47153 matches found
Barracuda Message Archiver 650 - Persistent Web Vulnerability
Document Title: =============== Barracuda Message Archiver 650 - Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=751 Barracuda Networks Security ID BNSEC: 703 Release Date: ============= 2014-02-18 Vulnerability Laboratory ID...
HP Service Manager multiple security vulnerabilities
Cross-Site Scripting XSS, Cross-Site Request Forgery CSRF, Remote Denial of Service DoS, Execution of Arbitrary Code, Unauthorized Access, Disclosure of Information and Authentication Issues...
[SECURITY] [DSA 2849-1] curl security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2849-1 [email protected] http://www.debian.org/security/ Florian Weimer January 31, 2014 http://www.debian.org/security/faq -...
Critical vulnerabilities discovered in Gazelle and TBDEV.net
Hi guys, Gazelle and TBDEV.NET are the most popular web applications used as BitTorrent trackers. A BitTorrent tracker is an application that assists in the communication between peers using the BitTorrent protocol. BitTorrent trackers can be public/open where anybody can join or private where an...
[ MDVSA-2013:203 ] phpmyadmin
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:203 http://www.mandriva.com/en/support/security/ Package : phpmyadmin Date : July 30, 2013 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: Multiple vulnerabilities has been discover...
APPLE-SA-2013-04-16-2 Java for OS X 2013-003 and Mac OS X v10.6 Update 15
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2013-04-16-2 Java for OS X 2013-003 and Mac OS X v10.6 Update 15 Java for OS X 2013-003 and Mac OS X v10.6 Update 15 are now available and address the following: Java Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7 o...
[USN-1789-1] PostgreSQL vulnerabilities
========================================================================== Ubuntu Security Notice USN-1789-1 April 04, 2013 postgresql-8.3, postgresql-8.4, postgresql-9.1 vulnerabilities ========================================================================== A security issue affects these...
Cisco IOS multiple security vulnerabilities
Multiple DoS conditions in different protocols implementations...
NGS00162 Patch Notification: Symantec Message Filter Session Hijacking via session fixation
High Risk Vulnerability in Symantec Message Filter 2 July 2012 Ben Williams of NCC Group has discovered a High risk vulnerability in Symantec Message Filter Impact: Session Hijacking via session fixation Versions affected: Symantec Message Filter Version 6.3 An updated version of the software has...
b2ePMS 1.0 Authentication Bypass Vulnerability
b2ePMS 1.0 Authentication Bypass Vulnerability Discovered by: Jean Pascal Pereira [email protected] Vendor Information: "b2ePMS stands for Browser to Email Phone Message System. It is intended to replace the standard paper/carbon phone message slips commonly used in offices, with the capability o...
VMware High-Bandwidth Backdoor ROM Overwrite Privilege Elevation
VMware High-Bandwidth Backdoor ROM Overwrite Privilege Elevation Derek Soeder [email protected] Reported: December 5, 2011 Published: March 30, 2012 AFFECTED VENDOR --------------- VMware, Inc. AFFECTED ENVIRONMENTS --------------------- The following VMware product versions are known to be...
[SECURITY] [DSA 2368-1] lighttpd security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------------- Debian Security Advisory DSA-2368-1 [email protected] http://www.debian.org/security/ Nico Golde Dec 20th, 2011 http://www.debian.org/security/faq -...
PHP Booking Calendar 10e XSS
Exploit Title: PHP Booking Calendar 10e XSS Date: 12/16/11 Author: G13 Software Link: http://sourceforge.net/projects/bookingcalendar/ Version: 10e Category: webapps php Vulnerability The pageinfomessage varibale in the detailsview.php does not sanitize input. This is a relective XSS attack...
Microsoft IIS 6 parsing directory “x.asp” Vulnerability
Microsoft IIS 6 parsing directory Vulnerability Discovered by: Pouya daneshmand whhiranATyahooDOTcom http://securitylab.ir/blog Introduction: Using this vulnerability you can bypass some Security filters, for example a file with “.jpg” or “.rar” extension can be executed as an asp Active Server...
XSRF (CSRF) in Wolf CMS
Vulnerability ID: HTB22681 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinwolfcms.html Product: Wolf CMS Vendor: Wolf CMS team http://www.wolfcms.org/ Vulnerable Version: 0.6.0b and probably prior versions Vendor Notification: 09 November 2010 Vulnerability Type: CSRF Cross-Site Request...
[FLOCK-SA-2010-03] Flock Browser: javascript: url with a leading NULL byte can bypass cross origin protection (XSS)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 FLOCK-SA-2010-03 http://flock.com/security/ Title: javascript: url with a leading NULL byte can bypass cross origin protection XSS Impact: High Announced on: 2010-09-09 Affected Products: Flock 3 versions prior to 3.0.0.4112 CVEs cve.mitre.org:...
About the security content of iTunes 9.1
About the security content of iTunes 9.1 Last Modified: August 12, 2010 Article: HT4105 Email this article Print this page Summary This document describes the security content of iTunes 9.1. For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a...
[ MDVSA-2010:115 ] perl
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2010:115 http://www.mandriva.com/security/ Package : perl Date : June 11, 2010 Affected: 2009.0, 2009.1, Corporate 4.0, Enterprise Server 5.0, Multi Network Firewall 2.0 Problem Description: Multiple...
[DSecRG-09-053] VMware Remoute Console - format string
Digital Security Research Group DSecRG Advisory DSECRG-09-053 Application: VMware Remoute Console Version: e.x.p build-158248 Vendor URL: http://vmware.com Bugs: Format String Vulnerabilitys Exploits: YES PoC Reported: 07.08.2009 Vendor response: 13.08.2009 Date of Public Advisory: 09.04.2010 CVE...
MKPortal modules metric XSS Vulnerability
========================================= MKPortal modules metric XSS Vulnerability ========================================= 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' /' / /' 0 0 /, // ,/ / 1 1 // /' / // /' / /' 0 0 / / / / / / 1 1 / / 0 0 ////// // // //...
[CORE-2010-0106] Cisco Secure Desktop XSS/JavaScript Injection
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ Cisco Secure Desktop XSS/JavaScript Injection 1. Advisory Information Title: Cisco Secure Desktop XSS/JavaScript Injection Advisory Id: CORE-2010-0106 Advisory URL:...
ZDI-09-095: Hewlett-Packard OpenView NNM Snmp.exe Oid Variable Buffer Overflow Vulnerability
ZDI-09-095: Hewlett-Packard OpenView NNM Snmp.exe Oid Variable Buffer Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-095 December 9, 2009 -- CVE ID: CVE-2009-3849 -- Affected Vendors: Hewlett-Packard -- Affected Products: Hewlett-Packard OpenView Network Node Manager --...
Oracle 11g (11.1.0.6) Password Policy and Compliance
Many security standards require the tracking of users' password history to prevent password re-use. In Oracle 11g 11.1.0.6, if a security administrator has enabled 11g passwords exclusively then tracking password history is broken. This can affect compliance. This was addressed by Oracle in their...
URL spoofing bug involving Firefox's error pages and document.write
Application: Firefox 3.0.11 OS: Windows XP - SP3 ------------------------------------------------------ 1 - Description 2 - Vulnerability 3 - POC/EXPLOIT ------------------------------------------------------ Description This software is a popular web browser that supports multiple platforms as...
Netgear DG632 Router Remote DoS Vulnerability
Product Name: Netgear DG632 Router Vendor: http://www.netgear.com Date: 15 June, 2009 Author: [email protected] [email protected] Original URL: http://www.tomneaves.co.uk/NetgearDG632RemoteDoS.txt Discovered: 18 November, 2006 Disclosed: 15 June, 2009 I. DESCRIPTION The Netgear DG632 router h...
[SECURITY] CVE-2009-0783 Apache Tomcat Information disclosure
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2009-0783: Apache Tomcat information disclosure vulnerability Severity: low Vendor: The Apache Software Foundation Versions Affected: Tomcat 6.0.0 to 6.0.18 Tomcat 5.5.0 to 5.5.27 Tomcat 4.1.0 to 4.1.39 The unsupported Tomcat 3.x, 4.0.x and 5.0.x...
Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. PHPSlideshow: crossite scripting. Athree CMS: information leak, SQL injection, DoS...
LFI in Drupal CMS
Author : Rasool Nasr ------------------------------------------- Discovered by : Rasool Nasr ------------------------------------------- Exploited By : Rasool Nasr ------------------------------------------- E-Mail : [email protected] ------------------------------------------- WebSite :...
FreeBSD Security Advisory FreeBSD-SA-08:12.ftpd
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-08:12.ftpd Security Advisory The FreeBSD Project Topic: Cross-site request forgery in ftpd8 Category: core Module: ftpd Announced: 2008-12-23 Credits: Maksymilian...
multiple vendor ftpd - Cross-site request forgery
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 multiple vendor ftpd - Cross-site request forgery Author: Maksymilian Arciemowicz securityreason.com Date: - - Written: 03.09.2008 - - Public: 26.09.2008 SecurityReason Research SecurityAlert Id: 56 CVE: not assigned SecurityRisk: Low Affected Softwar...
Mozilla Foundation Security Advisory 2008-35
Mozilla Foundation Security Advisory 2008-35 Title: Command-line URLs launch multiple tabs when Firefox not running Impact: Critical Announced: July 15, 2008 Reporter: Billy Rios, Ben Turner, Dan Veditz Products: Firefox Fixed in: Firefox 3.0.1 Firefox 2.0.0.16 Description Security researcher Bil...
Aria-Security.net: NetAuctionHelp SQL Injection
Aria-Security Net Original Advisory @ http://aria-security.net/forum/showthread.php?p=1099 ------------------------ Vendor: http://www.netauctionhelp.com PoC: search.asp?sort=ni&category=&categoryname=&kwsearch=&nsearch=SQL INJECTION...
Directory traversal and absolute path in multiple archivers
Directory traversal and absolute path allow to overwrite any file during archive extraction...
[Full-disclosure] ActiveWeb Contentserver CMS SQL Injection Management Interface
Advisory: ActiveWeb Contentserver CMS SQL Injection Management Interface RedTeam Pentesting discovered an SQL Injection in the picturerealedit.asp script of the activeWeb contentserver CMS during a penetration test. An editor with the permission to edit pictures can exploit this by injecting...
openMairie 1.11(/scr/soustab.php)Local File Inclusion Vulnerabilitiy
openMairie 1.11/scr/soustab.phpLocal File Inclusion Vulnerabilitiy D.Script: http://adullact.net/frs/download.php/1302/openmairieexemple1.11.zip Discovered by: GolDM = Mahmoodali Homepage: http://Www.Tryag.Com/cc Exploit:Path/scr/soustab.php?dsnphptype= Local File 00 Greetz To: Tryag.Com/cc &...
Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
Multiple XSS in IronMail
=============================== - Advisory - =============================== Tнtulo: Multipls XSS in Cypherstrust Ironmail 6.1.1 Risk: Medium Date: 20.Feb.2007 Author: Javier Olascoaga jolascoaga at 514.es WEB: http://www.514.es/ .: INTRO :. IronMail protects enterprise email systems from inbound...
FlashGameScript v1.5.4 Remote File Inclusion Vulnerability
-------------------------------------------------------- Author : JuMp-Er Date : feb, 21th 2007 Level : Dangerous contact: : aH-crewathotmaildotcom -------------------------------------------------------- Software description -------------------------------------------------------- App...
Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
Selenium FTP Server / Conxint FTP directory traversal
Directory traversal in different FTP commands...
[Full-disclosure] [x0n3-h4ck.org] Bug on Drake CMS v0.2
-=--------------------ADVISORY-------------------=- Drake CMS V. 0.2 Author: CorryL x0n3-h4ck.org -=----------------------------------------------------=- -=+ Application: Drake CMS -=+ Version: 0.2 -=+ Vendor's URL: https://sourceforge.net/projects/drakecms/ -=+ Platform: WindowsLinuxUnix -=+ Bu...
[Full-disclosure] Cross Site Scripting (XSS) Vulnerability in Netquery by "VIRtech"
·= Security Advisory =· Issue: Cross Site Scripting XSS Vulnerability in Netquery by "VIRtech" Discovered Date: 04/10/2006 Author: Tal Argoni, LegendaryZion. talargoni at gmail.com Product Vendor: http://www.virtech.org Details: VIRtechs Netquery system is prone to a Cross Site Scripting...
AlberT-EasySite <= 1.0.a5 Remote File Inclusion
AlberT-EasySite = 1.0.a5 Remote File Inclusion Download Source : http://www.superalbert.it/download/AlberT-EasySite/AES1.0a5.tar.gz Found By : k1tk4t - k1tk4t4tnewhack.org Location : Indonesia -- newhackdotorg file ; logout.php bugs ; requireonce $PSAPATH.'/include/config.php'; exmple and methode...
VAMP Webmail <= 2.0beta1 (yesno.phtml) Remote Include Vulnerability
ToXiC VAMP Webmail Remote File Inclusion by ToXiC CreW BuG FounD by Drago84 Application Affect:VAMP Webmail Page: yesno.phtml Dir : /setup/ Problem: ?if$answer=="Yes" include $yesurl; else include $nourl; ? ExPloit :...
OpenSSH 4.4 is available
OpenSSH 4.4 has just been released. It will be available from the mirrors listed at http://www.openssh.com/ shortly. OpenSSH is a 100 complete SSH protocol version 1.3, 1.5 and 2.0 implementation and includes sftp client and server support. Once again, we would like to thank the OpenSSH community...
BluePay Manager v2.0 Script Insertion Vulnerability
BluePay Manager v2.0 Script Insertion Vulnerability Vuln. discovered by : r0t Date: 18 april 2006 vendor:bluepay.com affected versions:v2.0 and previous orginal advisory: http://pridels.blogspot.com/2006/04/bluepay-manager-v20-script-insertion.html Vuln. description: Input passed to the "Account...
Easy File Sharing Web Server Multiple Vulnerablilities
Easy File Sharing Web Server Multiple Vulnerablilities Software: Easy File Sharing Web Server Version: 3.2 Website: http://www.sharing-file.com/ Description: Easy File Sharing Web Server is a Windows program that allows you to host a secure peer-to-peer and web-based file sharing system without a...
Microsoft Security Bulletin MS04-038 Cumulative Security Update for Internet Explorer (834707)
Microsoft Security Bulletin MS04-038 Cumulative Security Update for Internet Explorer 834707 Issued: October 12, 2004 Version: 1.0 Summary Who should read this document: Customers who use Microsoft Windows Impact of Vulnerability: Remote Code Execution Maximum Severity Rating: Critical...
Advisory: Lawson Financials RDBMS Insecurity
+-----------------------------------------------------------------------+ | Advisory: lawson001 | | Authors: John Eisenschmidt [email protected] | | George Lewis [email protected] | | Release Date: December 02, 2002 | | Vendor: Lawson | | Application: Financials possibly others | | Affected...