APPLE-SA-2012-03-07-1 iTunes 10.6

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2012-03-07-1 iTunes 10.6 iTunes 10.6 is now available and addresses the following: WebKit Available for: Windows 7, Vista, XP SP2 or later Impact: A man-in-the-middle attack while browsing the iTunes Store via iTunes may lead to an unexpected...

AllWebMenus < 1.1.9 WordPress Menu Plugin Arbitrary file upload

Exploit Title: AllWebMenus WordPress Menu Plugin Arbitrary file upload Version: 1.1.9 Date: 2012-01-19 Author: 6Scan http://6scan.com security team Software Link: http://wordpress.org/extend/plugins/allwebmenus-wordpress-menu-plugin/ Official fix: This advisory is released after the vendor was...

[security bulletin] HPSBPI02733 SSRT100646 rev.1 - Certain HP LaserJet Printers, Remote Unauthorized Access to Files

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03140700 Version: 1 HPSBPI02733 SSRT100646 rev.1 - Certain HP LaserJet Printers, Remote Unauthorized Access to Files NOTICE: The information in this Security Bulletin should be acted upon as soon...

TWSL2011-019: Cross-Site Scripting Vulnerability in phpMyAdmin

Trustwave's SpiderLabs Security Advisory TWSL2011-019: Cross-Site Scripting Vulnerability in phpMyAdmin https://www.trustwave.com/spiderlabs/advisories/TWSL2011-019.txt Published: 12/22/11 Version: 1.0 Vendor: phpMyAdmin http://www.phpmyadmin.net/ Product: phpMyAdmin Version affected: 3.4.8 and...

ZDI-11-348 : HP OpenView NNM nnmRptConfig.exe nameParams Remote Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-11-348 : HP OpenView NNM nnmRptConfig.exe nameParams Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-348 December 13, 2011 - -- CVE ID: CVE-2011-3165 - -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C - -- Affected...

Wordpress clickdesk-live-support-chat plugin Cross-Site Scripting Vulnerabilities

a bug in Wordpress clickdesk-live-support-chat plugin that allows to us to occur a Cross-Site Scripting on a Remote machin. Www.Aria-security.com/forum/ Wordpress clickdesk-live-support-chat plugin Cross-Site Scripting Vulnerabilities Download......:...

[security bulletin] HPSBMU02708 SSRT100633 rev.1 - HP Network Node Manager i (NNMi) for HP-UX, Linux, Solaris, and Windows, Remote Cross Site Scripting (XSS)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03035744 Version: 1 HPSBMU02708 SSRT100633 rev.1 - HP Network Node Manager i NNMi for HP-UX, Linux, Solaris, and Windows, Remote Cross Site Scripting XSS NOTICE: The information in this Security...

ZOHO ManageEngine ADSelfService Plus Administrative Access

ZOHO ManageEngine ADSelfService Plus Administrative Access ========================================================== ADVISORY INFORMATION Title: ZOHO ManageEngine ADSelfService Plus Administrative Access Release date: 10/10/2011 Last update: 10/10/2011 Credits: Roberto Paleari, Emaze Networks...

Security bypass vulnerability in MyBB

Hello 3APA3A! I want to warn you about security bypass vulnerability in MyBB, which allows to bypass protection against Brute Force and conduct Brute Force attacks. In August in my article Bypassing captchas and blocking at web sites http://websecurity.com.ua/5334/ I wrote about vulnerability in...

Studio Linea (prodotto.php?id) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability Studio Linea prodotto.php?id AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.studiolinea.com/ Persian Gulf 4 Ever! Dork : "Designed by Studio Linea srl" Exploite:...

Gopal Systems (products.php?cat_id) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability Gopal Systems products.php?catid AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.gopalsystems.com/ Persian Gulf 4 Ever! Dork : "Powered by: Gopal Systems."...

ZDI-11-229: Apple QuickTime RIFF fmt Chunk Parsing Remote Code Execution Vulnerability

ZDI-11-229: Apple QuickTime RIFF fmt Chunk Parsing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-229 June 29, 2011 -- CVE ID: CVE-2011-0209 -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P -- Affected Vendors: Apple -- Affected Products: Apple Quicktime --...

XSS vulnerability in TWiki < 5.0.2

Information ----------------------------------- Name : XSS vulnerability in TWiki Software : TWiki 5.0.1 and possibily below. Vendor Hompeage : http://twiki.org/ Vulnerability Type : Cross-Site Scripting Severity : High Researcher : Mesut Timur mesut at mavitunasecurity dot com Advisory Reference...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Microsoft Office multiple security vulnerabilities

Multiple memory corruptions in Excel and PowerPoint, unsafe DLL loading, memory corruption in Office Graphic...

VUPEN Security Research - Microsoft Internet Explorer Layouts Use-after-free Vulnerability (CVE-2011-0094)

VUPEN Security Research - Microsoft Internet Explorer Layouts Use-after-free Vulnerability CVE-2011-0094 http://www.vupen.com/english/research.php I. BACKGROUND --------------------- "Microsoft Internet Explorer is a web browser developed by Microsoft and included as part of the Microsoft Windows...

phplist: cross site request forgery (CSRF), CVE-2011-0748

phplist: cross site request forgery CSRF, CVE-2011-0748 References https://vulners.com/cve/CVE-2011-2748 http://int21.de/cve/CVE-2011-0748-phplist.html Description phplist is a mailing list software written in PHP. Up to version 2.10.12, it provided no protection against cross site request forger...

Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Multipoint Switch

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Multipoint Switch Advisory ID: cisco-sa-20110223-telepresence-ctms Revision 1.0 For Public Release 2011 February 23...

Re: PHP 5.3.5 grapheme_extract() NULL Pointer Dereference

On Wed, 16 Feb 2011 16:11:23 -0700 cxib wrote: Affected Software: - PHP 5.3.5 grapheme is neither part of PHP core, nor built-in PHP extension, therefore above is false as bug is not in PHP itself. People using PHP 5.3.5 but not using grapheme some distros like Debian and derrivatives offer this...

[MajorSecurity SA-081]Contao CMS 2.9.2 - Persistent Cross Site Scripting Issue

MajorSecurity SA-081Contao CMS 2.9.2 - Persistent Cross Site Scripting Issue Details ============= Product: Contao CMS 2.9.2 Security-Risk: moderated Remote-Exploit: yes Vendor-URL: http://www.contao.org/ Advisory-Status: published Credits ============= Discovered by: David Vieira-Kurz Affected...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

[USN-1017-1] MySQL vulnerabilities

=========================================================== Ubuntu Security Notice USN-1017-1 November 11, 2010 mysql-5.1, mysql-dfsg-5.0, mysql-dfsg-5.1 vulnerabilities CVE-2010-2008, CVE-2010-3677, CVE-2010-3678, CVE-2010-3679, CVE-2010-3680, CVE-2010-3681, CVE-2010-3682, CVE-2010-3683,...

R7-0037: SAP BusinessObjects Axis2 Default Admin Password

R7-0037: SAP BusinessObjects Axis2 Default Admin Password October 13th, 2010 Description: The SAP BusinessObjects product contains a module dswsbobje.war which deploys Axis2 with an administrator account which is configured with a static password. As a result, anyone with access to the Axis2 port...

[STANKOINFORMZASCHITA-10-01] Netbiter® webSCADA multiple vulnerabilities

STANKOINFORMZASCHITA-10-01 Netbiter® webSCADA – multiple vulnerabilities Authors: Eugene Salov [email protected], Andrej Komarov [email protected] Product: Netbiter® webSCADA CVSS v2 Base Score: 9.0 AV:N/AC:L/Au:R/C:C/I:C/A:C Impact Subscore: 10.0 Exploitability Subscore: 8.0 Availability of...

[ISecAuditors Security Advisories] SQL Injection and XSS in Motorito < v2.0 Ni 483

============================================= INTERNET SECURITY AUDITORS ALERT 2010-005 - Original release date: March 30th, 2010 - Last revised: September 23th, 2010 - Discovered by: Mario Diaz Caldera - Severity: 5.5/10 CVSS Base Score ============================================= I...

Security problems in Zenphoto version 1.3

We are continuing with the list of security vulnerabilities found in a number of web applications while testing our latest version of Acunetix WVS v7 . In this blog post, we will look into the details of a number of security problems discovered by Acunetix WVS in the popular web gallery applicati...

Mozilla Foundation Security Advisory 2010-61

Mozilla Foundation Security Advisory 2010-61 Title: UTF-7 XSS by overriding document charset using object type attribute Impact: High Announced: September 7, 2010 Reporter: David Huang, Collin Jackson Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 3.6.9 Firefox 3.5.12 Thunderbird 3.1...

XSS vulnerability in i-Web Suite

Vulnerability ID: HTB22544 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityiniwebsuite.html Product: i-Web Suite Vendor: immediaC world wide Inc http://www.immediac.com/ Vulnerable Version: Current at 27.07.2010 and Probably Prior Versions Vendor Notification: 27 July 2010 Vulnerabilit...

ZDI-10-133: Mozilla Firefox CSS font-face Remote Code Execution Vulnerability

ZDI-10-133: Mozilla Firefox CSS font-face Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-133 July 20, 2010 -- CVE ID: CVE-2010-2752 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: Mozilla Firefox -- Affected Products: Mozilla Firefox 3.6.x --...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Cisco Security Advisory: Vulnerabilities in Cisco Unified Contact Center Express

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Vulnerabilities in Cisco Unified Contact Center Express Advisory ID: cisco-sa-20100609-uccx Revision 1.0 For Public Release 2010 June 09 1600 UTC GMT +--------------------------------------------------------------------- Summa...

[security bulletin] HPSBMA02535 SSRT100029 rev.1 - HP Performance Manager, Remote Unauthorized Access, Cross Site Scripting (XSS), Denial of Service (DoS)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c02181353 Version: 1 HPSBMA02535 SSRT100029 rev.1 - HP Performance Manager, Remote Unauthorized Access, Cross Site Scripting XSS, Denial of Service DoS NOTICE: The information in this Security...

ZDI-10-033: Microsoft Internet Explorer TIME2 Behavior Remote Code Execution Vulnerability

ZDI-10-033: Microsoft Internet Explorer TIME2 Behavior Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-033 April 2, 2010 -- CVE ID: CVE-2010-0492 -- Affected Vendors: Microsoft -- Affected Products: Microsoft Internet Explorer -- TippingPointTM IPS Customer...

CVE-2010-0684: Apache ActiveMQ Persistent Cross-Site Scripting (XSS) Vulnerability

CVE-2010-0684: Apache ActiveMQ Persistent Cross-Site Scripting XSS Vulnerability ============================================================== Security Advisory 03.30.2010 I. BACKGROUND Apache ActiveMQ is the most popular and powerful open source messaging and Integration Patterns provider...

rPSA-2010-0018-1 bind bind-utils caching-nameserver

rPath Security Advisory: 2010-0018-1 Published: 2010-03-15 Products: rPath Appliance Platform Linux Service 1 rPath Appliance Platform Linux Service 2 rPath Linux 1 rPath Linux 2 Rating: Severe Exposure Level Classification: Remote User Deterministic Vulnerability Updated Versions:...

Microsoft Security Advisory (979267) Vulnerabilities in Adobe Flash Player 6 Provided in Windows XP Could Allow Remote Code Execution

Microsoft Security Advisory 979267 Vulnerabilities in Adobe Flash Player 6 Provided in Windows XP Could Allow Remote Code Execution Published: January 12, 2010 Version: 1.0 General Information Executive Summary Microsoft is aware of reports of vulnerabilities in Adobe Flash Player 6 provided in...

US-CERT Technical Cyber Security Alert TA10-012A -- Oracle Updates for Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA10-012A Oracle Updates for Multiple Vulnerabilities Original release date: Last revised: -- Source: US-CERT Systems Affected Oracle Database 11g, version 11.1.0.7 Oracle Database 10g Release...

[ MDVSA-2009:337 ] proftpd

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2009:337 http://www.mandriva.com/security/ Package : proftpd Date : December 22, 2009 Affected: 2008.0, 2009.0, 2009.1, 2010.0, Corporate 4.0, Enterprise Server 5.0 Problem Description: A vulnerability has been...

com_jumi / jumi 2.0.5 for joomla 1.5 backdoored

Summary: another backdoored joomla component yawn Application: Jumi, a joomla component About Jumi: Jumi is the set of custom code extensions for Joomla! 1.0.x and 1.5.x in their native modes. Since 2006 more then 200.000 downloads. With Jumi you can include php, html, javascript scripts into the...

3Com OfficeConnect Firewall/Router multiple remote Vulnerabilities

Product: 3Com OfficeConnect Firewall/Router Website: http://www.3com.com/ Discovered By: Andrea Fabrizi Email: [email protected] Web: http://www.andreafabrizi.it Vuln: remote command execution and password disclosure Admin password disclosure 1 SSH/Telnet to router using one of these hidde...

Microsoft Security Bulletin MS09-054 - Critical Cumulative Security Update for Internet Explorer (974455)

Microsoft Security Bulletin MS09-054 - Critical Cumulative Security Update for Internet Explorer 974455 Published: October 13, 2009 Version: 1.0 General Information Executive Summary This security update resolves three privately reported vulnerabilities and one publicly disclosed vulnerability in...

Virtualmin Multiple Vulnerabilities

Virtualmin Multiple Vulnerabilities by Filip Palian filip dot palian at pjwstk dot edu dot pl Software affected: Virtualmin 3.703 Description from the vendor site: "Virtualmin is the world's most powerful and flexible web server control panel. Manage your virtual domains, mailboxes, databases,...

Microsoft Security Bulletin MS09-029 - Critical Vulnerabilities in the Embedded OpenType Font Engine Could Allow Remote Code Execution (961371)

Microsoft Security Bulletin MS09-029 - Critical Vulnerabilities in the Embedded OpenType Font Engine Could Allow Remote Code Execution 961371 Published: July 14, 2009 Version: 1.0 General Information Executive Summary This security update resolves two privately reported vulnerabilities in a...

osTicket v1.6 RC4 Admin Login Blind SQLi

nGenuity Information Services - Security Advisory Advisory ID: NGENUITY-2009-007 osTicket Admin Login Blind SQL Injection Application: osTicket v1.6 RC4 Vendor: osTicket Vendor website: http://www.osticket.com Author: Adam Baldwin [email protected] I. BACKGROUND "osTicket is a widely-us...

[Full-disclosure] [ GLSA 200906-02 ] Ruby: Denial of Service

Gentoo Linux Security Advisory GLSA 200906-02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...

Microsoft Security Bulletin MS09-020 - Important Vulnerabilities in Internet Information Services (IIS) Could Allow Elevation of Privilege (970483)

Microsoft Security Bulletin MS09-020 - Important Vulnerabilities in Internet Information Services IIS Could Allow Elevation of Privilege 970483 Published: June 9, 2009 Version: 1.0 General Information Executive Summary This security update resolves one publicly disclosed vulnerability and one...

CORE-2009-0420 - Apple CUPS IPP_TAG_UNSUPPORTED Handling null pointer Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ Apple CUPS IPPTAGUNSUPPORTED Handling null pointer Vulnerability 1. Advisory Information Title: Apple CUPS IPPTAGUNSUPPORTED Handling null pointer Vulnerability...

ftpdmin v. 0.96 RNFR remote buffer overflow exploit

?php / ftpdmin v. 0.96 RNFR remote buffer overflow exploit xp sp3 / case study by Nine:Situations:Group::surfista software site: http://www.sentex.net/mwandel/ftpdmin/ our site: http://retrogod.altervista.org/ bug found by rgod in 2006, RNFR sequences can trigger a simple eip overwrite. We can us...

Q2 Solutions ConnX - SQL Injection Vulnerability

aushack.com - Vulnerability Advisory ----------------------------------------------- Release Date: 03-Apr-2009 Software: Q2 Solutions - ConnX http://www.q2solutions.com.au/ "ConnX is a ready built internet/intranet solution that empowers employees and management to view and update HR and Payroll...

Cisco Security Advisory: Cisco Unified Communications Manager IP Phone Personal Address Book Synchronizer Privilege Escalation Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco Unified Communications Manager IP Phone Personal Address Book Synchronizer Privilege Escalation Vulnerability Advisory ID: cisco-sa-20090311-cucmpab Revision 1.0 For Public Release 2009 March 11 1600 UTC GMT...