Cisco Security Advisory: Cisco PIX Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco PIX Vulnerabilities Revision 1.0 For Public Release 2003 December 15 at 1600 UTC GMT ---------------------------------------------------------------------- Contents Summary Affected Products Details Impact Software...

[security bulletin] HPSBHF02888 rev.1 - HP ProCurve, H3C, 3COM Routers and Switches, Remote Information Disclosure and Code Execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03808969 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03808969 Version: 1 HPSBHF02888 rev....

ESA Software S.p.a. Asp/Portal www/archivio.asp Sql injection

ESA Software S.p.a. Asp/Portal www/archivio.asp Sql injection Credit : CodeXpLoder'tq Mail : codexploderathotmaildotcom Site : codexploder.biyosecurity.net,biyofrm.com Sourge : http://www.esasoftware.com ЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈЈ Thnx :...

Portcullis Security Advisory 06-038

Portcullis Security Advisory 06-038 Vulnerable System: Movable Type Vulnerability Title: Username enumeration is possible via the password reset mechanism. Vulnerability Discovery And Development: Portcullis Security Testing Services. Credit For Discovery: Tim Brown - Porcullis Computer Security...

In-game format string bug in the Lithtech engine

Luigi Auriemma Application: Lithtech engine http://www.lithtech.com Games: Alien vs Predator 2 = 1.0.9.6 Blood 2 = 2.1 Contract Jack = 1.1 Global Operations = 2.0/2.1 Kiss Psycho Circus = 1.13 Legends of Might and Magic = 1.1 No one lives forever = 1.004 No one lives forever 2 = 1.3 Purge Jihad =...

Update to Microsoft Security Bulletin MS00-086

-----BEGIN PGP SIGNED MESSAGE----- Hi All - We have updated Microsoft Security Bulletin MS00-086 http://www.microsoft.com/technet/security/bulletin/MS00-086.asp, to provide the following additional information: There is an additional restriction on the vulnerability. As originally reported, the...

Vulnerability found in Flynax Classifieds products

I. BACKGROUND -------------- Flynax is a software development company which produces several CMSs to mantain different kinds of classifieds websites. II. DESCRIPTION ---------------- Nasel members discovered a critical vulnerability in the front-end of these products. The vulnerability is an SQL...

Inout Meta Searh engine Remote Code Execution

!/usr/bin/php -q -d shortopentag=on ? echo " Inout Search Engine all version Remote Code Execution Exploit by BlackHawk [email protected] http://itablackhawk.altervista.org Thanks to rgod for the php code and Marty for the Love "; if $argc3 echo "Usage: php ".$argv0." Host Path cmd Host: targe...

[USN-2782-1] Apport vulnerability

========================================================================== Ubuntu Security Notice USN-2782-1 October 27, 2015 apport vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

CodeBreak (codebreak.php process_method) - Remote File Inclusion Vulnerability

http://john-martinelli.com/work/codebreak.txt !-- CodeBreak codebreak.php processmethod - Remote File Inclusion Vulnerability Google d0rk: intitle:"CodeBreak - Hidden Morse Code" Vulnerable Code: include$POST"processmethod" . "" . $POST"outputmethod" . ".inc"; John Martinelli [email protected]...

CA20140413-01: Security Notice for OpenSSL Heartbleed Vulnerability

CA20140413-01: Security Notice for OpenSSL Heartbleed Vulnerability Issued: April 13, 2014 Updated: May 12, 2014 CA Technologies is investigating an OpenSSL vulnerability, referred to as the "Heartbleed bug" that was publicly disclosed on April 7, 2014. CVE identifier CVE-2014-0160 has been...

PerlSoft Guestbook v1.7b Bruteforcer + RCE!

Typ: Bruter & RCE Name: PerlSoft GB Pwner Affected Software: PerlSoft Gastebuch Version: 1.7b Coder/Bugfounder: Perforin ------ the RCE is only once possible, do not waste your command! STEP1: Use my script to bruteforce the admin login from the guestbook. STEP2: If we gain access, you can decide...

[ERPSCAN-15-029] Oracle E-Business Suite - XXE injection Vulnerability

ADVISORY INFORMATION Title: Oracle E-Business Suite - XXE injection Advisory ID: ERPSCAN-15-029 Advisory URL: http://erpscan.com/advisories/erpscan-15-029-oracle-e-business-suite-xxe-injection-vulnerability/ Date published: 21.10.2015 Vendors contacted: Oracle 2. VULNERABILITY INFORMATION Class:...

Multiple vulnerabilities in Joomla-Base

Hello 3APA3A! These are Denial of Service, XML Injection, Cross-Site Scripting, Full path disclosure and Insufficient Anti-automation vulnerabilities in Joomla-Base. This is package of Joomla with different plugins with their vulnerabilities. These vulnerabilities are in Google Maps plugin for...

PBBoard v2.1.4 CMS - Multiple Web Vulnerabilities

Title: ====== PBBoard v2.1.4 CMS - Multiple Web Vulnerabilities Date: ===== 2012-06-26 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=623 VL-ID: ===== 625 Common Vulnerability Scoring System: ==================================== 4.5 Introduction: ============= PBBoard...

Article DashBoard all version SQL Injection Vulnerability

ArticleDashBoard all version SQL Injection Vulnerability Homepage: http://articledashboard.com/ Download: http://www.articledashboard.com/addxpc/ArticleDashboard.zip SQL Injection Found by : ^ Xcross87 | xcross87.info | hcegroup.net Thanks to: ^ RongChauA | reaonline.net | rongchaua.net Dork :...

OpenBSD ICMPv6 buffer overflow

Buffer oveflow on fragmented IPv6 packet...

CORE-2013-0704 - Vivotek IP Cameras RTSP Authentication Bypass

Core Security - Corelabs Advisory http://corelabs.coresecurity.com Vivotek IP Cameras RTSP Authentication Bypass 1. Advisory Information Title: Vivotek IP Cameras RTSP Authentication Bypass Advisory ID: CORE-2013-0704 Advisory URL:...

AllMyLinks PHP Code Injection vulnerability

AllMyLinks PHP Code Injection vulnerability Product : AllMyLinks Vendor : www.php-resource.net Date : February 14, 2004 Problem : PHP Code Injection Vendor Contacted ? : No Source in /include/footer.inc.php -------------------------------------------------------------- $AMLfooterget =...

Microsoft Security Bulletin MS10-071 - Critical Cumulative Security Update for Internet Explorer (2360131)

Microsoft Security Bulletin MS10-071 - Critical Cumulative Security Update for Internet Explorer 2360131 Published: October 12, 2010 Version: 1.0 General Information Executive Summary This security update resolves seven privately reported vulnerabilities and three publicly disclosed vulnerabiliti...

new vulnerability inPowerFTP Personal FTP Server

PowerFTP Personal FTP Server is a multithreaded FTP server for the MS Windows OS by Cooolsoft. The PowerFTPd is available from vendor Cooolsoft's website: http://www.cooolsoft.com I found a vulnerability has PowerFTP that allows a remote user--any user--to shut down the ftp server tested on v 2.2...

Cisco CUCM - Multiple Vulnerabilities

Recurity Labs GmbH http://www.recurity-labs.com [email protected] Date: 08.11.2011 Vendor: Cisco Systems Product: CUCM Environment Cisco Unified Communications Manager CallManager Cisco IP Phone CP-7975G Vulnerability: Directory Traversal Reversible Obfuscation Algorithm SCCP service...

PR08-16: CSRF (Cross-site Request Forgery) on Moodle edit profile page

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 PR08-16: CSRF Cross-site Request Forgery on Moodle edit profile page Vulnerability found: 25/06/2008 Vendor informed: 28/06/2008 Vulnerability fixed: 16/07/2008 Advisory publicly released: 22/07/2008 Severity: High Description: HTTP requests can be...

[Full-disclosure] D-Link DSL routers authentication bypass

====================== SUMMARY ======================== Title: D-Link DSL routers authentication bypass Date: 19 May 2005 Author: Francesco Orro francesco.orro 4t akhela.com Product: DSL-502T, DSL-504T, DSL-562T, DSL-G604T Vendor: D-Link Vendor URL: http://www.dlink.com Vendor Status: D-Link was...

[security bulletin] HPSBMU02714 SSRT100244 rev.1 - HP Network Node Manager i (NNMi) for HP-UX, Linux, Solaris, and Windows, Remote Unauthorized Disclosure of Information

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03057508 Version: 1 HPSBMU02714 SSRT100244 rev.1 - HP Network Node Manager i NNMi for HP-UX, Linux, Solaris, and Windows, Remote Unauthorized Disclosure of Information NOTICE: The information in...

[waraxe-2004-SA#026 - Multiple vulnerabilities in Coppermine Photo Gallery for PhpNuke]

================================================================================ waraxe-2004-SA026 ================================================================================ Multiple vulnerabilities in Coppermine Photo Gallery for PhpNuke...

CERT Advisory CA-2003-06 Multiple vulnerabilities in implementations of the Session Initiation Protocol (SIP)

-----BEGIN PGP SIGNED MESSAGE----- CERT Advisory CA-2003-06 Multiple vulnerabilities in implementations of the Session Initiation Protocol SIP Original release date: February 21, 2003 Last revised: -- Source: CERT/CC A complete revision history can be found at the end of this file. Systems Affect...

CVE-2011-2730: Spring Framework Information Disclosure

CVE-2011-2730: Spring Framework Information Disclosure Severity: Variable depending on application. Likely to be low to moderate, may be important. Version affected: 3.0.0 to 3.0.5 2.5.0 to 2.5.6.SEC02 community releases 2.5.0 to 2.5.7.SR01 subscription customers Earlier, unsupported versions may...

XSRF (CSRF) in CMScout

Vulnerability ID: HTB22719 Reference: http://www.htbridge.ch/advisory/xsrfcsrfincmscout.html Product: CMScout Vendor: CMScout Team http://www.cmscout.co.za/ Vulnerable Version: 2.09 and probably prior versions Vendor Notification: 25 November 2010 Vulnerability Type: CSRF Cross-Site Request Forge...

[security bulletin] HPSBMU02994 rev.2 - HP BladeSystem c-Class Onboard Administrator (OA) running OpenSSL, Remote Disclosure of Information

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04236062 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04236062 Version: 2 HPSBMU02994 rev....

HP/H3C and Huawei SNMP Weak Access to Critical Data

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 HP/H3C and Huawei SNMP Weak Access to Critical Data =================================================== http://grutztopia.jingojango.net/2012/10/hph3c-and-huawei-snmp-weak-access-to.html Overview - - -------- HP/H3C and Huawei networking equipment...

PhotoPost PHP 4.6 - 4.5 [PP_PATH] >> Remote File Include Vulnerability

PhotoPost PHP 4.6 - 4.5 PPPATH Remote File Include Vulnerability Found by ..........: AG-Spider our Web Site : ---- http://www.ArabAttack.com Arab Attack Security Team Affected Software .: PhotoPost PHP Vendor ............: http://www.popphoto.com Risk & Class...: high-Remote File Inclusion C0ntA...

Cpanel 5 and below remote command execution and local root vulnerabilities

Products: Cpanel 5 and below http://www.cpanel.net Date: 19th February 2003 Author: pokleyzz pokleyzzatscan-associates.net Contributors: sk skatscan-associates.net shaharil shaharilatscan-associates.net Special thanks: Skywizard skywizardatmybsd.org.my Description =========== Cpanel is web hostin...

Oracle / Sun / PeopleSoft / MySQL multiple security vulnerabilities

Over 150 vulnerabilities in different applications are closed in auqrterly update...

PHP-Nuke KutubiSitte "kid" SQL Injection exploit code adding

!/usr/bin/perl use Getopt::Std; use LWP::UserAgent; sub usg printf" --------------------------- | PHP-NUKE KutubiSitte kid = SQL Injection | --------------------------- Bug by Lovebug Exploit-Code by r080cy90r from RBT-4 ----------------------------- :::::::::::::::::::::::::::::...

Office XP Remote SQL Injection

Aria-Security Team Persian Security Network http://forum.Aria-Security.com ENGLISH FORUM! -------------------------------------------------- Shoutz: Aura, Null, Kinglet Office XP Remote SQL Injection Vendor: vso-xp.com Vulnerable File: MyIssuesView.asp Original Adivosry:...

RUNCMS 1.3a SQL injection

refrence: http://www.runcms.org/public/modules/forum/viewtopic.php?topicid=4003&forum=18 http://hamid.ir/security/ ----------------------------------------------- RUNCMS 1.3a SQL injection Runcms Includes most things a webmaster would expect from a cms: downloads, links, tutorials section, polls,...

XSS and IL vulnerabilities in IBM Lotus Domino

Hello 3APA3A! I want to warn you about Cross-Site Scripting and Information Leakage vulnerabilities in IBM Lotus Domino. At 15th of August IBM released the advisory concerning these Cross-Site Scripting vulnerabilities. CVE ID: CVE-2012-3302. ------------------------- Affected products:...

D-Link DIR-300 authentication bypass

intro Hello, I found security bug in D-Link DIR-300 wireless router. It can be used to bypass authentication mechanizm by attacker with access to web interface. I reported it to D-Link but they are not replying for my emails. According to other D-Link security holes and their status I think that...

Oracle Database Buffer overflows and Denial of service vulnerabilities in public procedures of MDSYS.MD (DB12)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Team SHATTER Security Alert Update Oracle Database Buffer overflows and Denial of service vulnerabilities in public procedures of MDSYS.MD DB12 Jan 18, 2007 Updated July 18th, 2007 Risk Level: High Affected versions: Oracle Database Server versions 8i...

BF and FPD vulnerabilities in MODx

Hello 3APA3A! I want to warn you about security vulnerabilities in MODx. This is the first part of the vulnerabilities in this CMS the first 19 vulnerabilities. These are Brute Force and Full path disclosure vulnerabilities in MODx. It's about 0.x and 1.x Evolution versions of MODx CMS. In 2.x...

ZDI-12-081 : Oracle Java GlueGen Arbitrary Native Library Loading Remote Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-081 : Oracle Java GlueGen Arbitrary Native Library Loading Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-081 June 6, 2012 - -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P - -- Affected Vendors: Oracle - --...

[Full-disclosure] FusionPHP Multiple Vulnerabilities

Advisory 8 Title: FusionPHP Multiple Vulnerabilities Author: 0ozeuso0 Contact: [email protected] Website: www.elitemexico.org Date: 01/03/2006 Risk: High Vendor Url: http://fusionphp.net/forums/ Affected Software: FusionPHP Non Affected: We Are: olimpus klan team Info:...

Zorum Portal (PHP)

Version : 3.0;3.1;3.2 Website : http://zorum.phpoutsourcing.com/ Problem : Include file File: --------------------------------- include.php --------------------------------- PHP Code: --------------------------------- ... include"$gorumDir/generformlibmultipleselection.php";...

Geovision Digital Video Surveillance System directory traversal

No description provided...

Security Advisory: FreeBSD-SA-00:58.chpass

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:58 Security Advisory FreeBSD, Inc. Topic: chpass family contains local root vulnerability Category: core Module: chfn/chpass/chsh/ypchfn/ypchpass/ypchsh/passwd Announced:...

CVE-2014-1599 - 39 Type-1 XSS in SFR DSL/Fiber Box

CVE-2014-1599 39 Type-1 XSS in SFR ADSL/Fiber Box. SFR is the french Vodafone estimated DSL user base of 5.2 Millions. affected product: SFR BOX NB6-MAIN-R3.3.4 vulnerabilities: /network/dns 5 non-filtered Type-1 XSS /network/dhcp 6 non-filtered Type-1 XSS /network/nat 7 non-filtered Type-1 XSS...

WGCC Beta <= 0.5.6 (quiz.php) Remote SQL InJection Vulnerability

Title : WGCC Beta = 0.5.6 quiz.php Remote SQL InJection Vulnerability Author : ajann Dork : "Web Group Communication Center beta 0.5.6/0.5.5/.." Greetz : Tm, Mslman, Aleminin, Ramazan, Bayram., MUBAREK, Olsun --Login Before Injection Inject http://target.com/path/quiz.php?action=show&qzid=SQL...

Multiple Sql injection and XSS in CartWIZ ASP Cart

Dcrab 's Security Advisory Hsc Security Group http://www.hackerscenter.com/ dP Security http://digitalparadox.org/ Get Dcrab's Services to audit your Web servers, scripts, networks, etc. Learn more at http://www.digitalparadox.org/services.ah Severity: High Title: Multiple Sql injection and XSS i...

[SECURITY] [DSA-046-1] exuberant-ctags uses insecure temporary files

-----BEGIN PGP SIGNED MESSAGE----- - ------------------------------------------------------------------------ Debian Security Advisory DSA-046-1 [email protected] http://www.debian.org/security/ Wichert Akkerman April 15, 2001 -...