DefenseCode Security Advisory: Cisco Linksys Remote Preauth 0day Root Exploit Follow-Up

A few weeks ago, we have announced remote preauth root access exploit for Cisco Linksys http://www.youtube.com/watch?v=cv-MbL7KFKE. Vulnerability details were disclosed here: http://www.defensecode.com/public/DefenseCodeBroadcomSecurityAdvisory.pdf During further research, we have discovered that...

[KIS-2013-01] DataLife Engine 9.7 (preview.php) PHP Code Injection Vulnerability

------------------------------------------------------------------ DataLife Engine 9.7 preview.php PHP Code Injection Vulnerability ------------------------------------------------------------------ • Software Link: http://dleviet.com/ • Affected Version: 9.7 only. • Vulnerability Description: Th...

Multiple Command Execution Vulnerabilities in Smartphone Pentest Framework

Advisory ID: HTB23127 Product: Smartphone Pentest Framework SPF Vendor: Bulb Security LLC Vulnerable Versions: 0.1.3, 0.1.4 and probably prior Tested Versions: 0.1.3, 0.1.4 Vendor Notification: November 19, 2012 Public Disclosure: December 10, 2012 Vulnerability Type: OS Command Injection CWE-78...

Apple Mac OS X multiple security vulnerabilities

Multiple vulnerabilities in different subsystems...

VUPEN - Mozilla Firefox "nsHTMLEditRules" Remote Use-after-free (CVE-2012-3958 / MFSA 2012-58)

VUPEN Security Research - Mozilla Firefox "nsHTMLEditRules" Remote Use-after-free CVE-2012-3958 / MFSA 2012-58 Website : http://www.vupen.com/english/research.php Twitter : http://twitter.com/vupen I. BACKGROUND --------------------- Mozilla Firefox is a free and open source web browser and...

Multiple Vulnerabilities in phpList

Advisory ID: HTB23100 Product: phpList Vendor: phpList Ltd Vulnerable Versions: 2.10.18 and probably prior Tested Version: 2.10.18 Vendor Notification: July 11, 2012 Public Disclosure: August 8, 2012 Vulnerability Type: Cross-Site Scripting CWE-79, SQL Injection CWE-89 CVE References:...

CJWSoft ASPGuest GuestBook 'edit.asp' - SQL Injection Vulnerability

Title: CJWSoft ASPGuest GuestBook 'edit.asp' - SQL Injection Vulnerability Product : CJWSoft ASPGuest GuestBook Version : Free Version Vendor: http://www.cjwsoft.com/aspguest/default.asp Class: Input Validation Error CVE: Remote: Yes Local: No Published: 2012-02-24 Updated: Impact : Medium CVSSv2...

LSE-2012-03-01: PyPAM -- Python bindings for PAM - Double Free Corruption

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 === LSE Leading Security Experts - Security Advisory 2012-03-01 === PyPAM -- Python bindings for PAM - Double Free Corruption - --------------------------------------------------------- Affected Versions ================= PyPAM = 0.4.2 Red Hat PyPAM =...

PHP-SCMS 1.6.8 "lang" parameter XSS vulnerability

Advisory: PHP-SCMS 1.6.8 "lang" parameter XSS vulnerability Advisory ID: SSCHADV2011-035 Author: Stefan Schurtz Affected Software: Successfully tested on PHP-SCMS 1.6.8 Vendor URL: http://php-scms.sourceforge.net/ Vendor Status: unpatched no vendor feedback ========================== Vulnerabilit...

MVSA-11-013 - EllisLab xss_clean Filter Bypass - ExpressionEngine and CodeIgniter

CVE: CVE-2011-4025 Vendor: EllisLab Products: ExpressionEngine 2.2.2, CodeIgniter 2.0.3 Vulnerabilities: xssclean filter bypass, leading to Cross-Site Scripting XSS Risk: High Attack Vector: From Remote Reference: http://secureappdev.blogspot.com/2011/11/ellislab-xssclean-filter-bypass.html 1...

Blogs manager <= 1.101 SQL Injection Vulnerability

Dear all, I have found a SQL injection vulnerability in Blogs manager = 1.101 It seems to be version 1.101 as you can see in the files section of sourceforge. I reported the vulnerability to the vendor but no response as stated in the advisory. Best, muuratsalo -- ADVISORY --...

[SECURITY] CVE-2011-3376 Apache Tomcat - Privilege Escalation via Manager app

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2011-3376 Apache Tomcat - Privilege Escalation via Manager app Severity: Low Vendor: The Apache Software Foundation Versions Affected: - - Tomcat 7.0.0 to 7.0.21 Description: This issue only affects environments running web applications that are n...

Microsoft Windows multiple security vulnerabilities

Active Accessibility and Media Center insecure DLL loading...

openEngine 2.0 'id' Blind SQL Injection vulnerability

Advisory: openEngine 2.0 'id' Blind SQL Injection vulnerability Advisory ID: SSCHADV2011-019 Author: Stefan Schurtz Affected Software: Successfully tested on openEngine 2.0 100226 Vendor URL: http://www.openengine.de/ Vendor Status: informed CVE-ID: - ========================== Vulnerability...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Microsoft Internet Explorer 'toStaticHTML' HTML Sanitizing Information Disclosure

Name: Microsoft Internet Explorer 'toStaticHTML' HTML Sanitizing Information Disclosure Vulnerability Author: Adi Cohen of IBM Rational Application Security [email protected] Date: June 14, 2011 Risk: Medium CVE: CVE-2011-1252 Introduction ------------- The JavaScript function toStaticHTML, which i...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

www.eVuln.com : Non-persistent XSS in BizDir

www.eVuln.com advisory: Non-persistent XSS in BizDir Summary: http://evuln.com/vulns/158/summary.html Details: http://evuln.com/vulns/158/description.html -----------Summary----------- eVuln ID: EV0158 Software: BizDir Vendor: LEXIPIXEL Version: v.05.10 Critical Level: low Type: Cross Site...

The GNU C library dynamic linker expands $ORIGIN in setuid library search path

The GNU C library dynamic linker expands $ORIGIN in setuid library search path ------------------------------------------------------------------------------ Gruezi, This is CVE-2010-3847. The dynamic linker or dynamic loader is responsible for the runtime linking of dynamically linked programs...

[oCERT-2010-003] Free Simple CMS path sanitization errors

2010-003 Free Simple CMS path sanitization errors Description: Free Simple CMS, an open source content management system, suffers from remote file inclusion vulnerabilities. Insufficient path sanitization on several query string parameters leads to inclusion of arbitrary files from remote sources...

About the security content of Safari 5.0.2 and Safari 4.1.2

About the security content of Safari 5.0.2 and Safari 4.1.2 Last Modified: September 07, 2010 Article: HT4333 Email this article Print this page Summary This document describes the security content of Safari 5.0.2 and Safari 4.1.2. For the protection of our customers, Apple does not disclose,...

Cyberoam SSL VPN Client - Plain-text Storage of Username and Password

Cyberoam SSL VPN Client - Plain-text Storage of Username and Password Vulnerability Summary: Product: Cyberoam SSL VPN Client v1.0 Vendor: eLiteCore Website: http://www.cyberoam.com/ Platform: Windows Vulnerability Classification: Insecure Storage of User Credentials Issue Fixed in Version:...

FreeBSD jail escape

It's possible to access current working directory...

Vbulletin 4.0.2 XSS Vulnerability

================================= Vbulletin 4.0.2 XSS Vulnerability ================================= + Vbulletin 4.0.2 XSS Vulnerability 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' /' / /' 0 0 /, // ,/ / 1 1 // /' / // /' / /' 0 0 / / / / / / 1 1 / / 0 0...

Ananta Gazelle SQL Injection Vulnerability

www.BugReport.ir AmnPardaz Security Research Team Title: Ananta Gazelle SQL Injection Vulnerability Vendor: http://www.anantasoft.com/ Vulnerable Version: 1.0 Latest version till now Exploitation: Remote with browser Fix: N/A - Description: Ananta Gazelle is a rich JavaScript enabled CMS with...

[security bulletin] HPSBMA02483 SSRT090257 rev.1 - HP OpenView Network Node Manager (OV NNM), Remote Execution of Arbitrary Code

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c01950877 Version: 1 HPSBMA02483 SSRT090257 rev.1 - HP OpenView Network Node Manager OV NNM, Remote Execution of Arbitrary Code NOTICE: The information in this Security Bulletin should be acted up...

FreeBSD privilege escalation

It's possible to bypass environment variables filtering on suid program execution...

google apps googleapps.url.mailto:// uri handler cross-browser remote command execution exploit (IE)

google apps googleapps.url.mailto:// uri handler cross-browser remote command execution exploit Internet Explorer by nine:situations:group::pyrokinesis site: http://retrogod.altervista.org/ software site: http://pack.google.com/intl/it/packinstaller.html tested against: Internet Explorer 8, windo...

[ONSEC-09-017] Blogolet PHP including

ONSEC-09-017 Blogolet PHP including Цель: Blogolet CMS Тип: PHP инъекция Угроза: Высокая Дата обнаружения: 21.09.2009 Дата оповещения разработчика: 21.09.2009 Дата выхода исправления: 21.09.2009 Автор: Vladimir Vorontsov OnSec Russian Security Group onsec dot ru Описание: Уязвимость существует...

Mozilla Foundation Security Advisory 2009-43

Mozilla Foundation Security Advisory 2009-43 Title: Heap overflow in certificate regexp parsing Impact: Critical Announced: August 1, 2009 Reporter: Moxie Marlinspike Products: Firefox, Thunderbird, SeaMonkey, NSS Fixed in: Firefox 3.5 NSS 3.12.3 Description Moxie Marlinspike reported a heap...

[DSECRG-09-031] Oracle BEA Weblogic 10.3 Linked ХSS vulnerability

Digital Security Research Group DSecRG Advisory DSECRG-09-031 http://dsecrg.com/pages/vul/show.php?id=131 Application: Oracle BEA Weblogic 10 Versions Affected: Oracle BEA Weblogic 10 Vendor URL: http://oracle.com Bugs: Linked XSS Vulnerability Exploits: YES Reported: 18.03.2009 Vendor response:...

[security bulletin] HPSBMA02417 SSRT090031 rev.1 - HP Data Protector Express and HP Data Protector Express Single Server Edition (SSE), Local Denial of Service (DoS), Execution of Arbitrary Code

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c01697543 Version: 1 HPSBMA02417 SSRT090031 rev.1 - HP Data Protector Express and HP Data Protector Express Single Server Edition SSE, Local Denial of Service DoS, Execution of Arbitrary Code...

Microsoft Security Bulletin MS09-013 - Critical Vulnerabilities in Windows HTTP Services Could Allow Remote Code Execution (960803)

Microsoft Security Bulletin MS09-013 - Critical Vulnerabilities in Windows HTTP Services Could Allow Remote Code Execution 960803 Published: April 14, 2009 Version: 1.0 General Information Executive Summary This security update resolves one publicly disclosed vulnerability and two privately...

OpenX 2.6.4 multiple vulnerabilities

OpenX multiple vulnerabilities An advisory by EnableSecurity in collaboration with Acunetix. Advisory URL: http://resources.enablesecurity.com/advisories/openx-2.6.4-multiple.txt Version: OpenX 2.6.4 and older versions Description: OpenX is an online advertising web application written in PHP tha...

[USN-748-1] OpenJDK vulnerabilities

=========================================================== Ubuntu Security Notice USN-748-1 March 26, 2009 openjdk-6 vulnerabilities CVE-2006-2426, CVE-2009-1093, CVE-2009-1094, CVE-2009-1095, CVE-2009-1096, CVE-2009-1097, CVE-2009-1098, CVE-2009-1100, CVE-2009-1101, CVE-2009-1102...

DoS vulnerabilities in Mozilla, Internet Explorer, Google Chrome and Opera

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Denial of Service уязвимостях в браузерах Mozilla Firefox, Opera та Google Chrome. Данные уязвимости похожи на DoS в Firefox, Opera и Chrome http://websecurity.com.ua/2456/, которые я опубликовал в проекте День багов в браузерах. Данную атаку я...

Linksys/Cisco WRT350N 1.0.3.7 Insecure Samba Static Configuration

As of today 25 September 2008, I am using the latest 1.0.3.7 firmware for my region Singapore, US also use this version. 1/ Outdated Samba 3.0.2, vulnerable to numerous security holes. 2/ Default admin:admin user 3/ Default open guest user, noway to disable it 4/ It is impossible to disable SAMBA...

Team SHATTER Security Advisory: Security Vulnerability in CLR stored procedure deployment from IBM Database Add-Ins for Visual Studio

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Team SHATTER Security Advisory Security Vulnerability in CLR stored procedure deployment from IBM Database Add-Ins for Visual Studio September 15th 2008 Risk Level: High Affected versions: IBM DB2 Database Server v9.1 and 9.5 on Windows platform. Remo...

PHP Live Helper <= 2.0.1 Multiple Vulnerabilities

GulfTech Security Research August 16, 2008 Vendor : Turnkey Web Tools, Inc URL : http://www.turnkeywebtools.com Version : PHP Live Helper = 2.0.1 Risk : Multiple Vulnerabilities Description: PHP Live Helper is an online support system written in php that allows the visitors of a website to intera...

[SECURITY] [DSA 1588-1] New Linux 2.6.18 packages fix several vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ---------------------------------------------------------------------- Debian Security Advisory DSA-1588-1 [email protected] http://www.debian.org/security/ dann frazier May 27, 2008 http://www.debian.org/security/faq -...

phpBB PJIRC mod LFI

/ PJIRC mod phpBB Local File Include Discrovered by: 0in from DaRk-CodeRs Programming & Security Group! Contact: 0indotemailatgmaildotcom Description: This is a simply irc applet to phpbb. Download: http://www.hotscripts.pl/produkt-1998.html HTTP://Dark-Coders.4rh.eu Greetz to: All DaRk-CodeRs Te...

[SA29344] Linksys WRT54G Security Bypass Vulnerability

TITLE: Linksys WRT54G Security Bypass Vulnerability SECUNIA ADVISORY ID: SA29344 VERIFY ADVISORY: http://secunia.com/advisories/29344/ CRITICAL: Less critical IMPACT: Security Bypass WHERE: From local network OPERATING SYSTEM: Linksys WRT54G Wireless-G Broadband Router...

{securityreason.com}PHP 5 *printf() - Integer Overflow

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 PHP 5.2.5 and prior : printf functions Integer Overflow Author: Maksymilian Arciemowicz cXIb8O3 SecurityReason.com and SecurityReason.pl Date: - - Written: 01.03.2008 - - Public: 20.03.2008 SecurityReason Research SecurityAlert Id: 52 CVE-2008-1384...

Microsoft Security Bulletin MS08-014 - Critical Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (949029)

Microsoft Security Bulletin MS08-014 - Critical Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution 949029 Published: March 11, 2008 Version: 1.0 General Information Executive Summary This security update resolves several privately reported and publicly reported vulnerabilities i...

UniversalFtp Server 1.0.44 Multiple Remote Denial of service

UniversalFtp Server 1.0.44 Multiple Remote Denial of service @nolife : This bug has been found with a brain , ten fingers, a keyboard , and a laptop , one of my best Tool i ever tryed. Stay tuned for more tools hint . Reponse: 226 Completed... Statut: Liste du repertoire completee Commande : LIST...

Serious holes affecting SiteBar 3.3.8

All, As a result of a short security audit of SiteBar, a number of security holes were found. The holes included code execution, a malicious redirect and multiple cases of Javascript injection. After liasing with the developers, the holes have been patched. Attached are the advisory and patch...

[CVE-2007-1358] Apache Tomcat XSS vulnerability in Accept-Language header processing

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2007-1358: Apache Tomcat XSS vulnerability in Accept-Language header processing Severity: Low cross-site scripting Vendor: The Apache Software Foundation Versions Affected: Tomcat 4.0.0 to 4.0.6 Tomcat 4.1.0 to 4.1.34 Tomcat 5.0.0 to 5.0.30 Tomcat...

[Full-disclosure] WSPortal version 1.0 Path Disclosure Vulnerability

netVigilance Security Advisory 32 WSPortal version 1.0 Path Disclosure Vulnerability Description: WSPortal is a site management system coded in PHP/MySQL. It is capable of adding pages, adding news to pages, adding images to news articles, alerting the site or a specific ip address, private...

[Full-disclosure] [OPENADS-SA-2007-003] Openads 2.0.11 vulnerability fixed

======================================================================== Openads security advisory OPENADS-SA-2007-003 ------------------------------------------------------------------------ Advisory ID: OPENADS-SA-2007-003 Date: 2007-Apr-11 Security risk: medium risk Applications affetced:...

Microsoft Security Bulletin MS07-021 Vulnerabilities in CSRSS Could Allow Remote Code Execution (930178)

Microsoft Security Bulletin MS07-021 Vulnerabilities in CSRSS Could Allow Remote Code Execution 930178 Published: April 10, 2007 Version: 1.0 Summary Who Should Read this Document: Customers who use Microsoft Windows Impact of Vulnerability: Remote Code Execution Maximum Severity Rating: Critical...