Memory Corruption in Google SketchUp Could Allow Arbitrary Code Execution

Executive Summary Microsoft is providing notification of the discovery and remediation of a vulnerability affecting Google SketchUp software version 8.0.11752.0 and earlier. Microsoft discovered and disclosed the vulnerability under coordinated vulnerability disclosure to the affected vendor,...

Novell Groupwise 8.0.2 HP3 / 2012 Integer Overflow

Application: Novell Groupwise Platforms: Windows Version: 8.0.2 HP3 and 2012 Secunia: SA50622 PRL: 2012-28 Author: Francis Provencher Protek Research Lab's Website: http://www.protekresearchlab.com/ Twitter: @ProtekResearch 1 Introduction 2 Report Timeline 3 Technical details 4 The Code...

qdPM v7 Arbitrary PHP File Upload Vulnerability

This module exploits a vulnerability found in qdPM - a web-based project management software. The user profile's photo upload feature can be abused to upload any arbitrary file onto the victim server machine, which allows remote code execution. Please note in order to use this module, you must ha...

CVE-2012-3013

CVE-2012-3013 affects WAGO I/O System 758 family Industrial PCs (models 758-870, 758-874, 758-875, 758-876). The issue is caused by default passwords for unspecified Web-Based Management accounts, enabling remote attackers to obtain administrative access over TCP. Connected Red Hat records refere...

[SECURITY] Fedora 17 Update: zabbix-1.8.15-1.fc17

ZABBIX is software that monitors numerous parameters of a network and the health and integrity of servers. ZABBIX uses a flexible notification mechanism that allows users to configure e-mail based alerts for virtually any event. This allows a fast reaction to server problems. ZABBIX offers...

[SECURITY] Fedora 16 Update: zabbix-1.8.15-1.fc16

ZABBIX is software that monitors numerous parameters of a network and the health and integrity of servers. ZABBIX uses a flexible notification mechanism that allows users to configure e-mail based alerts for virtually any event. This allows a fast reaction to server problems. ZABBIX offers...

Eventy CMS v1.8 Plus Multiple Vulnerabilities

Exploit for php platform in category web applications Eventy CMS v1.8 Plus - Multiple Web Vulnerablities Introduction: ============= Publish Your Events In Online Calendar. Eventy Is Beautiful And Easy To Use Web Based Event Calendar Software Publish events like parties, courses, meetings,...

Use of Java Zero-Day Flaws Tied to Nitro Attack Crew

Researchers say that one of the attack groups using the two new Java zero-day vulnerabilities is the same group that was behind an earlier targeted attack campaign from 2011. That group was traced back to China and was essentially running a spear-phishing campaign, but now the crew, known as Nitr...

Report: Advanced Malware Targeting Organizations up Nearly 400 Percent

There’s been a huge jump in malicious, web-based infections targeting companies in the last year, a nearly 400 percent increase from last year, according to research released today by network security company FireEye. The company’s “Advanced Threat Report – 1H 2012,” blames the jump on attackers’...

PHP. S3. TO upload the exploit-vulnerability warning-the black bar safety net

PHP S3 upload vulnerability This web-based vulnerability is more serious, can directly access the shell, is given below exploits the method of Vulnerability information: Can any upload the PHP, TXT, JPG, PNG format file change your shell to sh3ll.php.jpg or sh3ll.php%0%0.1.jpg Exploit demo: Use:...

Multiple NULL Pointer Dereference Vulnerabilities in Corel Quattro Pro X6

High-Tech Bridge Security Research Lab discovered two null pointer dereference vulnerabilities in Corel Quattro Pro. Opening of a malicious QPW Quattro Pro Spreadsheet document causes immediate application crash, resulting in a loss of all unsaved current application data of the user. 1 Multiple...

OpenDocMan 1.2.6.1 - Cross-Site Request Forgery (Password Change)

OpenDocMan 1.2.6.1 - Cross-Site Request Forgery Password Change Exploit Title: OpenDocMan Password Change CSRF Date: 22/08/2012 Exploit Author: Shai rod @NightRang3r Vendor Homepage: http://www.opendocman.com/ Software Link:...

OpenDocMan 1.2.6.1 Cross Site Request Forgery

Exploit Title: OpenDocMan Password Change CSRF Date: 22/08/2012 Exploit Author: Shai rod @NightRang3r Vendor Homepage: http://www.opendocman.com/ Software Link: https://github.com/downloads/opendocman/opendocman/opendocman-1.2.6.1.tar.gz Version: 1.2.6.1 Gr33Tz: @aviadgolan , @benhayak,...

Vulnerability in Foxit Reader Could Allow Arbitrary Code Execution

Executive Summary Microsoft is providing notification of the discovery and remediation of a vulnerability affecting Foxit Reader software version 5.1.4.0104 and earlier. Microsoft discovered and disclosed the vulnerability under coordinated vulnerability disclosure to the affected vendor, Foxit...

sphpforum 0.4 - Multiple Vulnerabilities

Author: loneferret of Offensive Security Product: sphpforum Version: 0.4 older versions may be affected Software Download: http://sourceforge.net/projects/sphpforum/ Description: Simple PHP Forum is a PHP based forum/BBS board is designed to be small, simple, fast and allow easy integration into...

Umbraco Detection

The remote host is running Umbraco, a web-based content management system written in ASP.NET. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid61516; scriptversion"1.5"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/06/01"; scriptnameenglish:"Umbrac...

PBBoard - Authentication Bypass

PBBoard - Authentication Bypass source: https://www.securityfocus.com/bid/54862/info PBBoard is a web-based messaging board application implemented in PHP. Attackers may exploit these issues to gain unauthorized access to user accounts or to bypass intended security restrictions. Other attacks ma...

Attackers Go Phishing for Payroll Workers With Java CVE-2012-1723 Exploit

The Java CVE-2012-1723 vulnerability is suddenly the golden child of bugs. The flaw, which Oracle patched in June, has been the target of several pieces of malware and Web-based attacks of late, and now researchers say there is a phishing scam targeting payroll and HR employees that involves and...

Scientific Linux Security Update : conga on SL4.x i386/x86_64

The conga packages provide a web-based administration tool for remote cluster and storage management. A privilege escalation flaw was found in luci, the Conga web-based administration application. A remote attacker could possibly use this flaw to obtain administrative access, allowing them to rea...

CentOS Update for luci CESA-2011:0394 centos5 x86_64

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...