BinGo News <= v3.01 (bnrep) Remote File Inclusion Exploit

============================================================================================== BinGo News = v3.01 bnrep Remote File Inclusion Exploit =============================================================================================== Critical Level : Dangerous Venedor site :...

[ERPSCAN-15-028] Oracle E-Business Suite - XXE injection Vulnerability

ADVISORY INFORMATION Title: Oracle E-Business Suite XXE injection Advisory ID: ERPSCAN-15-028 Advisory URL: http://erpscan.com/advisories/erpscan-15-028-oracle-e-business-suite-xxe-injection-vulnerability/ Date published: 20.10.2015 Vendors contacted: Oracle 2. VULNERABILITY INFORMATION Class:...

Multiple vulnerabilities in RUNCMS 1.6 by DSecRG

Digital Security Research Group Advisory Application: RunCMS Versions Affected: RunCMS 1.6 Vendor URL: http://www.runcms.org Bugs: SQL Injections, XSS, PHP Include, Predictable session id, etc. Exploits: Aviable Reported: 14.12.2007 Vendor response: 15.12.2007 Date of Public Advisory: 25.12.2007...

Security update for Gnome-Lokkit

A bug has been found in the Gnome lokkit firewall package that could leave a few ports exposed when the user answered no to making any services visible to the outside world. Gnome-Lokkit 0.41 fixes this problem. Users should upgrade and regenerate their firewall rules...

Oracle / Sun / Peoplesoft / Open Office applications multiple security vulnerabilities

Quarterly security update closes nearly 70 different vulnerabilities in all applications...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Microsoft Security Bulletin MS09-001 - Critical Vulnerabilities in SMB Could Allow Remote Code Execution (958687)

Microsoft Security Bulletin MS09-001 - Critical Vulnerabilities in SMB Could Allow Remote Code Execution 958687 Published: January 13, 2009 Version: 1.0 General Information Executive Summary This security update resolves several privately reported vulnerabilities in Microsoft Server Message Block...

Adobe Distiller buffer overflow

Buffer overflow on .joboptions file parsing...

Re: [oss-security] CVE-2014-6271: remote code execution through bash

Florian Weimer: Chet Ramey, the GNU bash upstream maintainer, will soon release official upstream patches. http://ftp.gnu.org/pub/gnu/bash/bash-3.0-patches/bash30-017 http://ftp.gnu.org/pub/gnu/bash/bash-3.1-patches/bash31-018 http://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-052...

RUCKUS ADVISORY ID 041414: OpenSSL 1.0.1 library's "Heart bleed" vulnerability - CVE-2014-0160

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 RUCKUS ADVISORY ID 041414 Customer release date: April 14, 2014 Public release date: April 14, 2014 TITLE OpenSSL 1.0.1 library's "Heart bleed" vulnerability - CVE-2014-0160 SUMMARY OpenSSL library is used in Ruckus products to implement various...

NSOADV-2011-001: Symantec LiveUpdate Administrator CSRF vulnerability

NSOADV-2011-001: Symantec LiveUpdate Administrator CSRF vulnerability 111101111 11111 00110 00110001111 111111 01 01 1 11111011111111 11111 0 11 01 0 11 1 1 111011001 11111111101 1 11 0110111 1 1111101111 1001 0 1 10 11 0 10 11 1111111 1 111 111001 111111111 0 10 1111 0 11 11 111111111 1 1101 10...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Remote File Include In Script copyright (c) James Coyle; JCcorp

By Hasadya Raed Contact : [email protected] ------------------------------------ Script : copyright c James Coyle; JCcorp Expl : Remote Include File Dork : "copyright © James Coyle; JCcorp" ------------------------------------ B.File : createurl.php ------------------------------------ Exploit :...

ArtForms 2.1b7.2 RC2 Joomla Component Multiple Remote Vulnerabilities

ArtForms 2.1b7.2 RC2 Joomla Component Multiple Remote Vulnerabilities Name ArtForms Vendor http://joomlacode.org/gf/project/jartforms/ Versions Affected 2.1b7.2 RC2 Author Salvatore Fresta aka Drosophila Website http://www.salvatorefresta.net Contact salvatorefresta at gmail dot com Date 2010-07-...

Microsoft Security Bulletin MS09-063 - Critical Vulnerability in Web Services on Devices API Could Allow Remote Code Execution (973565)

Microsoft Security Bulletin MS09-063 - Critical Vulnerability in Web Services on Devices API Could Allow Remote Code Execution 973565 Published: November 10, 2009 Version: 1.0 General Information Executive Summary This security update resolves a privately reported vulnerability in the Web Service...

Linux kernel multiple security vulnerabilities

Kernel memory content leak in cpuset and setsockopt. Weak PRNG generator. GEODE-AES weak encryption key generation...

@lex Guestbook 4.0.1 : Full Path Disclosure & XSS

@lex Guestbook 4.0.1 -------------------- Vendor site: http://www.alexphpteam.com/ Product: @lex Guestbook 4.0.1 Vulnerability: Full Path Disclosure & XSS Credits: MrKaLiMaN Reported to Vendor: 24.11.06 Public disclosure: 30.11.06 Description: ------------ Full Path Disclosure:...

[ERPSCAN-15-025] Oracle E-Business Suite Database user enumeration Vulnerability

ADVISORY INFORMATION Title: Oracle E-Business Suite - Database user enumeration Advisory ID: ERPSCAN-15-025 Advisory URL: http://erpscan.com/advisories/erpscan-15-025-oracle-e-business-suite-database-user-enumeration-vulnerability/ Date published:20.10.2015 Vendors contacted: Oracle 2...

Power Phlogger 2.0.9 Remote|Local File Include Vulnerability

Power Phlogger 2.0.9 - Class: Remote|Local File Include Vulnerability Remote: Yes Local: No Type: High Site: http://www.comscripts.com/scripts/php.power-phlogger.211.html Author: xw0x Contact: [email protected] Vuln Code config.inc.php3: ?php include $relpath."functions.php3";//nothing here ?...

EMC Documentum multiple security vulnerabilities

Code injection, privilege escalation...

Mozilla Firefox / Thunderbird / Seamonkey multiple security vulnerabilities

Memory corruptions, local files access...

CVE-2013-4152 XML External Entity (XXE) injection in Spring Framework

Severity: Important Vendor: Spring by Pivotal Versions Affected: - 3.0.0 to 3.2.3 Spring OXM & Spring MVC - 4.0.0.M1 Spring OXM - 4.0.0.M1-4.0.0.M2 Spring MVC - Earlier unsupported versions may also be affected Description: The Spring OXM wrapper did not expose any property for disabling entity...

Microsoft ActiveSync clear text password

Microsoft ActiveSync clear text password Microsoft ActiveSync is widely used to synchronies Windows based PDAs and smartphones with desktop computer. PDA can connect to PC via COM/USB/IR or LAN. Before synchronization user on PC must setup "partnership" to allow synchronization. If PDA is protect...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

RE: ScanAlert Security Advisory

HackerSafe Labs - Security Advisory http://www.hackersafelabs.com SWsoft Plesk for Windows - SQL Injection Vulnerability Date: 9-11-07 Vendor: www.swsoft.com Package: Plesk for Windows Versions: v7.6.1, v8.1.0, v8.1.1, v8.2.0 Vendor Demo: https://plesk8.1win.demo.swsoft.com:8443/login.php3 Credit...

PhotoPost =>4.6 (PP_PATH) Remote File Inclusion Exploit

==================================================================== PhotoPost =4.6 PPPATH Remote File Inclusion Exploit ==================================================================== Critical Level : Dangerous By Saudi Hackrz http://www.popphoto.com/...

Microsoft Security Bulletin MS09-050 - Critical Vulnerabilities in SMBv2 Could Allow Remote Code Execution (975517)

Microsoft Security Bulletin MS09-050 - Critical Vulnerabilities in SMBv2 Could Allow Remote Code Execution 975517 Published: October 13, 2009 Version: 1.0 General Information Executive Summary This security update resolves one publicly disclosed and two privately reported vulnerabilities in Serve...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

MWChat pro V 7.0 <= (CONFIG[MWCHAT_Libs]) Remote File Include Vulnerability

MWChat pro V 7.0 Class = Remote File Inclusion URL : http://www.appindex.net/products/download/?product=mwchat&version=7.0 Found by = Mr.3FReeT .. code in :. about.php , buddy.php , chat.php , dialog.php , head.php , help.php , index.php , license.php ..... nearly all :D...

singapore v0.9.7 XSS Vulnerabilities

SOFTWARE: ========= singapore v0.9.7 DESCRIPTION: ============ The system is vulnerable to various XSS attacks google dork : "Powered by singapore v0.9.7" inurl:index.php?gallery 429 results : xss code example ================ www.site.com/images/index.php?gallery=gallery...

Microsoft WebDAV XML DoS

Large number of attributes in requests causes resource exhaustion...

Microsoft Windows multiple security vulnerabilities

Memory corruption in graphics library, signature check bypass, use-after-free in scripting, multiple privilege escalations...

n.runs-SA-2010.002 - Alcatel-Lucent - arbitrary code execution on OmniVista 4760

n.runs AG http://www.nruns.com/ securityatnruns.com n.runs-SA-2010.002 20-September-2010 Vendor: Alcatel Affected Products: OmniVista 4760 server: all versions prior to release R5.1.06.03.cPatch3. Vulnerability: arbitrary code execution Risk: High CVE-Number: CVE-2010-3281 Vendor communication:...

[Full-disclosure] [SVRT-05-08] Critical BoF vulnerability found in ffdshow affecting all internet browsers (SVRT-Bkis)

General Information ffdshow is a DirectShow filter and VFW codec for many audio and video formats, such as DivX, Xvid and H.264. It is the most popular audio and video decoder on Windows. Besides a stand-alone setup package, ffdshow is often included in almost all codec pack software such as...

DUC NO-IP weak encryption

Password is stored in world-readable registry entry in reversable encryption form...

phpHoo3 (admin.php) Remote Login Bypass SQL Injection Vulnerability

phpHoo3 Login SQL injection // AYYILDIZ.ORG Gururla Sunar... download:http://cable-modems.org/phpHoo/files/phphoo3.zip author : iLker Kandemir ilkerkandemir at mynet.com Risk : High Class : Remote Vuln. Script : phpHoo3 tnx : h0tturk,ekin0x,Gencnesil,Gencturk,koray,Ajann .. Vulnerable; ///admin.p...

[MajorSecurity #26] Woltlab Burning Board - Multiple Cookie manipulation and session fixation vulnerabilities

MajorSecurity 26 Woltlab Burning Board - Multiple Cookie manipulation and session fixation vulnerabilities ---------------------------------------------------------------------------------------- Software: Woltlab Burning board Impact: Cookie manipulation and Session Fixation Made public: July,...

[security bulletin] HPSBHF03119 rev.2 - HP DreamColor Professional Display running Bash Shell, Remote Code Execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04468293 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04468293 Version: 2 HPSBHF03119 rev....

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Code Execution via XSS in Internet Explorer

Hello 3APA3A! Recently I wrote about Code Execution via XSS attack http://websecurity.com.ua/2635/. In this article I told about Code Execution attack via Cross-Site Scripting vulnerability in Internet Explorer http://websecurity.com.ua/1241/, which I disclosed in August 2007. Last year and this...

MODx CMS 0.9.2.1 (base_path) Remote File Include Vulnerability

+------------------------------------------------------------------------------------------- + MODx CMS 0.9.2.1 basepath Remote File Include Vulnerability +------------------------------------------------------------------------------------------- + Affected Software .: MODx CMS 0.9.2.1 + Vendor...

Mambo Gallery Manager v095.r3 Remote File Inclusion Vulnerabilities

---------------------------------------------------- Mambo Gallery Manager v095.r3 Remote File Inclusion Vulnerabilities ---------------------------------------------------- Discovered By A-S-T TEAM WE ARE CrAsHoVeRrIdE & BLACK-CODE & MR-HCR ---------------------------------------------------- si...

[security bulletin] HPSBMU03032 rev.1 - HP Virtual Connect Firmware Smart Components Installer Software running OpenSSL, Remote Disclosure of Information

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04272594 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04272594 Version: 1 HPSBMU03032 rev....

Ako Comments (mod) Remote File Inclusion

Aria-Security.net Advisory Discovered by: O.U.T.L.A.W www.Aria-security.net Gr33t to: A.U.R.A & Hessam-X & Cl0wn & DrtRp Software: Ako Comments mod Attack method: Remote File Inclusion Source: Description: This module shows users' comments from component AkoComments. File Version: 1.1 for Mambo 4...

Winamp M3U playlist parser buffer overflow security vulnerability

LEGAL NOTICE: By reading this you do agree that life does not make sense and it doesn't need to. You also agree to wear a condom. You do agree to think about nature. .. umm you also agree to GPL all software you've ever written. Click here if you're under 18 There is a buffer overflow security...

[security bulletin] HPSBST03004 rev.1 - HP IBRIX X9320 Storage running OpenSSL, Remote Disclosure of Information

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04264595 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04264595 Version: 1 HPSBST03004 rev....

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

PostGuestbook 0.6.1(tpl_pgb_moddir)Remote File Include Expliot

PostGuestbook 0.6.1tplpgbmoddirRemote File Include Expliot D.Script: http://sourceforge.net/projects/postguestbook/ Dork: "Powered by: PostGuestbook 0.6.1" Discovered by GloDM = Mahmoodali Homepage: http://www.Tryag.cc Greetz To Tryag-Team & 4lKaSrGoLd3n-Team & AsbMay's Group V.Code include...

Multiple vulnerabilities in WinShadow

Multiple vulnerabilities in WinShadow ------------------------------------- Affected Systems: OmniCom WinShadow version: 2.0 and possibly earlier versions Vendor: OmniCom Technologies - http://www.omnicomtech.com Issue: 1. Buffer overflow in client handling hostnames in host files 2. DoS against...

FreeBSD Ports Security Advisory FreeBSD-SA-01:27.cfengine

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:27 Security Advisory FreeBSD, Inc. Topic: cfengine port contains remote root vulnerability Category: ports Module: cfengine Announced: 2001-03-12 Credits: Pekka Savola...