Zero-day flaw in WordPress image utility allows to upload files and execute codes

Zero-day flaw in WordPress image utility allows to upload files and execute codes Mark Maunder, CEO of Seattle-based technology firm Feedjit, discovered the flaw after his own blog was hacked to load advertising content. He ended up tracing the issue back to TimThumb, which he uses on his blog...

Zero-day flaw in WordPress image utility allows to upload files and execute codes

Zero-day flaw in WordPress image utility allows to upload files and execute codes Mark Maunder, CEO of Seattle-based technology firm Feedjit, discovered the flaw after his own blog was hacked to load advertising content. He ended up tracing the issue back to TimThumb, which he uses on his blog...

ZDI-11-239: Apple Safari Webkit FrameOwner Element Remote Code Execution Vulnerability

ZDI-11-239: Apple Safari Webkit FrameOwner Element Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-239 July 27, 2011 -- CVE ID: CVE-2011-0233 -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P -- Affected Vendors: Apple -- Affected Products: Apple WebKit --...

ZDI-11-240: Apple Safari Webkit SVG Marker Remote Code Execution Vulnerability

ZDI-11-240: Apple Safari Webkit SVG Marker Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-240 July 27, 2011 -- CVE ID: CVE-2011-1453 -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P -- Affected Vendors: Apple -- Affected Products: Apple WebKit -- TippingPointTM IPS...

ZDI-11-242: Apple Safari Rendering Object Body Detachment Remote Code Execution Vulnerability

ZDI-11-242: Apple Safari Rendering Object Body Detachment Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-242 July 27, 2011 -- CVE ID: CVE-2011-0255 -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P -- Affected Vendors: Apple -- Affected Products: Apple Safari --...

ZDI-11-238: Oracle Secure Backup validate_login Command Injection Remote Code Execution Vulnerability

ZDI-11-238: Oracle Secure Backup validatelogin Command Injection Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-238 July 21, 2011 -- CVE ID: CVE-2011-2261 -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P -- Affected Vendors: Oracle -- Affected Products: Oracle Secu...

ZDI-11-237: CA Total Defense Suite Gateway Security Malformed HTTP Packet Remote Code Execution Vulnerability

ZDI-11-237: CA Total Defense Suite Gateway Security Malformed HTTP Packet Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-237 July 20, 2011 -- CVE ID: CVE-2011-2667 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: CA -- Affected Products: CA Tota...

ZDI-11-236: EMC Documentum eRoom Indexing Server OpenText HummingBird Connector Remote Code Execution Vulnerability

ZDI-11-236: EMC Documentum eRoom Indexing Server OpenText HummingBird Connector Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-236 July 18, 2011 -- CVE ID: CVE-2011-1741 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: EMC -- Affected Products:...

Apple, Google Need Mobile Security Rethink

Threatpost interviews Mickey Boodaei, the CEO of Trusteer, about the state of mobile device security. Mobile security issues have been getting more press recently – on Threatpost and elsewhere. Partially, this is because they’re new, and because mobile devices are proliferating both at home and i...

ZDI-11-233: Symantec Web Gateway forget.php SQL Injection Vulnerability

ZDI-11-233: Symantec Web Gateway forget.php SQL Injection Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-233 July 7, 2011 -- CVE ID: CVE-2011-0549 -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P -- Affected Vendors: Symantec -- Affected Products: Symantec Web Gateway -- TippingPointTM...

ZDI-11-234: Trend Micro Control Manager CasLogDirectInsertHandler.cs Remote Code Execution Vulnerability

ZDI-11-234: Trend Micro Control Manager CasLogDirectInsertHandler.cs Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-234 July 11, 2011 -- CVSS: 9, AV:N/AC:L/Au:N/C:P/I:P/A:C -- Affected Vendors: Trend Micro -- Affected Products: Trend Micro Control Manager -...

ZDI-11-235: TrendMicro Control Manager CASProcessor.exe BLOB Remote Code Execution Vulnerability

ZDI-11-235: TrendMicro Control Manager CASProcessor.exe BLOB Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-235 July 12, 2011 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: Trend Micro -- Affected Products: Trend Micro Control Manager --...

ZDI-11-234: Trend Micro Control Manager CasLogDirectInsertHandler.cs Remote Code Execution Vulnerability

ZDI-11-234: Trend Micro Control Manager CasLogDirectInsertHandler.cs Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-234 July 11, 2011 -- CVSS: 9, AV:N/AC:L/Au:N/C:P/I:P/A:C -- Affected Vendors: Trend Micro -- Affected Products: Trend Micro Control Manager -...

ZDI-11-230: Apple Quicktime Apple Lossless Audio Codec Parsing Remote Code Execution Vulnerability

ZDI-11-230: Apple Quicktime Apple Lossless Audio Codec Parsing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-230 June 29, 2011 -- CVE ID: CVE-2011-0211 -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P -- Affected Vendors: Apple -- Affected Products: Apple Quicktim...

ZDI-11-232: HP iNode Management Center iNodeMngChecker.exe Remote Code Execution Vulnerability

ZDI-11-232: HP iNode Management Center iNodeMngChecker.exe Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-232 July 1, 2011 -- CVE ID: CVE-2011-1867 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: Hewlett-Packard -- Affected Products:...

ZDI-11-226: Citrix EdgeSight Launcher Service Remote Code Execution Vulnerability

ZDI-11-226: Citrix EdgeSight Launcher Service Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-226 June 27, 2011 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: Citrix -- Affected Products: Citrix EdgeSight -- TippingPointTM IPS Customer...

ZDI-11-228: Apple ColorSync ICC Profile ncl2 Parsing Remote Code Execution Vulnerability

ZDI-11-228: Apple ColorSync ICC Profile ncl2 Parsing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-228 June 29, 2011 -- CVE ID: CVE-2011-0200 -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P -- Affected Vendors: Apple -- Affected Products: Apple Mail Apple OS X...

ZDI-11-227: Novell File Reporter Engine RECORD Tag Parsing Remote Code Execution Vulnerability

ZDI-11-227: Novell File Reporter Engine RECORD Tag Parsing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-227 June 27, 2011 -- CVE ID: CVE-2011-2220 -- CVSS: 9.7, AV:N/AC:L/Au:N/C:C/I:C/A:P -- Affected Vendors: Novell -- Affected Products: Novell File...

ZDI-11-229: Apple QuickTime RIFF fmt Chunk Parsing Remote Code Execution Vulnerability

ZDI-11-229: Apple QuickTime RIFF fmt Chunk Parsing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-229 June 29, 2011 -- CVE ID: CVE-2011-0209 -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P -- Affected Vendors: Apple -- Affected Products: Apple Quicktime --...

ZDI-11-231: Apple QuickTime Pict File Matrix Parsing Remote Code Execution Vulnerability

ZDI-11-231: Apple QuickTime Pict File Matrix Parsing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-231 June 29, 2011 -- CVE ID: CVE-2010-3790 -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P -- Affected Vendors: Apple -- Affected Products: Apple Quicktime --...