Microsoft Says IE8 Weakness Not an Exploitable Flaw

Microsoft on Friday said that a weakness in Internet Explorer 8 identified by security researcher Ruben Santamarta recently is not an exploitable vulnerability, but rather a “technique for bypassing ASLR.” ASLR Address Space Layout Randomization is a memory protection that, along with DEP Data...

CVE-2010-2650: Undefined Security Weakness

Unspecified vulnerability in Google Chrome before 5.0.375.99 has unknown impact and attack vectors, related to an "annoyance with print dialogs."...

DistCC Daemon Command Execution

DistCC Daemon Command Execution. CVE-2004-2687. Remote exploit for linux platform $Id: distccexec.rb 9669 2010-07-03 03:13:45Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for...

CVE-2010-2517: Undefined Security Weakness

Multiple unspecified vulnerabilities in IBM Rational ClearQuest before 7.1.1.02 have unknown impact and attack vectors, as demonstrated by an AppScan report...

Mozilla Firefox 3.6.x < 3.6.4 Multiple Vulnerabilities

Binary data 5580.prm...

CVE-2010-2421: Undefined Security Weakness

Multiple unspecified vulnerabilities in Opera before 10.54 have unknown impact and attack vectors related to 1 "extremely severe," 2 "highly severe," 3 "moderately severe," and 4 "less severe" issues...

Solaris Sadmind - Command Execution (Metasploit)

$Id: sadmindexec.rb 9583 2010-06-22 19:11:05Z todb $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...

New VPN Flaw Can Expose Users' IP Addresses

Researchers have identified a bug in the way that some third-party VPN services use the PPTP protocol over IPv6, a problem that enables eavesdroppers to unmask the specific IP addresses of the VPN service’s users. The vulnerability, which was disclosed at a conference in Sweden last week, only...

HP OpenView Client Configuration Manager Radia Notify Code Execution (CVE-2006-5782)

An authentication weakness vulnerability exists in the Radia Notify Daemon component of HP OpenView Client Configuration Manager. The flaw is created by improper handling of user supplied data passed to the affected Radia Notify Daemon on TCP port 3465. By sending a crafted message, the attacker...

CVE-2010-1763: Undefined Security Weakness

Unspecified vulnerability in WebKit in Apple iTunes before 9.2 on Windows has unknown impact and attack vectors, a different vulnerability than CVE-2010-1387 and CVE-2010-1769...

Multiple Vulnerabilities in BloofoxCMS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in BloofoxCMS which could be exploited to perform cross-site request forgery and SQL injection attacks. 1 Cross-site request forgery CSRF in BloofoxCMS The vulnerability exists due to insufficient validation of the...

IBM DB2 9.7 < Fix Pack 2 Multiple Vulnerabilities

According to its version, the installation of IBM DB2 9.7 running on the remote host is affected by one or more of the following issues : - The 'MODIFIED SQL DATA' table function is not dropped when a definer loses required privileges to maintain the objects. IC63548 - A privilege escalation...

OSC Visitor Web Stats SQL Injection

Popular OSC add-on Visitor Web Stats is completely vulnerable to SQL injections. Although it uses request data i. e. the Accept-Language header, there's no escaping at all. This also applies to the extension's derivative for OSC 3, who's author completely inherited the insufficient code structure...

File Thingie v2.5.5 File Security Bypass

Exploit for php platform in category web applications ======================================== File Thingie v2.5.5 File Security Bypass ======================================== Title: File Thingie v2.5.5 File Security Bypass Author: Jeremiah Talamantes RedTeam Security Website:...

File Thingie 2.5.5 - File Security Bypass

Title: File Thingie v2.5.5 File Security Bypass Author: Jeremiah Talamantes RedTeam Security Website: http://www.redteamsecure.com/labs Date: 5/15/2010 Application: File Thingie Version: 2.5.5 Link: http://www.solitude.dk/filethingie/download Description: There are security controls in place that...

Oracle Database DBMS_JAVA.SET_OUTPUT_TO_JAVA Privilege Escalation (CVE-2010-0866; CVE-2010-0867)

Oracle Database Server is an enterprise-level relational database application suite. A vulnerability exists in Oracle Database 11g server that could allow users with limited privileges to execute SQL commands with System privileges on the server. The vulnerability is due to an access control...

Oracle Database DBMS_JVM_EXP_PERMS System Command Execution (CVE-2010-0866; CVE-2010-0867)

Oracle Database server is an enterprise-level relational database application suite. A privilege escalation vulnerability exists in Oracle Database server that can allow users with limited privileges to execute arbitrary operating system commands on a target server. The vulnerability is due to an...

Cisco Application Control Engine (ACE) - HTTP Parsing Security

Cisco Application Control Engine ACE - HTTP Parsing Security source: https://www.securityfocus.com/bid/40002/info Cisco Application Control Engine ACE is prone to a security weakness that may allow attackers to obfuscate HTTP server log entries. Attackers can exploit this issue to avoid having...

Cisco Application Control Engine (ACE) - HTTP Parsing Security

source: https://www.securityfocus.com/bid/40002/info Cisco Application Control Engine ACE is prone to a security weakness that may allow attackers to obfuscate HTTP server log entries. Attackers can exploit this issue to avoid having client IP addresses logged by servers. GET / HTTP / 1 . 1 HOST:...

Audit Shows Flaws in Coast Guard System

Flaws in the configuration and security of the U.S. Coast Guard IT system caused a material weakness in the Department of Homeland Security financial system, according to a recent audit. Read the full article. Dark Reading...