Security update for Gnome-Lokkit

A bug has been found in the Gnome lokkit firewall package that could leave a few ports exposed when the user answered no to making any services visible to the outside world. Gnome-Lokkit 0.41 fixes this problem. Users should upgrade and regenerate their firewall rules...

Qualys Security Advisory CVE-2015-0235 - GHOST: glibc gethostbyname buffer overflow

Qualys Security Advisory CVE-2015-0235 GHOST: glibc gethostbyname buffer overflow -- Contents ---------------------------------------------------------------- 1 - Summary 2 - Analysis 3 - Mitigating factors 4 - Case studies 5 - Exploitation 6 - Acknowledgments -- 1 - Summary...

BinGo News <= v3.01 (bnrep) Remote File Inclusion Exploit

============================================================================================== BinGo News = v3.01 bnrep Remote File Inclusion Exploit =============================================================================================== Critical Level : Dangerous Venedor site :...

Linux kernel multiple security vulnerabilities

Kernel memory content leak in cpuset and setsockopt. Weak PRNG generator. GEODE-AES weak encryption key generation...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

[ERPSCAN-15-028] Oracle E-Business Suite - XXE injection Vulnerability

ADVISORY INFORMATION Title: Oracle E-Business Suite XXE injection Advisory ID: ERPSCAN-15-028 Advisory URL: http://erpscan.com/advisories/erpscan-15-028-oracle-e-business-suite-xxe-injection-vulnerability/ Date published: 20.10.2015 Vendors contacted: Oracle 2. VULNERABILITY INFORMATION Class:...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Re: [oss-security] CVE-2014-6271: remote code execution through bash

Florian Weimer: Chet Ramey, the GNU bash upstream maintainer, will soon release official upstream patches. http://ftp.gnu.org/pub/gnu/bash/bash-3.0-patches/bash30-017 http://ftp.gnu.org/pub/gnu/bash/bash-3.1-patches/bash31-018 http://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-052...

Oracle / Sun / Peoplesoft / Open Office applications multiple security vulnerabilities

Quarterly security update closes nearly 70 different vulnerabilities in all applications...

ArtForms 2.1b7.2 RC2 Joomla Component Multiple Remote Vulnerabilities

ArtForms 2.1b7.2 RC2 Joomla Component Multiple Remote Vulnerabilities Name ArtForms Vendor http://joomlacode.org/gf/project/jartforms/ Versions Affected 2.1b7.2 RC2 Author Salvatore Fresta aka Drosophila Website http://www.salvatorefresta.net Contact salvatorefresta at gmail dot com Date 2010-07-...

@lex Guestbook 4.0.1 : Full Path Disclosure & XSS

@lex Guestbook 4.0.1 -------------------- Vendor site: http://www.alexphpteam.com/ Product: @lex Guestbook 4.0.1 Vulnerability: Full Path Disclosure & XSS Credits: MrKaLiMaN Reported to Vendor: 24.11.06 Public disclosure: 30.11.06 Description: ------------ Full Path Disclosure:...

Power Phlogger 2.0.9 Remote|Local File Include Vulnerability

Power Phlogger 2.0.9 - Class: Remote|Local File Include Vulnerability Remote: Yes Local: No Type: High Site: http://www.comscripts.com/scripts/php.power-phlogger.211.html Author: xw0x Contact: [email protected] Vuln Code config.inc.php3: ?php include $relpath."functions.php3";//nothing here ?...

[ERPSCAN-15-025] Oracle E-Business Suite Database user enumeration Vulnerability

ADVISORY INFORMATION Title: Oracle E-Business Suite - Database user enumeration Advisory ID: ERPSCAN-15-025 Advisory URL: http://erpscan.com/advisories/erpscan-15-025-oracle-e-business-suite-database-user-enumeration-vulnerability/ Date published:20.10.2015 Vendors contacted: Oracle 2...

Microsoft Security Bulletin MS09-001 - Critical Vulnerabilities in SMB Could Allow Remote Code Execution (958687)

Microsoft Security Bulletin MS09-001 - Critical Vulnerabilities in SMB Could Allow Remote Code Execution 958687 Published: January 13, 2009 Version: 1.0 General Information Executive Summary This security update resolves several privately reported vulnerabilities in Microsoft Server Message Block...

Remote File Include In Script copyright (c) James Coyle; JCcorp

By Hasadya Raed Contact : [email protected] ------------------------------------ Script : copyright c James Coyle; JCcorp Expl : Remote Include File Dork : "copyright © James Coyle; JCcorp" ------------------------------------ B.File : createurl.php ------------------------------------ Exploit :...

Microsoft ActiveSync clear text password

Microsoft ActiveSync clear text password Microsoft ActiveSync is widely used to synchronies Windows based PDAs and smartphones with desktop computer. PDA can connect to PC via COM/USB/IR or LAN. Before synchronization user on PC must setup "partnership" to allow synchronization. If PDA is protect...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

NSOADV-2011-001: Symantec LiveUpdate Administrator CSRF vulnerability

NSOADV-2011-001: Symantec LiveUpdate Administrator CSRF vulnerability 111101111 11111 00110 00110001111 111111 01 01 1 11111011111111 11111 0 11 01 0 11 1 1 111011001 11111111101 1 11 0110111 1 1111101111 1001 0 1 10 11 0 10 11 1111111 1 111 111001 111111111 0 10 1111 0 11 11 111111111 1 1101 10...

PhotoPost =>4.6 (PP_PATH) Remote File Inclusion Exploit

==================================================================== PhotoPost =4.6 PPPATH Remote File Inclusion Exploit ==================================================================== Critical Level : Dangerous By Saudi Hackrz http://www.popphoto.com/...

Microsoft WebDAV XML DoS

Large number of attributes in requests causes resource exhaustion...

EMC Documentum multiple security vulnerabilities

Code injection, privilege escalation...

RUCKUS ADVISORY ID 041414: OpenSSL 1.0.1 library's "Heart bleed" vulnerability - CVE-2014-0160

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 RUCKUS ADVISORY ID 041414 Customer release date: April 14, 2014 Public release date: April 14, 2014 TITLE OpenSSL 1.0.1 library's "Heart bleed" vulnerability - CVE-2014-0160 SUMMARY OpenSSL library is used in Ruckus products to implement various...

Microsoft Windows multiple security vulnerabilities

Memory corruption in graphics library, signature check bypass, use-after-free in scripting, multiple privilege escalations...

CVE-2013-4152 XML External Entity (XXE) injection in Spring Framework

Severity: Important Vendor: Spring by Pivotal Versions Affected: - 3.0.0 to 3.2.3 Spring OXM & Spring MVC - 4.0.0.M1 Spring OXM - 4.0.0.M1-4.0.0.M2 Spring MVC - Earlier unsupported versions may also be affected Description: The Spring OXM wrapper did not expose any property for disabling entity...

DUC NO-IP weak encryption

Password is stored in world-readable registry entry in reversable encryption form...

MWChat pro V 7.0 <= (CONFIG[MWCHAT_Libs]) Remote File Include Vulnerability

MWChat pro V 7.0 Class = Remote File Inclusion URL : http://www.appindex.net/products/download/?product=mwchat&version=7.0 Found by = Mr.3FReeT .. code in :. about.php , buddy.php , chat.php , dialog.php , head.php , help.php , index.php , license.php ..... nearly all :D...

Microsoft Security Bulletin MS09-063 - Critical Vulnerability in Web Services on Devices API Could Allow Remote Code Execution (973565)

Microsoft Security Bulletin MS09-063 - Critical Vulnerability in Web Services on Devices API Could Allow Remote Code Execution 973565 Published: November 10, 2009 Version: 1.0 General Information Executive Summary This security update resolves a privately reported vulnerability in the Web Service...

Microsoft Security Bulletin MS09-050 - Critical Vulnerabilities in SMBv2 Could Allow Remote Code Execution (975517)

Microsoft Security Bulletin MS09-050 - Critical Vulnerabilities in SMBv2 Could Allow Remote Code Execution 975517 Published: October 13, 2009 Version: 1.0 General Information Executive Summary This security update resolves one publicly disclosed and two privately reported vulnerabilities in Serve...

Ako Comments (mod) Remote File Inclusion

Aria-Security.net Advisory Discovered by: O.U.T.L.A.W www.Aria-security.net Gr33t to: A.U.R.A & Hessam-X & Cl0wn & DrtRp Software: Ako Comments mod Attack method: Remote File Inclusion Source: Description: This module shows users' comments from component AkoComments. File Version: 1.1 for Mambo 4...

Mambo Gallery Manager v095.r3 Remote File Inclusion Vulnerabilities

---------------------------------------------------- Mambo Gallery Manager v095.r3 Remote File Inclusion Vulnerabilities ---------------------------------------------------- Discovered By A-S-T TEAM WE ARE CrAsHoVeRrIdE & BLACK-CODE & MR-HCR ---------------------------------------------------- si...

singapore v0.9.7 XSS Vulnerabilities

SOFTWARE: ========= singapore v0.9.7 DESCRIPTION: ============ The system is vulnerable to various XSS attacks google dork : "Powered by singapore v0.9.7" inurl:index.php?gallery 429 results : xss code example ================ www.site.com/images/index.php?gallery=gallery...

Mozilla Firefox / Thunderbird / Seamonkey multiple security vulnerabilities

Memory corruptions, local files access...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

[security bulletin] HPSBHF03119 rev.2 - HP DreamColor Professional Display running Bash Shell, Remote Code Execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04468293 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04468293 Version: 2 HPSBHF03119 rev....

[Full-disclosure] [SVRT-05-08] Critical BoF vulnerability found in ffdshow affecting all internet browsers (SVRT-Bkis)

General Information ffdshow is a DirectShow filter and VFW codec for many audio and video formats, such as DivX, Xvid and H.264. It is the most popular audio and video decoder on Windows. Besides a stand-alone setup package, ffdshow is often included in almost all codec pack software such as...

RE: ScanAlert Security Advisory

HackerSafe Labs - Security Advisory http://www.hackersafelabs.com SWsoft Plesk for Windows - SQL Injection Vulnerability Date: 9-11-07 Vendor: www.swsoft.com Package: Plesk for Windows Versions: v7.6.1, v8.1.0, v8.1.1, v8.2.0 Vendor Demo: https://plesk8.1win.demo.swsoft.com:8443/login.php3 Credit...

Winamp M3U playlist parser buffer overflow security vulnerability

LEGAL NOTICE: By reading this you do agree that life does not make sense and it doesn't need to. You also agree to wear a condom. You do agree to think about nature. .. umm you also agree to GPL all software you've ever written. Click here if you're under 18 There is a buffer overflow security...

[security bulletin] HPSBST03004 rev.1 - HP IBRIX X9320 Storage running OpenSSL, Remote Disclosure of Information

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04264595 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04264595 Version: 1 HPSBST03004 rev....

n.runs-SA-2010.002 - Alcatel-Lucent - arbitrary code execution on OmniVista 4760

n.runs AG http://www.nruns.com/ securityatnruns.com n.runs-SA-2010.002 20-September-2010 Vendor: Alcatel Affected Products: OmniVista 4760 server: all versions prior to release R5.1.06.03.cPatch3. Vulnerability: arbitrary code execution Risk: High CVE-Number: CVE-2010-3281 Vendor communication:...

Code Execution via XSS in Internet Explorer

Hello 3APA3A! Recently I wrote about Code Execution via XSS attack http://websecurity.com.ua/2635/. In this article I told about Code Execution attack via Cross-Site Scripting vulnerability in Internet Explorer http://websecurity.com.ua/1241/, which I disclosed in August 2007. Last year and this...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

[security bulletin] HPSBMU03032 rev.1 - HP Virtual Connect Firmware Smart Components Installer Software running OpenSSL, Remote Disclosure of Information

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04272594 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04272594 Version: 1 HPSBMU03032 rev....

[MajorSecurity #26] Woltlab Burning Board - Multiple Cookie manipulation and session fixation vulnerabilities

MajorSecurity 26 Woltlab Burning Board - Multiple Cookie manipulation and session fixation vulnerabilities ---------------------------------------------------------------------------------------- Software: Woltlab Burning board Impact: Cookie manipulation and Session Fixation Made public: July,...

phpHoo3 (admin.php) Remote Login Bypass SQL Injection Vulnerability

phpHoo3 Login SQL injection // AYYILDIZ.ORG Gururla Sunar... download:http://cable-modems.org/phpHoo/files/phphoo3.zip author : iLker Kandemir ilkerkandemir at mynet.com Risk : High Class : Remote Vuln. Script : phpHoo3 tnx : h0tturk,ekin0x,Gencnesil,Gencturk,koray,Ajann .. Vulnerable; ///admin.p...

PostGuestbook 0.6.1(tpl_pgb_moddir)Remote File Include Expliot

PostGuestbook 0.6.1tplpgbmoddirRemote File Include Expliot D.Script: http://sourceforge.net/projects/postguestbook/ Dork: "Powered by: PostGuestbook 0.6.1" Discovered by GloDM = Mahmoodali Homepage: http://www.Tryag.cc Greetz To Tryag-Team & 4lKaSrGoLd3n-Team & AsbMay's Group V.Code include...

MODx CMS 0.9.2.1 (base_path) Remote File Include Vulnerability

+------------------------------------------------------------------------------------------- + MODx CMS 0.9.2.1 basepath Remote File Include Vulnerability +------------------------------------------------------------------------------------------- + Affected Software .: MODx CMS 0.9.2.1 + Vendor...

SECURITY.NNOV: Special device access in The Bat!

Dear bugtraq, Topic: Special device access in The Bat! Author: 3APA3A [email protected] Date: February, 25 2002 Software: The Bat! 1.53d, 1.54beta Vendor: Ritlabs http://www.thebat.net Risk: Low to average Remote: Yes Exploitable: Yes Vendor Status: Notified, not verified Details: The Bat!...

FreeBSD Ports Security Advisory FreeBSD-SA-01:27.cfengine

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:27 Security Advisory FreeBSD, Inc. Topic: cfengine port contains remote root vulnerability Category: ports Module: cfengine Announced: 2001-03-12 Credits: Pekka Savola...

AST-2007-026 - SQL Injection issue in cdr_pgsql

Asterisk Project Security Advisory - AST-2007-026 +------------------------------------------------------------------------+ | Product | Asterisk | |----------------------+-------------------------------------------------| | Summary | SQL Injection issue in cdrpgsql |...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...