AlienTechnology ALR-9900 default root password and backdoor

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Tested: www.alientechnology.com/readers/alr9900.php Background: Alien Technology is a major rfid-reader designer and manufacturer. Alien's products are sold to many corporations and the military. Alien's readers can be interfaced with in several ways...

Vbulletin 4.0.2 XSS Vulnerability

================================= Vbulletin 4.0.2 XSS Vulnerability ================================= + Vbulletin 4.0.2 XSS Vulnerability 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' /' / /' 0 0 /, // ,/ / 1 1 // /' / // /' / /' 0 0 / / / / / / 1 1 / / 0 0...

[xss] a xss on "ThreadID" parameter in BBSXP 2008 from china

first, my name is liscker, not lis + cker. Im chinese. thank you. BBSXP is prone to an cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting...

Cross-Site Scriting on Portwise SSL VPN v4.6

PR09-04: Cross-Site Scriting on Portwise SSL VPN v4.6 Vulnerability found: 25th March 2009 Vendor informed: 28th April 2009 Vulnerability fixed: Severity: Medium Description: The Portwise portal login page is vulnerable to XSS. Portwise is a SSL-VPN portal. Note: Other version might be affected a...

[SECURITY] [DSA 1966-1] New horde3 packages fix cross-site scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1966-1 [email protected] http://www.debian.org/security/ Steffen Joeris January 07, 2010 http://www.debian.org/security/faq -...

[DSECRG-09-010] Oracle 10g CTXSYS.DRVXTABC - plsql injection

Digital Security Research Group DSecRG Advisory DSECRG-09-010 http://dsecrg.com/pages/vul/show.php?id=110 Application: Oracle Database 10G Versions Affected: Oracle 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.4 Vendor URL: http://oracle.com Bugs: PL/SQL Injections Exploits: YES Reported: 29.01.2008 Vend...

(Post Form --> Parent Register (name)) Credentials Changer (SQLi) EXPLOIT -- Online Grades & Attendance v-3.2.6-->

!/usr/bin/perl ------------------------------------------------------------------------------------------------------------------- Post Form -- Parent Register name Credentials Changer SQLi EXPLOIT -- Online Grades & Attendance v-3.2.6--...

[security bulletin] HPSBMA02417 SSRT090031 rev.1 - HP Data Protector Express and HP Data Protector Express Single Server Edition (SSE), Local Denial of Service (DoS), Execution of Arbitrary Code

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c01697543 Version: 1 HPSBMA02417 SSRT090031 rev.1 - HP Data Protector Express and HP Data Protector Express Single Server Edition SSE, Local Denial of Service DoS, Execution of Arbitrary Code...

OpenX 2.6.4 multiple vulnerabilities

OpenX multiple vulnerabilities An advisory by EnableSecurity in collaboration with Acunetix. Advisory URL: http://resources.enablesecurity.com/advisories/openx-2.6.4-multiple.txt Version: OpenX 2.6.4 and older versions Description: OpenX is an online advertising web application written in PHP tha...

[USN-748-1] OpenJDK vulnerabilities

=========================================================== Ubuntu Security Notice USN-748-1 March 26, 2009 openjdk-6 vulnerabilities CVE-2006-2426, CVE-2009-1093, CVE-2009-1094, CVE-2009-1095, CVE-2009-1096, CVE-2009-1097, CVE-2009-1098, CVE-2009-1100, CVE-2009-1101, CVE-2009-1102...

C4 SCADA Security Advisory - AREVA e-terrahabitat / e-terraplatform Multiple Vulnerabilities

Background ----------------- Vendor product information, from www.areva-td.com : AREVA T&D solution for real-time energy management systems; this suite of software products can be configured to meet your specific needs and business function. Transmission companies, Generation owners, Independent...

UNAK-CMS Lfi

UNAK-CMS Lfi AUTHOR : IRCRASH R3d.W0rm Sina Yazdanmehr Discovered by : IRCRASH R3d.W0rm Sina Yazdanmehr Our Site : Http://IRCRASH.COM IRCRASH Team Members : Dr.Crash - R3d.w0rm Sina Yazdanmehr Script Download : www.unak.net DORK : "Powered by UNAK-CMS" Lfi...

Multiple DNS servers and clients DNS records spoofing

DNS poisoning attack may be used to spoof query results...

Microsoft Security Bulletin MS08-016 – Critical Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (949030)

Microsoft Security Bulletin MS08-016 – Critical Vulnerabilities in Microsoft Office Could Allow Remote Code Execution 949030 Published: March 11, 2008 Version: 1.0 General Information Executive Summary This security update resolves two privately reported vulnerabilities in Microsoft Office that...

WoltLab Burning Board 3.0.3 PL1 SQL-Injection Vulnerability

WoltLab Burning Board 3.0.3 PL1 SQL Injection Vulnerability by NBBN Vendor: http://woltlab.de ::Proof of Concept http://site.tld/wbb3/index.php?page=PMList&folderID=0&pageNo=1&sortField=isViewed&sortOrder=ASC, SELECT password FROM wcf1user WHERE userID=1 AND...

Microsoft Security Bulletin MS08-006 – Important Vulnerability in Internet Information Services Could Allow Remote Code Execution (942830)

Microsoft Security Bulletin MS08-006 – Important Vulnerability in Internet Information Services Could Allow Remote Code Execution 942830 Published: February 12, 2008 Version: 1.0 General Information Executive Summary This important update resolves a privately reported vulnerability in Internet...

JBC Explorer <= V7.20 RC 1 Remote Code Execution Exploit

!/usr/bin/php ?php This file require the PhpSploit class. If you want to use this class, the latest version can be downloaded from acid-root.new.fr. errorreportingEALL ^ ENOTICE; require'phpsploitclass.php'; head; if$argc 3 usage; $url = getparam'url', true; $prx = getparam'proxy', false; $pra =...

[ MDKSA-2007:188 ] - Updated postgresql packages prevent access abuse using dblink

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDKSA-2007:188 http://www.mandriva.com/security/ Package : postgresql Date : September 25, 2007 Affected: 2007.0, 2007.1, Corporate 3.0, Corporate 4.0 Problem Description: PostgreSQL 8.1 and probably later and earlier...

PostgreSQL dblink library multiple security vulnerabilities

Privilege escalation...

Microsoft Internet Explorer multiple security vulnerabilities

Memory corruption on ActiveX parsing, unsafe Visual Basic ActiveX execution, Visual Basic ActiveX memory corruption...

Pluck 4.3 themes.php Remote File Inclusion and disclosure

Aria-Security Team Pluck 4.3 Remote File Inclusion Vendor: http://www.pluck-cms.org/ /path/data/inc/theme.php if Registerglobal was set as ON then we can use the $dir variable for RFI isfile$dir."/".$file $files=$file; else $dirs=$dir."/".$file; if$dirs foreach $dirs as $dir include...

PHP Safe_mode bypass exploit (win32service)

?php PHP Safemode bypass exploit win32service Note: Tested on 5.2.1 Author: NetJackal Email: nima501atyahoodotcom Website: http://netjackal.by.ru Usage: http://victim.net/nj.php?CMD=command $command=isset$GET'CMD'?$GET'CMD':'dir'; cammand $dir=iniget'uploadtmpdir'; Directory to store command's...

AsteriDex (Asterisk / Trixbox) remote code execution

Hoku Security Vulnerability Advisory Title: AsteriDex remote command execution Vendor URL: http://bestof.nerdvittles.com/applications/asteridex/ Type: Command injection / remote code execution Vulnerable versions: = 3.0 Risk factor: High Popularity: Low Author: Carl Livitt Contact: [email protected]...

Ingres stack overflow in uuid_from_char function

======= Summary ======= Name: Stack overflow in uuidfromchar function Release Date: 25 June 2007 Reference: NGS00388 Discover: Chris Anley [email protected] Vendor: Ingres Vendor Reference: Ingres bug 115911, CVE-2007-3338, CAID 35452 Systems Affected: Ingres 2006 9.0.4 and prior Risk: High...

[Full-disclosure] SafeNET High Assurance Remote/SoftRemote (IPSecDrv.sys) remote DoS

Attached is POC for a remote DoS in IPSecDrv.sys shipped with SafeNET High Assurance Remote and SoftRemote. The version tested is 10.4.0.12. The bug itself is due to SafeNET making a complete hash of IPv6 support for IPSec. The result of the code is a complete DoS of the machine in Kernel mode...

Multiple Microsoft Excel buffer oveflows

Heap buffer overflow on oversized value of BIFF8 type column. Heap buffer overflow on oversized palette value for BIFF8 type column...

[SA23913] CGI Rescue WebFORM Cross-Site Scripting and HTTP Header Injection

TITLE: CGI Rescue WebFORM Cross-Site Scripting and HTTP Header Injection SECUNIA ADVISORY ID: SA23913 VERIFY ADVISORY: http://secunia.com/advisories/23913/ CRITICAL: Less critical IMPACT: Cross Site Scripting WHERE: From remote SOFTWARE: WebFORM 4.x http://secunia.com/product/10398/ DESCRIPTION:...

[Aria-Security Team] MidiCart ASP Plus Shopping Cart SQL Injection

Aria-Security Team Advisory www.Aria-security.Com For English www.Aria-Security.net For Persian ----------------------------------------------------------- Software: MidiCart ASP Plus Shopping Cart Method: SQL Injection And Cross Site Scripting PoC: http://target/path/itemshow.asp?codeno=SQL...

[ECHO_ADV_58$2006]Cyberfolio <=2.0 RC1 $av Remote File Inclusion Vulnerability

/ / | | / // / | | Y / | / / /| / / / / / / .OR.ID ECHOADV58$2006 ----------------------------------------------------------------------------------------------- ECHOADV58$2006Cyberfolio =2.0 RC1 $av Remote File Inclusion Vulnerability...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

K-Meleon Concurrency-related Vulnerability

The newest version of K-Meleon browser is affected to disclosed on Bugtraq recently. When using test link http://lcamtuf.coredump.cx/ffoxdie3.html browser crashed after a delay of some seconds. No user interaction was needed. Affected versions: Vulnerability has been confirmed in K-Meleon 1.0.1 i...

[Full-disclosure] Latinchat Denial Of Service

Denial Of Service on Chat Magma Latinchat http://www.latinchat.com Researcher: Vicente Perez 1.-Overview Latinchat is one of the most known chat server, and used basically by latin american people. 2.-Description This system has a vulnerabily as DoS, taking system offline by a while. The fail...

RE: [Full-disclosure] Cisco VPN Concentrator IKE resource exhaustionDoS Advisory

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello: This is a Cisco PSIRT response to an advisory published by an unaffiliated third party, Roy Hills, of NTA Monitor Ltd posted as of July 26, 2006 at http://www.nta-monitor.com/posts/2006/07/cisco-concentrator-dos.html, and entitled: Cisco VPN...

XSS vulnerability in guestbook-php-script

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------- SySS-Advisory: XSS-vulnerability in guestbook-php-script - ------------------------------------------------------------------- Problem discovered: February 3d 2006 Vendor contacted:...

[Bday release] Comersus shopping cart has multiple Sql injection and Cross Site Scripting vulnerabilities

Dcrab 's Security Advisory http://www.dbtech.org Deadbolt Computer Technologies SPECIAL BIRTHDAY RELEASE, 18TH BIRTHDAY RELEASE FOR DIABOLIC CRAB, YOU CAN SEND EMAILS TO [email protected] Get Dcrab's Services to audit your Web servers, scripts, networks, etc or even code them. Learn more at...

Microsoft Security Bulletin MS04-012

Microsoft Security Bulletin MS04-012 Cumulative Update for Microsoft RPC/DCOM 828741 Issued: April 13, 2004 Version: 1.0 Summary Who should read this document: Customers who use Microsoft® Windows® Impact of vulnerability: Remote Code Execution Maximum Severity Rating: Critical Recommendation:...

Подмена подписанного документа в ECDSA

Серьёзная ошибка в ECDSA. В матаппарате новейшего американского стандарта ЭЦП известного как ECDSA DSA для эллиптических кривых 1 cтр. 25-30 существует серьёзная ошибка позволяющая выбрать такое значение секретного ключа, чтобы получить одинаковые подписи для разных документов. Это позволяет...

PGPsdk Key Validity Vulnerability

http://www.pgp.com/support/product-advisories/pgpsdk.asp A vulnerability in PGP's display of key validity has been discovered that could allow an attacker to fool users into thinking that a valid signature was created by what is actually an invalid user ID. If the attacker can obtain a signature ...

hhp's Expect advisory/exploit/patch.

------------------------------------------------------------------------------- hhp adv-17 Sec-Advisory/Exploit/Patch www.hhp-programming.net ------------------------------------------------------------------------------- Topic: Expect. Versions: 5.31.8 and 5.28.1, maybe others. Date: 12/12/2000...

All, After reading a report on security focus that deals with the sonicwall soho versions 4.0 and 5.0 being vulnerable to a buffer overflow by using a alot of characters in the username...I started testing againg our Sonicwall Pro and Pro VX in the lab. Entering this for the username -...

imapd4r1 v12.264

Newest RH: OK nimue IMAP4rev1 v12.264 server ready 1 login lcamtuf test 1 OK LOGIN completed 1 list "" AAAAAAAAAAAAAAAAAAAAAAAAAAA...yes, a lot of 'A's ; Program received signal SIGSEGV, Segmentation fault. 0x41414141 in ?? sigh Privledges seems to be dropped, but, anyway, it's nice way to get...

HP Asset Manager information disclosure

No description provided...

UDID+ v2.5 iOS - Mail Command Inject Vulnerability

Document Title: =============== UDID+ v2.5 iOS - Mail Command Inject Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1542 Release Date: ============= 2015-07-06 Vulnerability Laboratory ID VL-ID: ==================================== 1542...

Data Source: Scopus CMS - SQL Injection Web Vulnerability

Document Title: =============== Data Source: Scopus CMS - SQL Injection Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1436 Release Date: ============= 2015-02-25 Vulnerability Laboratory ID VL-ID: ====================================...

CVE-2014-4958: Stored Attribute-Based Cross-Site Scripting (XSS) Vulnerability in Telerik UI for ASP.NET AJAX RadEditor Control

All versions of the popular UI for ASP.NET AJAX RadEditor Control product by Telerik may be affected by a high-risk stored attribute-based cross-site scripting XSS vulnerability that is assigned CVE-2014-4958. This WYSIWYG rich text editor is “...what Microsoft chose to use in MSDN, CodePlex,...

[Onapsis Security Advisory 2014-027] SAP HANA Multiple Reflected Cross Site Scripting Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Onapsis Security Advisory 2014-027: SAP HANA Multiple Reflected Cross Site Scripting Vulnerabilities 1. Impact on Business ===================== By exploiting this vulnerability a remote unauthenticated attacker would be able to attack other users of...

[SECURITY] CVE-2013-2187: Apache Archiva Cross-Site Scripting vulnerability

CVE-2013-2187: Apache Archiva Cross-Site Scripting vulnerability Severity: Important Vendor: The Apache Software Foundation Versions Affected: - Archiva 1.3 to Continuum 1.3.6 - The unsupported versions Archiva 1.2 to 1.2.2 are also affected. Description: A request that included a specially craft...

APPLE-SA-2014-04-22-3 Apple TV 6.1.1

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-04-22-3 Apple TV 6.1.1 Apple TV 6.1.1 is now available and addresses the following: Apple TV Available for: Apple TV 2nd generation and later Impact: An attacker in a privileged network position can obtain web site credentials Descriptio...

HP Integrated Lights-Out unauthorized access

Information leakage of password...

APPLE-SA-2014-02-21-3 Apple TV 6.0.2

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-02-21-3 Apple TV 6.0.2 Apple TV 6.0.2 is now available and addresses the following: Apple TV Available for: Apple TV 2nd generation and later Impact: An attacker with a privileged network position may capture or modify data in sessions...