SEC Consult SA-20070314-0 :: Apache HTTP Server / Tomcat directory traversal

SEC Consult Security Advisory 20070314-0 ======================================================================= title: Apache HTTP Server / Tomcat directory traversal program: Apache HTTP Server / Apache Tomcat vulnerable version: Apache Tomcat 5.x: 5.5.22 Apache Tomcat 6.x: 6.0.10 CVE:...

Citrix Metaframe Presentation Server / Javvin DiskAccess printer provider buffer overflow

Buffer overflow in cpprov.dll EnumPrintersW and OpenPrinter functions...

Invision Community Blog Mod 1.2.4 .PHP SQL Injection Vulnerability

Open any blog entry 2. Try to reply to any message 3. Push "Preview message" button Do not post your reply 4. Save source code of opened page to your PC 5. Find this string input type='hidden' name='eid' value='BLOGENTRYID' / 6. Change BLOGENTRYID with this SQL Injection: BLOGENTRYID UNION...

yappa-ng <= v2.3.1 (admin_modules) Remote File Inclusion Exploit

============================================================================================== yappa-ng = v2.3.1 adminmodules Remote File Inclusion Exploit =============================================================================================== Critical Level : Dangerous Venedor site :...

[Full-disclosure] Latinchat Denial Of Service

Denial Of Service on Chat Magma Latinchat http://www.latinchat.com Researcher: Vicente Perez 1.-Overview Latinchat is one of the most known chat server, and used basically by latin american people. 2.-Description This system has a vulnerabily as DoS, taking system offline by a while. The fail...

VBZooM <=V1.11 "sub-join.php" SQL Injection

======================================= Discovered By: C.B.B.L CrAzY CrAcKeR,Breeeeh,BoNy-m,LiNuX rOOt ======================================= Search: POWERED BY VBZooM V1.11 Example:- /sub-join.php?UserID=SQL Injection...

tseekdir.cgi<--Local File Include

---------------------------------- foud by: BoNy-m Site: http://www.alshmokh.com E-mail: [email protected] ---------------------------------- Search: allinurl:tseekdir.cgi example: /tseekdir.cgi?location=/etc/passwd00 /tseekdir.cgi?id=1055&location=/etc/passwd00...

bsod in win32k.sys(Multi-User Win32 Driver)

Hello vuln, OS: Microsoft Windows XP, SP2, other not tested VULNERABILITY: file : win32k.sys version : 5.1.2600.2180 xpspsp2rtm.040803-2158 description : Multi-User Win32 Driver author : 6star aka mg BUG DESCRIPTION: When you try HOW TO CHECK: 1. Click on Desktop to call Context Menu. 2. Then...

Woltlab Burning Board SQL Injection Vulnerability

GulfTech Security Research May 16th, 2005 Vendor : Woltlab GmbH URL : http://www.woltlab.de/ Version : Burning Board 2. And Earlier Risk : SQL Injection Vulnerabilities Description: Burning Board is a popular, multi purpose forum / community software offered by WoltLab GmbH. There is an SQL...

[Full-disclosure] NIC Chile CGI Script Zone Transfers

NIC Chile CGI Script Zone Transfers. Autor: Rodrigo Gutierrez rodrigo at intellicomp.cl Affected: All ".cl" domains which use NIC's Chile Secondary NS. Vendor url: http://www.nic.cl Rate: Critical Background. NIC Chile is a part of the University of Chile and is in charge of handling all the...

Foxmail Server Remote Buffer Overflow Vulnerability

DATE: 02/04/2005 AUTHOR: Fortinet, inc xouyangxouyangatfortinet.com [email protected] PRODUCTS: Foxmail Server- A MAil server for both Windows and linux. AFFECTED VERSION: Foxmail server for windows version 2.0Newest.I just test windows server ,maybe linux version have vulnerability too...

phpMyChat 0.14.5

Informations : °°°°°°°°°°°° Language : PHP Bugged Version : phpMyChat ver. 0.14.5 and less ? Patched version : none Website : http://www.phpheaven.net/ Problems : Permanent XSS, authorization bypass, SQL-injection, include read files. Objects : °°°°°°° - lib/login.lib.php3 - admin/adminBody.php3...

Microsoft Security Bulletin MS03-043

Microsoft Security Bulletin MS03-043 Buffer Overrun in Messenger Service Could Allow Code Execution 828035 Issued: October 15, 2003 Version Number: 1.0 Summary Who Should Read This Document: Customers using Microsoft® Windows® Impact of Vulnerability: Remote Code Execution Maximum Severity Rating...

Microsoft Security Bulletin MS03-011:Flaw in Microsoft VM Could Enable System Compromise (816093)

-----BEGIN PGP SIGNED MESSAGE----- - ------------------------------------------------------------------- Title: Flaw in Microsoft VM Could Enable System Compromise 816093 Date: 09 April 2003 Software: Microsoft VM Impact: Allow attacker to execute code of his or her choice Max Risk: Critical...

WAnewsletter (PHP)

Informations : °°°°°°°°°°°°°° Website : http://www.phpcodeur.net Versions : 2.0beta - 2.1.0 Problem : Include file PHP Code/Location : °°°°°°°°°°°°°°°°°°° newsletter.php 2.1beta - 2.1.0 : ---------------------------------------------------- if !empty$HTTPPOSTVARS'action' $action =...

Buffer Overflow in GazTek HTTP Daemon v1.4 (ghttpd)

/ qitest1's security advisory 002 / Buffer Overflow in GazTek HTTP Daemon v1.4 ghttpd +Systems Affected Any system running GazTek HTTP Daemon v1.4 ghttpd +Program Description ghttpd is a small and easy to configure HTTP server with CGI support, tested on Linux. It can run as a standalone daemon o...

Ntop -w remote exploit

Problem: ntop has a stack-based BOF when it's requested too long filename. 2. Tested Version ntop-1.2a1 I only tested this version. 3. Example 1. first run ntop -w 8080 2. run this script $ printf "GET /perl -e 'print "A"x240'rnrn" |nc localhost 8080 3. the ntop goes seg. fault. $ ntop -w 8080...

Security Bug in Jana HTTP Server

Hello Bugtraqers, I found a directory travelling bug again, this time in JANA HTTP Server software available as freeware from http://www.jana-server.ocm.de . Here is a copy of the mail I sended to the author. eAX -------------------------------------------- Hello Thomas, I got your proxy/perver...

Security advisory for Bugzilla 5.0, 4.4.9, and 4.2.14

Summary ======= Bugzilla is a Web-based bug-tracking system used by a large number of software projects. The following security issue has been discovered in Bugzilla: Login names longer than 127 characters can be corrupted, which could lead to the creation of a user account with an unexpected ema...

[SECURITY] [DSA 3373-1] owncloud security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3373-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 18, 2015 https://www.debian.org/security/faq...

[USN-2735-1] Oxide vulnerabilities

========================================================================== Ubuntu Security Notice USN-2735-1 September 08, 2015 oxide-qt vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives...

XSS vulnerability Adobe Connect 9.3 (CVE-2015-0343 )

Advisory: Adobe Connect Reflected XSS Author: Stas Volfus Bugsec Information Security LTD Vendor URL: http://www.adobe.com/ Status: Vendor Notified ========================== Vulnerability Description ========================== Adobe Connect Central version: 9.3 is vulnerable to Reflected XSS Cro...

[MATTA-2013-004] CVE-2014-1409; MobileIron authentication bypass vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Matta Consulting - Matta Advisory https://www.trustmatta.com MobileIron Multiple Products Authentication Bypass Vulnerability Advisory ID: MATTA-2013-004 CVE reference: CVE-2014-1409, CVE-2013-7286 Affected platforms: VSP and Sentry Version: VSP 5.9...

[ MDVSA-2014:059 ] php

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:059 http://www.mandriva.com/en/support/security/ Package : php Date : March 14, 2014 Affected: Business Server 1.0 Problem Description: Multiple vulnerabilities has been discovered and corrected in php: Fixe...

[REVIVE-SA-2013-001] Revive Adserver 3.0.2 fixes SQL injection vulnerability

======================================================================== Revive Adserver Security Advisory REVIVE-SA-2013-001 ------------------------------------------------------------------------ Advisory ID: REVIVE-SA-2013-001 CVE ID: CVE-2013-7149 Date: 2013-12-20 Security risk: Critical...

Open-Xchange multiple security vulnerabilities

Multiple different vulnerabilities...

ESA-2013-057: RSA Archer(r) GRC Multiple Vulnerabilities

ESA-2013-057.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-057: RSA Archer® GRC Multiple Vulnerabilities EMC Identifier: ESA-2013-057 CVE Identifier: CVE-2013-3276, CVE-2013-3277 Severity Rating: CVSS v2 Base Score: See below for individual scores Affected Products: RSA Archer versio...

ESA-2013-032 RSA BSAFE® Micro Edition Suite Security Update for SSL/TLS Plaintext Recovery (aka “Lucky Thirteen”) Vulnerability

ESA-2013-032.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-032: RSA BSAFE® Micro Edition Suite Security Update for SSL/TLS Plaintext Recovery aka “Lucky Thirteen” Vulnerability EMC Identifier: ESA-2013-032 CVE Identifier: CVE-2013-0169 Severity Rating: CVSS v2 Base Score: 2.6...

[security bulletin] HPSBMU02883 SSRT101227 rev.1 - HP Data Protector, Remote Increase of Privilege, Denial of Service (DoS), Execution of Arbitrary Code

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03781657 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03781657 Version: 1 HPSBMU02883...

OpenSSH security vulnerabilities

DoS, information leakage...

[USN-1731-1] OpenStack Cinder vulnerability

========================================================================== Ubuntu Security Notice USN-1731-1 February 21, 2013 cinder vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

Multiple Command Execution Vulnerabilities in Smartphone Pentest Framework

Advisory ID: HTB23127 Product: Smartphone Pentest Framework SPF Vendor: Bulb Security LLC Vulnerable Versions: 0.1.3, 0.1.4 and probably prior Tested Versions: 0.1.3, 0.1.4 Vendor Notification: November 19, 2012 Public Disclosure: December 10, 2012 Vulnerability Type: OS Command Injection CWE-78...

Multiple vulnerabilities in Megapolis.Portal Manager

Hello 3APA3A! I want to warn you about multiple Cross-Site Scripting vulnerabilities in Megapolis.Portal Manager. It's commercial CMS from Softline-IT earlier Softline, which in particularly widespread among Ukrainian government sites including ministry, parliament, two special services and many...

[USN-1542-1] PostgreSQL vulnerabilities

========================================================================== Ubuntu Security Notice USN-1542-1 August 21, 2012 postgresql-8.3, postgresql-8.4, postgresql-9.1 vulnerabilities ========================================================================== A security issue affects these...

Seeker Advisory: Insecure Redirect in .NET Form Authentication - Redirect From Login Mechanism (ReturnURL Parameter)

Seeker Research Center Security Advisory By Irene Abezgauz =========== I. Overview =========== An Insecure Redirect vulnerability has been identified in the .NET Form Authentication - in the Redirect From Login mechanism. This vulnerability allows an attacker to craft links that contain redirects...

ZDI-11-345 : TrendMicro Control Manager CmdProcessor.exe AddTask Remote Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-11-345 : TrendMicro Control Manager CmdProcessor.exe AddTask Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-345 December 7, 2011 - -- CVE ID: - -- CVSS: 9.7, AV:N/AC:L/Au:N/C:C/I:P/A:C - -- Affected Vendors:...

Cisco Security Advisory: Cisco Small Business SRP500 Series Command Injection Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco Security Advisory: Cisco Small Business SRP500 Series Command Injection Vulnerability Advisory ID: cisco-sa-20111102-srp500 Revision 1.0 For Public Release 2011 November 2 16:00 UTC GMT...

TeamSHATTER Security Advisory: Database Vault Account Management Vulnerabilites

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 TeamSHATTER Security Advisory October 20, 2011 Risk Level: Medium Affected versions: Oracle Database Server version 10gR2, 11gR1 and 11gR2 Remote exploitable: Yes Credits: This vulnerability was discovered and researched by Esteban Martinez Fayo of...

AdaptCMS 2.0.1 Multiple security vulnerabilities

Advisory: AdaptCMS 2.0.1 Multiple security vulnerabilities Advisory ID: SSCHADV2011-018 Author: Stefan Schurtz Affected Software: Successfully tested on AdaptCMS 2.0.1 Vendor URL: http://www.adaptcms.com/ Vendor Status: fixed CVE-ID: - ========================== Vulnerability Description:...

Security issue is_a function in PHP 5.3.7+

PHP 5.3.7 changed the behavior of the isa function, used to check if an object is an instance of a class, to call the autoload function. This causes a remote code execute problem when coupled with a standard library like PEAR that internally uses isa to check if a returned variable is an Error...

[DSECRG-11-032] SAP NetWeaver ipcpricing - information disclose (by ERPScan)

DSECRG-11-032 SAP NetWeaver ipcpricing - information disclose com.sap.ipc.webapp.ipcpricing application has information disclose vulnerability Digital Security Research Group DSecRG Advisory DSECRG-11-032 Internal DSecRG-00197 Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL...

[SECURITY] CVE-2011-2729: Commons Daemon fails to drop capabilities (Apache Tomcat)

CVE-2011-2729: Commons Daemon fails to drop capabilities Apache Tomcat Severity: Important Vendor: The Apache Software Foundation Versions Affected: Tomcat 7.0.0 to 7.0.19 Tomcat 6.0.30 to 6.0.32 Tomcat 5.5.32 to 5.5.33 Description: Due to a bug in the capabilities code, jsvc the service wrapper...

Cisco Security Advisory: Default Credentials Vulnerability in Cisco Network Registrar

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco Security Advisory: Default Credentials Vulnerability in Cisco Network Registrar Advisory ID: cisco-sa-20110601-cnr Revision 1.0 For Public Release 2011 June 01 1600 UTC GMT +---------------------------------------------------------------------...

Linux pertiotions handling multiple security vulnerabilities

Memory corruptions, information leaks, DoS...

[security bulletin] HPSBMA02621 SSRT100352 rev.2 - HP OpenView Network Node Manager (OV NNM), Remote Execution of Arbitrary Code

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c02670501 Version: 2 HPSBMA02621 SSRT100352 rev.2 - HP OpenView Network Node Manager OV NNM, Remote Execution of Arbitrary Code NOTICE: The information in this Security Bulletin should be acted up...

[eVuln.com] URL XSS in Easy Banner Free

New eVuln Advisory: URL XSS in Easy Banner Free Summary: http://evuln.com/vulns/148/summary.html Details: http://evuln.com/vulns/148/description.html -----------Summary----------- eVuln ID: EV0148 Software: Easy Banner Free Vendor: PHP Web Scripts Version: 2009.05.18 Critical Level: low Type: Cro...

Path disclosure in eoCMS

Vulnerability ID: HTB22674 Reference: http://www.htbridge.ch/advisory/pathdisclosureineocms.html Product: eoCMS Vendor: eocms.com http://eocms.com Vulnerable Version: 0.9.04 Vendor Notification: 21 October 2010 Vulnerability Type: Path disclosure Status: Not Fixed, Vendor Alerted, Awaiting Vendor...

Secunia Research: Opera "Download" Dialog File Execution Security Issue

====================================================================== Secunia Research 12/08/2010 - Opera "Download" Dialog File Execution Security Issue - ====================================================================== Table of Contents Affected...

Scientific Atlanta DPC2100 WebSTAR Cable Modem vulnerabilities

=============================================================== Scientific Atlanta DPC2100 Cable Modem Cross-Site Request Forgery and Insufficient Authentication May 24, 2010 CVE-2010-2025, CVE-2010-2026 =============================================================== ==Description== Scientific...

Joomla com_jashowcase Local File Inclusion Vulnerability

======================================================== Joomla comjashowcase Local File Inclusion Vulnerability ======================================================== + Joomla comjashowcase Local File Inclusion Vulnerability...