CVE-2009-2161

Directory traversal vulnerability in backend/admin-functions.php in TorrentTrader Classic 1.09, when used on a case-insensitive web site, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the ssuri parameter, in conjunction with a modified component name...

iPhone 3.0 Includes 46 Security Patches

Apple’s latest iPhone OS 3.0 software updates includes patches for multiple vulnerabilities, some with serious security implications. The update, which is only available for download via iTunes, covers a total of 46 documented vulnerabilities, including several that allows malicious code executio...

Microsoft Internet Explorer 6 - 'JavaScript:' URI in 'Refresh' Header Cross-Site Scripting

source: https://www.securityfocus.com/bid/35570/info Microsoft Internet Explorer is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to execute arbitrary script code in the context of the user running the...

Google Chrome 0.3.154 - 'JavaScript:' URI in 'Refresh' Header Cross-Site Scripting

source: https://www.securityfocus.com/bid/35572/info Google Chrome is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to execute arbitrary script code in the context of the user running the application and...

WinAMP 5.551 MAKI Parsing Integer Overflow

/ Winamp 5.551 MAKI Parsing Integer Overflow Exploit !!! Tested on :Vista sp1 and Xpsp3 Release Date :May 22 2009 Venders web site :http://www.winamp.com/ Version Tested:Winamp 5.551 Not vulnerable :Winamp 5.552 Credits to Monica Sojeong Hong down at vrt-sourcefire for the overflow...

Design/Logic Flaw

Opera executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in an inline PDF file, which might allow remote attackers to bypass intended Adobe Acrobat JavaScript restrictions on accessing the document object, as demonstrated by a w...

Design/Logic Flaw

Mozilla Firefox executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in an inline PDF file, which might allow remote attackers to bypass intended Adobe Acrobat JavaScript restrictions on accessing the document object, as...

Design/Logic Flaw

Apple Safari executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in an inline PDF file, which might allow remote attackers to bypass intended Adobe Acrobat JavaScript restrictions on accessing the document object, as demonstrated...

CVE-2009-0194

The domain-locking implementation in the GARMINAXCONTROL.GarminAxControlt.1 ActiveX control in npGarmin.dll in the Garmin Communicator Plug-In 2.6.4.0 does not properly enforce the restrictions that 1 download and 2 upload requests come from a web site specified by the user, which allows remote...

Design/Logic Flaw

Google Chrome executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in an inline PDF file, which might allow remote attackers to bypass intended Adobe Acrobat JavaScript restrictions on accessing the document object, as demonstrate...

Update Protection against Novell QuickFinder Server Multiple Cross Site Scripting

A cross-site scripting vulnerability was reported in Novell QuickFinder Server, a site-specific search engine. The flaw is due to lack of validation of user supplied input data. An attacker can leverage this flaw to execute arbitrary HTML and script code on target user's web browser, within the...

CVE-2009-0551

Microsoft Internet Explorer 6 SP1, 6 and 7 on Windows XP SP2 and SP3, 6 and 7 on Windows Server 2003 SP1 and SP2, 7 on Windows Vista Gold and SP1, and 7 on Windows Server 2008 does not properly handle transition errors in a request for one HTTP document followed by a request for a second HTTP...

Protection against Microsoft Windows HTTP Services Certificate Name Mismatch Remote Code Execution Vulnerability (MS09-013)

A spoofing vulnerability has been reported in Microsoft Windows HTTP Services. Windows HTTP Services WinHTTP provides developers with an HTTP client application programming interface API to send requests through the HTTP protocol to other HTTP servers. A remote attacker may exploit this issue to...

Update Protection against IBM Access Support ActiveX GetXMLValue Method Buffer Overflow

IBM Access Support ActiveX Control contains a buffer overflow vulnerability. The IBM Access Support ActiveX control is used by the vendor to collect system information, such as make, model, serial number, OS version, etc. This control is available on the IBM / Lenovo web site, and may also come...

Adobe Acrobat getIcon() Stack Overflow Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Acrobat and Adobe Reader. User interaction is required in that a user must visit a malicious web site or open a malicious file. The specific flaw exists when processing malicious JavaScript...

Microsoft Security Bulletin MS06-056

A cross-site scripting vulnerability exists in a server running a vulnerable version of the .Net Framework 2.0 that could inject a client side script in the user's browser. The script could spoof content, disclose information, or take any action that the user could take on the affected web site...

Can we learn from Microsoft and Google on security?

Tech security company Fortify and security consulting firm Cigital are getting ready to release a set of best practices that tech companies and other businesses can follow to ensure that the software they develop is secure. The authors developed the model by studying the security practices at...

GMail, GTalk phishing scam underway

Attention GMail and GTalk users: There’s a major spam run underway with social engineering lures to steal your login cretentials. This image shows a GMail message that purports to be an account termination warning from Google but, if a user is tricked into clicking on the link, he/she is redirect...

Fedora Update for httrack FEDORA-2008-7896

Check for the Version of httrack OpenVAS Vulnerability Test Fedora Update for httrack FEDORA-2008-7896 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

HTTP Backdoor Detection deprecated

This plugin has been deprecated and replaced by plugin 71024 Web Site Hosting Malicious Binaries. C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2019/01/09. Deprecated by wwwhostingmalware.nbin. include"compat.inc"; ifdescription scriptid35322; scriptversion "1.11"; scriptcvsdate"Date:...