47153 matches found
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
Chrome for Android - UXSS via com.android.browser.application_id Intent extra
CVE Number: CVE-2012-4905 Title: Chrome for Android - UXSS via com.android.browser.applicationid Intent extra Affected Software: Confirmed on Chrome for Android v18.0.1025123 Credit: Takeshi Terada Issue Status: v18.0.1025308 was released which fixes this vulnerability Overview: By sending a...
Exploit - EasyITSP by Lemens Telephone Systems 2.0.2
?php errorreporting0; $arguments = getopt"a:b:c:"; $url = $arguments'a'; $idpod =$arguments'b'; $idend =$arguments'c'; ifcount$arguments!=3 echo ' Exploit - EasyITSP by Lemens Telephone Systems 2.0.2 '."n"; echo ' Discovery users with passwords '."n"; echo ' '."n"; echo ' Author: Michal Blaszczak...
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
Security Advisory in LedgerSMBv 1.3.20 and below: Denial of Service vulnerability
A security oversight has been discovered in LedgerSMB 1.3 which could allow a malicious user to cause a denial of service against LedgerSMB or otherwise affect the way in which certain forms of data would get entered. In most cases we do not believe this to be particularly severe in the absence o...
[SECURITY] [DSA 2368-1] lighttpd security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------------- Debian Security Advisory DSA-2368-1 [email protected] http://www.debian.org/security/ Nico Golde Dec 20th, 2011 http://www.debian.org/security/faq -...
ZDI-11-306 : Oracle Java IIOP Deserialization Type Confusion Remote Code Execution Vulnerability
ZDI-11-306 : Oracle Java IIOP Deserialization Type Confusion Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-306 October 26, 2011 -- CVE ID: CVE-2011-3521 -- CVSS: 9, AV:N/AC:L/Au:N/C:P/I:P/A:C -- Affected Vendors: Oracle -- Affected Products: Oracle Java...
bizConsulting (prodotto.php?id) Remote SQL injection Vulnerability
IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability bizConsulting prodotto.php?id AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.bizconsulting.it/ Persian Gulf 4 Ever! Dork : "Powered by: bizConsulting"...
Oracle / Sun / Peoplesoft applications multiple security vulnerabilities
Quarterly critical patch update closes 78 different vulnerabilities in all major applications...
HTB22819: XSS vulnerability in WebAsyst Shop-Script
Vulnerability ID: HTB22819 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinwebasystshopscript1.html Product: WebAsyst Shop-Script Vendor: WebAsyst, LLC http://www.shop-script.ru/ Vulnerable Version: Current version 2011.01.23 shop-script.ru/demo/ Vendor Notification: 25 January 2011...
Majordomo2 - Directory Traversal (SMTP/HTTP)
Original Advisory: https://sitewat.ch/en/Advisory/View/1 Credit: Michael Brooks https://sitewat.ch Vulnerability: Directory Traversal Software: Majordomo2 Identifier:CVE-2011-0049 Vendor: http://www.mj2.org/ Affected Build: 20110121 and prior Special thanks to Dave Miller, Reed Loden and the rest...
Symantec Antivirus Corporate Edition Alert Management Service code execution
It's possible to execute commands without authentication via TCP/38292 service...
About the security content of Safari 5.0.3 and Safari 4.1.3
About the security content of Safari 5.0.3 and Safari 4.1.3 Last Modified: November 18, 2010 Article: HT4455 Email this article Print this page Summary This document describes the security content of Safari 5.0.3 and Safari 4.1.3. For the protection of our customers, Apple does not disclose,...
BBcode XSS in eoCMS
Vulnerability ID: HTB22677 Reference: http://www.htbridge.ch/advisory/bbcodexssineocms.html Product: eoCMS Vendor: eocms.com http://eocms.com Vulnerable Version: 0.9.04 Vendor Notification: 21 October 2010 Vulnerability Type: XSS Cross Site Scripting Status: Not Fixed, Vendor Alerted, Awaiting...
Hewlett Packard applications multiple security vulnerabilities
20 vulnerabilities in different applications are fixed...
[SECURITY] CVE-2009-2901 Apache Tomcat insecure partial deploy after failed undeploy
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2009-2901: Apache Tomcat insecure partial deploy after failed undeploy Severity: Low Vendor: The Apache Software Foundation Versions Affected: Tomcat 5.5.0 to 5.5.28 Tomcat 6.0.0 to 6.0.20 The unsupported Tomcat 3.x, 4.x and 5.0.x versions may be...
[security bulletin] HPSBMI02473 SSRT080138 rev.1 - Cisco Catalyst Blade Switch 3020/3120, Remote Denial of Service (DoS)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c01923093 Version: 1 HPSBMI02473 SSRT080138 rev.1 - Cisco Catalyst Blade Switch 3020/3120, Remote Denial of Service DoS NOTICE: The information in this Security Bulletin should be acted upon as so...
ZDI-09-080: Sun Java Runtime Environment JPEGImageReader Heap Overflow Vulnerability
ZDI-09-080: Sun Java Runtime Environment JPEGImageReader Heap Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-080 November 4, 2009 -- Affected Vendors: Sun Microsystems -- Affected Products: Sun Microsystems Java Runtime -- TippingPointTM IPS Customer Protection:...
Oracle 11g (11.1.0.6) Password Policy and Compliance
Many security standards require the tracking of users' password history to prevent password re-use. In Oracle 11g 11.1.0.6, if a security administrator has enabled 11g passwords exclusively then tracking password history is broken. This can affect compliance. This was addressed by Oracle in their...
Netgear DG632 Router Remote DoS Vulnerability
Product Name: Netgear DG632 Router Vendor: http://www.netgear.com Date: 15 June, 2009 Author: [email protected] [email protected] Original URL: http://www.tomneaves.co.uk/NetgearDG632RemoteDoS.txt Discovered: 18 November, 2006 Disclosed: 15 June, 2009 I. DESCRIPTION The Netgear DG632 router h...
DevIL library buffer overflow
Buffer overflow in iGetHdrHeader function on Radiance RGBE files processing...
Mozilla Foundation Security Advisory 2008-35
Mozilla Foundation Security Advisory 2008-35 Title: Command-line URLs launch multiple tabs when Firefox not running Impact: Critical Announced: July 15, 2008 Reporter: Billy Rios, Ben Turner, Dan Veditz Products: Firefox Fixed in: Firefox 3.0.1 Firefox 2.0.0.16 Description Security researcher Bil...
RSS-aggregator (display) Remote File Inclusion Vulnerability
RSS-aggregator display Remote File Inclusion Vulnerability Found : Ghost Hacker R-H TeaM HOME : www.Real-Hack.net Email : [email protected] Script : RSS-aggregator Download Script : http://www.rss-aggregator.com/download.php =========================== Viva IslaM ==========================...
[SECURITY] [DSA 1575-1] New Linux 2.6.18 packages fix denial of service
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ---------------------------------------------------------------------- Debian Security Advisory DSA-1575-1 [email protected] http://www.debian.org/security/ dann frazier May 12, 2008 http://www.debian.org/security/faq -...
aeries browser interface(ABI) 3.8.3.14 Remote SQL Injection
Discovered By : Arsalan Emamjomehkashan aeries browser interfaceABI 3.8.3.14 Remote SQL Injection Website:http://aeries.com/ SQL injection: GradebookOptions.asp?GrdBk=SQL loginproc.asp If you post variable "SchlCode" XSS: UserName variable on loginproc.asp and usr on Login.asp...
[waraxe-2007-SA#059] - XSS in WordPress 2.3
waraxe-2007-SA059 - XSS in WordPress 2.3 ==================================================================== Author: Janek Vind "waraxe" Date: 27. October 2007 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-59.html Target software description: WordPress is a state-of-the-art semanti...
[Full-disclosure] Fujitsu-Siemens PRIMERGY BX300 Switch Blade Information Disclosure
Advisory: Fujitsu-Siemens PRIMERGY BX300 Switch Blade Information Disclosure RedTeam Pentesting discovered an information disclosure in the Fujitsu- Siemens BX300 Switch Blade during a penetration test. By accessing URLs of the web interface directly and aborting the authentication dialog, one is...
[Full-disclosure] [ MDKSA-2007:122 ] - Updated gd packages fix vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDKSA-2007:122 http://www.mandriva.com/security/ Package : gd Date : June 13, 2007 Affected: 2007.0, 2007.1, Corporate 3.0, Corporate 4.0 Problem Description: A flaw in libgd2 was found by Xavier Roche where it would n...
webMethods Glue Management Console Directory Traversal
aushack.com - Vulnerability Advisory ----------------------------------------------- Release Date: 11-Apr-2007 Software: webMethods - webMethods Glue Management Console http://www.webmethods.com/ "With webMethods Glue developers can easily create SOAP interfaces for their existing Java and C/C++...
sitex multiple vulnerabilities
global risk:critical upload vulnerability: in user profile upload an avatar with a double extension like : file.php.jpg once it's done,you gone get an error like:Fatal error: Call to undefined function imagedestroy in /. but the last extension jpg will be removed by the script, and stored in :...
JBoss insecure defaults
Web console and management instruments are available without authentication...
[x0n3-h4ck] Siteman 2.0.x2 Remote Md5 Hash Disclosure Vulnerability
-=--------------------ADVISORY-------------------=- Siteman 2.0.x2 Author: CorryL [email protected] -=-----------------------------------------------=- -=+ Application: Siteman 2.0.x2 -=+ Version: 2.0.x2 -=+ Vendor's URL: http://home.no.net/siteman/ -=+ Platform: WindowsLinuxUnix -=+ Bug type:...
Mozilla Foundation Security Advisory 2006-72
Mozilla Foundation Security Advisory 2006-72 Title: XSS by setting img.src to javascript: URI Impact: High Announced: December 19, 2006 Reporter: mozbugra4 Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 2.0.0.1 Firefox 1.5.0.9 Thunderbird 1.5.0.9 SeaMonkey 1.0.7 Description mozbugra4...
A-Blog v2.0 Remote File Include
============================================================================================== A-Blog v2.0 Remote File Include =============================================================================================== Critical Level : Dangerous A-Blog...
SolpotCrew Advisory #10 - phpBB XS (phpbb_root_path) Remote File Include
SolpotCrew Community phpBB XS phpbbrootpath Remote File Include Download file : http://www.phpbbxs.eu/dload.php?action=category&catid=2 Bug Found By : NoGe a.k.a dajackass contact: [email protected] Website : http://nyubicrew.org/adv/Nogeadv02.txt Greetz: skulmaticthanks for sharing knowledge...
PHP ip2long() function circumvention
--- PHP ip2long function circumvention -------------------------------------- tested on php 5.0.2 " 4.3.3 -------------------------------------------------------------------------------- after some test on miniBB application http://www.minibb.net/ I obtained that the php ip2long function can be...
D-Link Router UPNP Stack Overflow
D-Link Router UPNP Stack Overflow Release Date: July 13, 2006 Date Reported: February 27, 2006 Patch Development Time In Days: 136 Severity: High Remote Code Execution Vendor: D-Link Routers Affected: DI-524 Rev A DI-524 Rev C DI-524 Rev D DI-604 Rev E DI-624 Rev C DI-624 Rev D DI-784 Rev A...
[eVuln] PHP SimpleNEWS, PHP SimpleNEWS MySQL - Authentication Bypass Vulnerability
New eVuln Advisory: PHP SimpleNEWS, PHP SimpleNEWS MySQL - Authentication Bypass Vulnerability http://evuln.com/vulns/94/summary.html --------------------Summary---------------- eVuln ID: EV0094 Vendor: Himpfen Consulting Company Vendor's Web Site: http://www.himpfenconsulting.com/ Software: PHP...
PHP5 Globals Vulnerability: with ?GLOBALS[foobar] you can set the value of the un-initialized $foobar variable.
PHP5 Globals Vulnerability: with ?GLOBALSfoobar you can set the value of the un-initialized $foobar variable. PHP5 Globals Vulnerability Name PHP5 Globals Vulnerability Systems Affected PHP5 verified on 5.1.1 and 5.1.2 Severity Critical Vendor www.php.net Advisory...
US-CERT Technical Cyber Security Alert TA05-136A -- Apple Mac OS X is affected by multiple vulnerabilities
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Technical Cyber Security Alert TA05-136A Apple Mac OS X is affected by multiple vulnerabilities Original release date: May 16, 2005 Last revised: -- Source: US-CERT Systems Affected Mac OS X version 10.3.9 Panther and Mac OS X Server version 10.3.9...
SurfControl Web Filter directory traversal
Directory traversal in web interface TCP/8888...
@stake Advisory: NTLM Replaying via Windows 2000 Telnet Client (A 091400-1)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I wish this could have gone out sooner but there was an issue with the initial Microsoft patch which we found during our testing. They subsequently decided to fix the patch which delayed things a bit. We feel that if a vendor is taking an issue...
Remote DoS Attack in Small HTTP Server ver. 1.212 Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Remote DoS Attack in Small HTTP Server ver. 1.212 Vulnerability USSR Advisory Code: USSR-2000047 Release Date: June 16, 2000 Systems Affected: Small HTTP Server ver. 1.212 maybe others THE PROBLEM The Ussr Labs team has recently discovered a buffer...
APPLE-SA-2015-09-30-2 Safari 9
APPLE-SA-2015-09-30-2 Safari 9 Safari 9 is now available and addresses the following: Safari Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5 and OS X El Capitan v10.11 Impact: Visiting a malicious website may lead to user interface spoofing Description: Multiple user interface...
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
[CVE-2014-5361][CVE-2014-5362]Landesk Management Suite RFI & CSRF Security Vulnerabilities
Exploit Title: Landesk Management Suite RFI and CSRF vulnerabilities Product: Landesk Management Suite Vulnerable Versions: 9.5 and possible previous versions, 9.6 Tested Version: 9.5 Advisory Publication: 16/04/2015 Latest Update: 16/04/2015 Vulnerability Type: Cross-site request forgery CWE-352...
[ MDVSA-2015:228 ] nodejs
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:228 http://www.mandriva.com/en/support/security/ Package : nodejs Date : May 6, 2015 Affected: Business Server 2.0 Problem Description: Updated nodejs package fixes security vulnerability: It was found that...
IL and CSRF vulnerabilities in D-Link DAP-1360
Hello 3APA3A! There are Information Leakage and Cross-Site Request Forgery vulnerabilities in D-Link DAP-1360 Wi-Fi Access Point and Router. ------------------------- Affected products: ------------------------- Vulnerable is the next model: D-Link DAP-1360, Firmware 1.0.0. This model with other...
ESA-2014-055: EMC Network Configuration Manager (NCM) Report Advisor Session Fixation Vulnerability
ESA-2014-055.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-055: EMC Network Configuration Manager NCM Report Advisor Session Fixation Vulnerability EMC Identifier: ESA-2014-055 CVE Identifier: CVE-2014-2509 Severity Rating: CVSS v2 Base Score: 6.9 AV:A/AC:M/Au:N/C:C/I:P/A:P Affected...