CVE-2008-3590

Multiple SQL injection vulnerabilities in admin/login.asp in E. Z. Poll 2 allow remote attackers to execute arbitrary SQL commands via the 1 Username and 2 Password parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Z-blog FUNCTION/c_function.asp跨站脚本攻击漏洞

Z-Blog是一款基于Asp平台的Blog博客网志程序，支持Wap，支持Firefox，Oprea等浏览器，在国内使用非常广泛，官方主页在http://www.rainbowsoft.org/。Z-blog代码严谨，前台功能简洁，后台功能强大，这为它的产品安全带来很大的优势，但是在上次的xss漏洞被公布后，80sec在产品中又发现一个严重的跨站脚本攻击漏洞，加上产品设计上的一些问题可能带来严重的后果。 在FUNCTION/cfunction.asp中，程序处理UBB标签的时候存在漏洞，导致任何用户可以在目标页面内执行任意js代码，利用该代码恶意用户可以获取目标站点的所有权限。漏洞代码如下...

Z-blog跨站脚本攻击漏洞

Z-Blog是一款基于Asp平台的Blog博客网志程序，支持 Wap，支持Firefox，Oprea等浏览器，在国内使用非常广泛，官方主页在http://www.rainbowsoft.org/。Z- blog代码严谨，前台功能简洁，后台功能强大，这为它的产品安全带来很大的优势，但是80sec在产品中发现一个严重的跨站脚本攻击漏洞，加上产品设计 上的一些问题可能带来严重的后果。 在FUNCTION/curlredirect.asp中，程序对提交的url参数做如下处理 strUrl=URLDecodeForAntiSpamRequest.QueryString"url"...

Unfixed XSS vulnerability at z-look.webmastak.info

Security researcher Uber0n, has submitted on 06/07/2008 a cross-site-scripting XSS vulnerability affecting z-look.webmastak.info, which at the time of submission ranked 255238 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 08/07/2008. It is...

RHEL 4 : kernel (RHSA-2008:0167)

Updated kernel packages that fix various security issues and several bugs are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any Linux...

CentOS 4 : kernel (CESA-2008:0167)

Updated kernel packages that fix various security issues and several bugs are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any Linux...

kernel security update

CentOS Errata and Security Advisory CESA-2008:0167 Updated kernel packages that fix various security issues and several bugs are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The kernel packages...

bmclassifieds-sql.txt

....... ...... ..... .....CoRPITX ..... ..... ...... ....... Turkey www.Hayalet-hack.com www.zone-turk.net/ Powered by BM Classifieds listingid,adSQL Injection Vulnerability AUTHOR : xcorpitx HOME : www.Hayalet-hack.com / www.zone-turk.net Dork 1 : ''showad.php?listingid='' Dork 2 :...

RHEL 5 : kernel (RHSA-2008:0154)

Updated kernel packages that fix various security issues and several bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any Linux...

Critical: evolution security update

evolution-2.0.2-35.0.4.el46.1: 2.0.2-35.0.4.el4.1 - Add patch for RH bug 435797 format string vulnerability. evolution28-2.8.0-53.el46.2.0.1: 2.8.0-53.el46.2.0.1 - Comment evolution-2.8.0-red-hat-branding.patch to make evolution as vendor neutral 2.8.0-53.el46.2 - Fix hardcoded %dist tag for...

CVE-2007-6661

2z project 0.9.6.1 allows attackers to change the password without supplying the old password...

CVE-2007-6525

Unspecified vulnerability in eClient in IBM DB2 Content Manager CM Toolkit 8.3 before fix pack 7 for z/OS has unknown impact and attack vectors, related to "scripting."...

CVE-2007-6525

CVE-2007-6525 affects IBM DB2 Content Manager (CM) Toolkit 8.3 for z/OS, specifically the eClient component. The vulnerability type is unspecified; impact and attack vectors are not detailed in the provided documents, which reference “scripting” but do not describe exploitability. The description...

Important: kernel security update

CVE-2007-4571 ALSA memory disclosure flaw - Tick divider bugs on x8664 - CVE-2007-5494 openOATOMICLOOKUP leaks dentry - PATCH jbd: wait for already submitted tsyncdatalist buffer to complete Possibility of in-place data destruction - LSPP: audit rule causes kernel 'out of memory' condition and...

JVN#84565055 Lotus Domino cross-site scripting vulnerability

IBM Lotus Domino is server software for Lotus Notes, groupware from IBM. Lotus Domino contains a cross-site scripting vulnerability. Impact An attacker could execute an arbitrary script on the web browser of a user who accesses a Lotus Domino server. Solution Update the Software For Lotus Domino...

Seditio CMS 121 - pfs.php Arbitrary File Upload

Seditio CMS 121 - pfs.php Arbitrary File Upload Seditio CMS Remote File Upload Vulnerability ReSearcher : A.D.T Script : Seditio and Ldu Cms Version : All Versions Script HomePage : http://neocrome.net/ Dork : "powered by seditio" or "powered by ldu" Risk : Very High! Usage : Firstly, you registe...

CVE-2007-3083

Z-Blog 1.7 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for zblog.mdb...

Improper access control

Z-Blog 1.7 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for zblog.mdb...

CVE-2007-3083

CVE-2007-3083 affects Z-Blog 1.7, where sensitive data is stored under the web root with insufficient access control. An attacker can directly access zblog.mdb to download the database, per NVD entry. The CVSS v2 vector (AV:N/AC:L/Au:N/C:C/I:N/A:N) yields a base score of 7.8 (High). No remediatio...

CVE-2007-3083

Z-Blog 1.7 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for zblog.mdb...