ZDI-10-031: Apple Webkit Blink Event Dangling Pointer Remote Code Execution Vulnerability

ZDI-10-031: Apple Webkit Blink Event Dangling Pointer Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-031 March 16, 2010 -- Affected Vendors: Apple -- Affected Products: Apple WebKit -- TippingPointTM IPS Customer Protection: TippingPoint IPS customers have...

ZDI-10-027: Skype Protocol Handler datapath Argument Injection Remote Code Execution Vulnerability

ZDI-10-027: Skype Protocol Handler datapath Argument Injection Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-027 March 11, 2010 -- Affected Vendors: Skype -- Affected Products: Skype -- TippingPointTM IPS Customer Protection: TippingPoint IPS customers hav...

Samagraph CMS SQL Injection

Title : Sql injection in samagraph product Date : 11-03-2010 Author : K053 Vendor : http://www.samagraph.com/ Cms is fully vulnerable, but just enjoy this zer0day flaw : ------------------------------------------------------------- Dork : inurl:"fa/inside.aspx?g=" list :...

Samagraph CMS SQL Injection / Authentication Bypass Vulnerability

Exploit for unknown platform in category web applications ================================================================= Samagraph CMS SQL Injection / Authentication Bypass Vulnerability ================================================================= Title : Sql injection in samagraph produc...

[security bulletin] HPSBMA02489 SSRT090065 rev.1 - HP Performance Insight , Remote Execution of Arbitrary Commands

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c02033170 Version: 1 HPSBMA02489 SSRT090065 rev.1 - HP Performance Insight , Remote Execution of Arbitrary Commands NOTICE: The information in this Security Bulletin should be acted upon as soon a...

Exploit Code Published for Latest IE Zero-Day

Using obvious clues from a McAfee blog post, an Israeli hacker was able to pinpoint the latest Internet Explorer zero-day vulnerability and create working exploit code. The exploit code, which provides a clear roadmap to launch drive-by download attacks against IE 6 and IE 7 users, is being fitte...

ZDI-10-025: Microsoft Office Excel XLSX File Parsing Remote Code Execution Vulnerability

ZDI-10-025: Microsoft Office Excel XLSX File Parsing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-025 March 9, 2010 -- CVE ID: CVE-2010-0263 -- Affected Vendors: Microsoft -- Affected Products: Microsoft Office Excel -- Vulnerability Details: This...

Microsoft Warns of New IE Zero Day Attacks

A zero-day unpatched vulnerability in Microsoft’s Internet Explorer is being exploited in the wild, the company warned in an advisory issued today. On the same day it issued software fixes as part of its Patch Tuesday schedule, Microsoft released a pre-patch advisory to warn of the risk of remote...

ZDI-10-022: IBM Informix librpc.dll Multiple Remote Code Execution Vulnerabilities

ZDI-10-022: IBM Informix librpc.dll Multiple Remote Code Execution Vulnerabilities http://www.zerodayinitiative.com/advisories/ZDI-10-022 March 1, 2010 -- CVE ID: CVE-2009-2753 -- Affected Vendors: IBM -- Affected Products: IBM Informix -- TippingPointTM IPS Customer Protection: TippingPoint IPS...

ZDI-10-024: Novell eDirectory SOAP Request Parsing Denial of Service Vulnerability

ZDI-10-024: Novell eDirectory SOAP Request Parsing Denial of Service Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-024 March 2, 2010 -- Affected Vendors: Novell -- Affected Products: Novell eDirectory -- TippingPointTM IPS Customer Protection: TippingPoint IPS customers have be...

Microsoft Office PowerPoint Viewer TextBytesAtom Record Buffer Overflow

Added: 03/04/2010 CVE: CVE-2010-0033 BID: 38107 OSVDB: 62241 Background Microsoft PowerPoint Viewer 2003 is a free tool which allows viewing of Microsoft PowerPoint presentations without requiring Microsoft PowerPoint itself. Problem A stack overflow vulnerability in the handling of TextBytesAtom...

Hacker Report 'High Risk' Flaws in Safari Browser

Over the last two weeks, security researchers have reported eight different zero-day vulnerabilities in Apple’s Safari browser. Details of these vulnerabilities, all rated “high risk,” have been sold to Tippingpoint’s Zero Day Initiative ZDI, a program that purchases the rights to vulnerability...

ZDI-10-019: Mozilla Firefox showModalDialog Cross-Domain Scripting Vulnerability

ZDI-10-019: Mozilla Firefox showModalDialog Cross-Domain Scripting Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-019 February 19, 2010 -- CVE ID: CVE-2009-3988 -- Affected Vendors: Mozilla Firefox -- Affected Products: Mozilla Firefox 3.0.x -- TippingPointTM IPS Customer...

ZDI-10-020: EMC HomeBase SSL Service Arbitrary File Upload Remote Code Execution Vulnerability

ZDI-10-020: EMC HomeBase SSL Service Arbitrary File Upload Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-020 February 23, 2010 -- CVE ID: CVE-2010-0620 -- Affected Vendors: EMC -- Affected Products: EMC HomeBase Server -- Vulnerability Details: This...

ZDI-10-018: IBM Cognos Server Backdoor Account Remote Code Execution Vulnerability

ZDI-10-018: IBM Cognos Server Backdoor Account Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-018 February 18, 2010 -- Affected Vendors: IBM -- Affected Products: IBM Cognos -- TippingPointTM IPS Customer Protection: TippingPoint IPS customers have been...

Attack Code Released for Firefox Zero Day

A Russian security researcher on Thursday said he has released attack code that exploits a critical vulnerability in the latest version of Mozilla’s Firefox browser. Read the full article The Register...

Security Skeletons in Adobe's Closet

We all know what happens when a software vendor downplays the severity of a security vulnerability. It usually comes back to haunt them, when the vulnerability is eventually discovered by the bad guys and used to exploit innocent computer users. Microsoft, Apple and even Mozilla have all been...

Web Worker Array Handling Heap Corruption Vulnerability — Mozilla

Security researcher Orlando Barrera II of SecTheory reported, via TippingPoint's Zero Day Initiative, that Mozilla's implementation of Web Workers contained an error in its handling of array data types when processing posted messages. This error could be used by an attacker to corrupt heap memory...

ZDI-10-016: Microsoft Windows ShellExecute Improper Sanitization Code Execution Vulnerability

ZDI-10-016: Microsoft Windows ShellExecute Improper Sanitization Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-016 February 9, 2010 -- CVE ID: CVE-2010-0027 -- Affected Vendors: Microsoft -- Affected Products: Microsoft Windows XP -- TippingPointTM IPS Customer...

Change parameter "wide links" to default to "no";

Description The problem comes from a combination of two features in Samba, each of which on their own are useful to Administrators, but in combination allow users to access any file on the system that their logged in username has permissions to read this is not a privilege escalation problem. By...