2010-1319)

AgentX++ is a C++ object API written by Frank Fock. It is an implementation of the AgentX protocol which is used in multiple applications; including RealNetworks Helix Server and Helix Mobile Server. A buffer overflow vulnerability has been reported in multiple products that use the AgentX++...

Gartner to Businesses: Eliminate Windows XP by 2012

As Microsoft prepares to pull the plug on support for Windows XP SP2, a move that stops the release of security updates for that operating system, research firm Gartner is urging businesses to start planning and testing Windows 7 this year with a plan to completely eliminate Windows XP by the end...

Decades On, Buffer Overflows Still the Target

Buffer overflows have been a serious security problem for software developers for several decades now, but the history of exploitation research on this class of flaws is relatively short. Attackers and researchers originally focused on finding, fixing or exploiting buffer overflows on non-x86...

Preemptive Protection against Multiple Vendors librpc.dll Stack Buffer Overflow

A buffer overflow vulnerability exists in IBM's Informix Dynamic Server and EMC's Legato Networker. Informix is a family of relational database management system RDBMS products by IBM. The vulnerability is due to insufficient validation of user input during authentication by the RPC protocol...

ZDI-10-072: Cisco Secure Desktop CSDWebInstaller ActiveX Control Remote Code Execution Vulnerability

ZDI-10-072: Cisco Secure Desktop CSDWebInstaller ActiveX Control Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-072 April 14, 2010 -- Affected Vendors: Cisco -- Affected Products: Cisco Secure Desktop -- TippingPointTM IPS Customer Protection: TippingPoint...

Taking Vendors to Task on Security Flaws

A loose consortium of security experts from more than 30 organizations today called on enterprises to exert more pressure on their software vendors to ensure that they use secure code development practices. Read the full article. Computerworld...

Multiple Vendors KeyHelp ActiveX Control Buffer Overflow (CVE-2012-2515)

A stack-based buffer overflow vulnerability exist in Multiple Vendors KeyHelp ActiveX control. The flaw is due to insufficient boundary checks. A remote attack can exploit this vulnerability by enticing a target user to visit a maliciously crafted web page...

Multiple Vendor CUPS Administration Interface CGI Heap Overflow (CVE-2008-0047)

The Common Unix Printing System CUPS is a modular printing system for Unix-like operating systems that allows a computer to act as a print server. A computer running CUPS is a host that can accept print jobs from client computers, process them, and send them to the appropriate printer. A heap...

DEBIAN-CVE-2009-3582

Multiple SQL injection vulnerabilities in the delete subroutine in SQL-Ledger 2.8.24 allow remote authenticated users to execute arbitrary SQL commands via the 1 id and possibly 2 db parameters in a Delete action to the output of a VendorsReportsSearch search operation...

Sql injection

Multiple SQL injection vulnerabilities in the delete subroutine in SQL-Ledger 2.8.24 allow remote authenticated users to execute arbitrary SQL commands via the 1 id and possibly 2 db parameters in a Delete action to the output of a VendorsReportsSearch search operation...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in SQL-Ledger 2.8.24 allow remote authenticated users to inject arbitrary web script or HTML via 1 the DCN Description field in the Accounts Receivables menu item for Add Transaction, 2 the Description field in the Accounts Payable menu item for A...

CVE-2009-3582

Multiple SQL injection vulnerabilities in the delete subroutine in SQL-Ledger 2.8.24 allow remote authenticated users to execute arbitrary SQL commands via the 1 id and possibly 2 db parameters in a Delete action to the output of a VendorsReportsSearch search operation...

CVE-2009-3582

Multiple SQL injection vulnerabilities in the delete subroutine in SQL-Ledger 2.8.24 allow remote authenticated users to execute arbitrary SQL commands via the 1 id and possibly 2 db parameters in a Delete action to the output of a VendorsReportsSearch search operation...

CVE-2009-3582

Multiple SQL injection vulnerabilities in the delete subroutine in SQL-Ledger 2.8.24 allow remote authenticated users to execute arbitrary SQL commands via the 1 id and possibly 2 db parameters in a Delete action to the output of a VendorsReportsSearch search operation...

Multiple Vendor SOAP Denial of Service (CVE-2004-1815)

A vulnerability exists in the way Apache Axis handles requests with SOAP arrays in the parameters. Apache Axis is embedded within several Web Services packages. Attackers can trigger the vulnerability to cause a denial of service condition in a vulnerable service. Triggering the vulnerability...

[Suspected Spam][oCERT-2009-019] Ganeti path sanitization errors

2009-019 Ganeti path sanitization errors Description: Ganeti, an open source virtualisation manager, suffers from an input validation bug that poses a security risk. The vulnerability applies to the commands submitted, either locally via gnt- commands or remotely via the HTTP API, to the machine...

ZDI-09-094: Hewlett-Packard OpenView NNM Multiple Command Injection Vulnerabilities

ZDI-09-094: Hewlett-Packard OpenView NNM Multiple Command Injection Vulnerabilities http://www.zerodayinitiative.com/advisories/ZDI-09-094 December 9, 2009 -- CVE ID: CVE-2009-3845 -- Affected Vendors: Hewlett-Packard -- Affected Products: Hewlett-Packard OpenView Network Node Manager --...

Multiple Vendor - TLS Protocol Session Renegotiation Security

Multiple Vendor - TLS Protocol Session Renegotiation Security include include include include include include include include include include include void failconst char proc perrorproc; exit1; void setupserver int sock, int port struct sockaddrin sa; int s, r, i; s = socketAFINET, SOCKSTREAM, 0;...