eClassifieds [injection sql]

vendor site: http://enthrallweb.com/ product : eClassifieds bug:injection sql risk : medium injection sql : /ad.asp?ADID='sql /ad.asp?catid='sql /dircat.asp?cid='sql /dirSub.asp?sid='sql /ad.asp?catid=35&subid='sql /ad.asp?catid=35&subid=102&adid='sql laurent gaffi & benjamin moss http://s-a-p.ca...

[security bulletin] HPSBMA02167 SSRT061262 rev.2 - HP OpenView Client Configuration Manager (CCM), Remote Unauthorized Arbitrary Code Execution or Denial of Service (DoS)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c00795552 Version: 2 HPSBMA02167 SSRT061262 rev.2 - HP OpenView Client Configuration Manager CCM, Remote Unauthorized Arbitrary Code Execution or Denial of Service DoS NOTICE: The information in...

[ECHO_ADV_58$2006]Cyberfolio <=2.0 RC1 $av Remote File Inclusion Vulnerability

/ / | | / // / | | Y / | / / /| / / / / / / .OR.ID ECHOADV58$2006 ----------------------------------------------------------------------------------------------- ECHOADV58$2006Cyberfolio =2.0 RC1 $av Remote File Inclusion Vulnerability...

Segue CMS <= 1.5.8 (themesdir) Remote File Include Vulnerability

+------------------------------------------------------------------------------------------- + Segue CMS = 1.5.8 themesdir Remote File Include Vulnerability +------------------------------------------------------------------------------------------- + Affected Software .: Segue CMS = 1.5.8 + Vend...

Pie Cart Pro => (Home_Path) Remote File Inclusion Exploit

==================================================================== Pie Cart Pro = HomePath Remote File Inclusion Exploit ==================================================================== Critical Level : Dangerous By Saudi Hackrz http://www.doodlebabies.com/...

VBZooM <=V1.11 " ignore-pm.php" SQL Injection

=========================================== Discovered By: C.B.B.L CrAzY CrAcKeR ,Breeeeh ,BoNy-m ,LiNuXrOOt =========================================== Search:- POWERED BY: VBZooM V1.11 Example:- ignore-pm.php?UserID=SQL Injection ===========================================...

[Full-disclosure] Multiple Vulns in Bitrix CMS

Multiple Vulns in Bitrix CMS Vendor bitrix.com Version The latest one 4.1.x Severity Medium Patched: No Multiple vulnerabilities discovered in Bitrix CMS. A remote attacker can conduct XSS attacks and compromise vulnerable system. 1. A remote attacker can get information about version history and...

Microsoft Security Bulletin MS05-051 Vulnerabilities in MSDTC and COM+ Could Allow Remote Code Execution (902400)

Microsoft Security Bulletin MS05-051 Vulnerabilities in MSDTC and COM+ Could Allow Remote Code Execution 902400 Published: October 11, 2005 Version: 1.0 Summary Who should read this document: Customers who use Microsoft Windows Impact of Vulnerability: Remote Code Execution Maximum Severity Ratin...

7a69Adv#17 - Internet Explorer FTP download path disclosure

NOTE FOR BUGTRAQ MODERATOR Excuseme if you have recibed this mail reapeated, but I had some problems on my mail server some days ago, and I have sent this mail 3 or 4 times. Sorry : Delete this note to post to the list. Thank's you. /NOTE FOR BUGTRAQ MODERATOR -...

Presentation: Bypassing client application protection techniques with notepad

Topic: Bypassing client application protection techniques Category: Protection bypass Affected products: CheckPoint VPN-1TM & FireWall-1R NG with Application Intelligence R55 HFA 9 Microsoft Windows XP SP2 Agnitum Outpost Pro 2.1, 2.5 Tiny Firewall Pro v6.0.100 ZoneAlarm Pro with Web Filtering...

QuikStore Shopping Cart Discloses Installation Path & Files to Remote Users

Indonesia Security Development Team Advisory QuikStore Shopping Cart Discloses Installation Path & Files to Remote Users ===================================================================== Advisory Name: QuikStore Shopping Cart Discloses Installation Path & Files to Remote Users Release Date:...

SECURITY.NNO: FTGate PRO/Office hotfixes

Dear bugtraq, Original version available at http://www.security.nnov.ru/advisories/ftgate.asp Title : FTGate PRO/Office hotfixes Author : 3APA3A [email protected] Date : December, 18 2001 Affected : FTGate PRO 1.05, FTGate Office 1.05 Vendor : Floositek 1 Risk : high Remote : yes Exploitabl...

nCipher Security Advisory #2: SNMP vulnerabilities

SUMMARY ======= SNMP agents supplied by nCipher, as well as those required to run other nCipher SNMP aupport software, could be vulnerable to buffer overflow attacks including denial of service and privilege elevation. BACKGROUND ========== nCipher supplies a range of Hardware Security Modules HS...

Multiple PHP Vulnerabilities - Remote Compromise Exploit in Circulation

Internet Security Systems Security Alert February 27, 2002 Multiple PHP Vulnerabilities: Remote Compromise Exploit in Circulation Synopsis: ISS X-Force has learned of multiple buffer overflow vulnerabilities present in the PHP Hypertext Preprocessor scripting language. PHP is a popular server-sid...

Security Bulletin MS01-033

The following is a Security Bulletin from the Microsoft Product Security Notification Service. Please do not reply to this message, as it was sent from an unattended mailbox. -----BEGIN PGP SIGNED MESSAGE----- - ---------------------------------------------------------------------- Title: Uncheck...

Security Bulletin MS01-018

---------------------------------------------------------------------- Title: Visual Studio VB-TSQL Object Contains Unchecked Buffer Date: 27 March 2001 Software: Visual Studio 6.0 Enterprise Edition Impact: Run code of attacker's choice Bulletin: MS01-018 Microsoft encourages customers to review...

INDEXU Authentication By-Pass

UNDERSEC SECURITY ADVISORY 4th March 20001 ======================================================================= PROGRAM: INDEXU VERSIONS: All versions prior to 2.0Beta 2.0Beta included OS: All REMOTE: YES LOCAL: YES CLASS: Authentication bypass POSTED BY: Sp4rK [email protected] BACKGROUND...

HIS Auktion 1.62: "show files" vulnerability and remote command execute.

-----------UkR security team advisory 8------------ HIS Auktion 1.62: "show files" vulnerability and remote command execute. -------------------------------------------------- Name: HIS Auktion 1.62: "show files" vulnurability. Date: 11.02.2001 Author: UkR-XblP About: script "HIS Auktion 1.62" is...

Ports Security Advisory: FreeBSD-SA-00:59.pine

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:59 Security Advisory FreeBSD, Inc. Topic: pine4 port contains remote vulnerability Category: ports Module: pine4/pine4-ssl/zh-pine4/iw-pine4 Announced: 2000-10-30 Affects...

Cisco CDP attacks

Folks, when playing around with CDP, I discovered several interesting things. Due the leak of Cisco hardware around here, I ask you for your expiriences. Details as follows: Program: http://www.phenoelit.de/irpas/cdp.c Known effekts: -IOS 11.11: when flooding the cisco with random deviceID update...

HP KeyView multiple security vulnerabilities

Multiple vulnerabilities with potential code execution impact...

[ MDVSA-2015:200 ] mediawiki

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:200 http://www.mandriva.com/en/support/security/ Package : mediawiki Date : April 10, 2015 Affected: Business Server 1.0 Problem Description: Updated mediawiki packages fix security vulnerabilities: In...

[SECURITY] [DSA 3177-1] mod-gnutls security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3177-1 [email protected] http://www.debian.org/security/ Sebastien Delafond March 10, 2015 http://www.debian.org/security/faq -...

REWTERZ-20140101 - ManageEngine ServiceDesk SQL Injection Vulnerability

================================================================================ REWTERZ-20140101 - Rewterz - Security Advisory ================================================================================ Title: ManageEngine ServiceDesk SQL Injection Vulnerability Product: ServiceDesk Plus...

SEC Consult SA-20150113-1 :: Privilege Escalation & XSS & Missing Authentication in Ansible Tower

SEC Consult Vulnerability Lab Security Advisory 20150113-1 ======================================================================= title: Privilege Escalation & XSS & Missing Authentication product: Ansible Tower vulnerable version: =2.0.2 fixed version: =2.0.5 impact: high homepage:...

[SECURITY] [DSA 3107-1] subversion security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3107-1 [email protected] http://www.debian.org/security/ Florian Weimer December 20, 2014 http://www.debian.org/security/faq -...

APPLE-SA-2014-12-11-1 Safari 8.0.2, Safari 7.1.2, and Safari 6.2.2

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2014-12-11-1 Safari 8.0.2, Safari 7.1.2, and Safari 6.2.2 Safari 8.0.2, Safari 7.1.2, and Safari 6.2.2 are now available and include the security content of Safari 8.0.1, Safari 7.1.1, and Safari 6.2.1: https://support.apple.com/en-us/HT659...

[ MDVSA-2014:221 ] php-smarty

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:221 http://www.mandriva.com/en/support/security/ Package : php-smarty Date : November 21, 2014 Affected: Business Server 1.0 Problem Description: References: https://vulners.com/cve/CVE-2012-4437...

[ MDVSA-2014:200 ] bugzilla

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:200 http://www.mandriva.com/en/support/security/ Package : bugzilla Date : October 21, 2014 Affected: Business Server 1.0 Problem Description: Updated bugzilla packages fix security vulnerabilities: If a new...

Ultra Electronics / AEP Networks - SSL VPN (Netilla / Series A / Ultra Protect) Vulnerabilities

Ultra Electronics / AEP Networks - SSL VPN Netilla / Series A / Ultra Protect Vulnerabilities http://www.osisecurity.com.au/advisories/ultra-aep-netilla-vulnerabilities Release Date: 02-Oct-2014 Software: Ultra Electronics - Series A...

FreeBSD Security Advisory FreeBSD-SA-14:19.tcp

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-14:19.tcp Security Advisory The FreeBSD Project Topic: Denial of Service in TCP packet processing Category: core Module: inet Announced: 2014-09-16 Credits:...

[USN-2332-1] Linux kernel vulnerabilities

========================================================================== Ubuntu Security Notice USN-2332-1 September 02, 2014 linux vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

[USN-2316-1] Subversion vulnerabilities

========================================================================== Ubuntu Security Notice USN-2316-1 August 14, 2014 subversion vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives:...

XSS, FPD and RCE vulnerabilities in DZS Video Gallery for WordPress

Hello 3APA3A! These are Cross-Site Scripting, Full path disclosure and OS Commanding vulnerabilities in plugin DZS Video Gallery for WordPress. Earlier I've disclosed Content Spoofing and Cross-Site Scripting vulnerabilities in this plugin http://securityvulns.ru/docs30871.html...

CVE-2014-3524: Apache OpenOffice Calc Command Injection Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2014-3524 OpenOffice Calc Command Injection Vulnerability Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache OpenOffice 4.1.0 and older on Windows. OpenOffice.org versions may also be affected. Description: The...

[oss-security] CVE-2014-3940 - Linux kernel - missing check during hugepage migration

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The scope of CVE-2014-3940 is the https://lkml.org/lkml/2014/3/18/784 post, i.e., "PATCH RESEND -mm 1/2 mm: add !ptepresent check on existing hugetlbentry callbacks" on 18 March. Two notes about this: - Applying the https://lkml.org/lkml/2014/3/18/784...

[RT-SA-2014-005] SQL Injection in webEdition CMS File Browser Installer Script

Advisory: SQL Injection in webEdition CMS File Browser RedTeam Pentesting discovered an SQL injection vulnerability in the file browser component of webEdition CMS during a penetration test. Unauthenticated attackers can get read-only access on the SQL database used by webEdition and read for...

CVE-2014-5795 - Database Credentials Leak in Oracle Demantra

Vulnerability title: Database Credentials Leak in Oracle Demantra CVE: CVE-2014-5795 Vendor: Oracle Product: Demantra Affected version: 12.2.1 Fixed version: 12.2.3 Reported by: Oliver Gruskovnjak Details: Oracle Demantra version 12.2.1 has a backend function that allows anyone to retrieve the...

[USN-2172-1] CUPS vulnerability

========================================================================== Ubuntu Security Notice USN-2172-1 April 24, 2014 cups vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu...

SQL Injection in doorGets CMS

Advisory ID: HTB23197 Product: doorGets CMS Vendor: doorGets Vulnerable Versions: 5.2 and probably prior Tested Version: 5.2 Advisory Publication: January 15, 2014 without technical details Vendor Notification: January 15, 2014 Vendor Patch: January 15, 2014 Public Disclosure: February 5, 2014...

[SE-2013-01] Security vulnerabilities in Oracle Java Cloud Service

Hello All, Those concerned about security of Java PaaS Platform as a Service or cloud services in general might find the following information interesting. Security Explorations discovered multiple security vulnerabilities in the environment of Oracle 1 Java Cloud Service 2. Among a total of 28...

[USN-2049-1] Linux kernel vulnerabilities

========================================================================== Ubuntu Security Notice USN-2049-1 December 07, 2013 linux vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

[USN-2035-1] Ruby vulnerabilities

========================================================================== Ubuntu Security Notice USN-2035-1 November 27, 2013 ruby1.8, ruby1.9.1 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its...

Apple MacOSX 10.9 Hard Link Memory Corruption

Apple MacOSX 10.9 Hard Link Memory Corruption Date: 08.11.2013 http://cxsecurity.com/ http://cvemap.org/ URL: http://cxsecurity.com/issue/WLB-2013110059 - 0. Description --- In most UNIX-like systems a hard link to a directory is only reserved for the 'root' user when possible at all. In MacOSX...

Microsoft Windows multiple security vulnerabilities

GDI integer overflow, InformationCardSigninHelper ActiveX code execution, AFD driver information leak, X.509 certificates DoS, Hyper-V privilege escalation...

[ MDVSA-2013:246 ] openjpa

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:246 http://www.mandriva.com/en/support/security/ Package : openjpa Date : October 7, 2013 Affected: Business Server 1.0 Problem Description: Updated openjpa packages fix security vulnerability: The...

[SECURITY] [DSA 2695-1] chromium-browser security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2695-1 [email protected] http://www.debian.org/security/ Michael Gilbert May 29, 2013 http://www.debian.org/security/faq -...

Microsoft Office multiple security vulnerabilities

Multiple buffer overflows, integer overflows, memory corruptions, etc...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

[waraxe-2013-SA#098] - Directory Traversal Vulnerabilities in OpenCart 1.5.5.1

waraxe-2013-SA098 - Directory Traversal Vulnerabilities in OpenCart 1.5.5.1 =============================================================================== Author: Janek Vind "waraxe" Date: 19. March 2013 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-98.html Description of vulnerabl...