libzip library / PHP DoS

NULL pointer dereference in zipnamelocate...

PHPShop 0.8.1 <= | Cross Site Scripting Vulnerability

======================================== PHPShop 0.8.1 = | Cross Site Scripting Vulnerability ======================================== 1. OVERVIEW The PHPShop 0.8.1 and lower versions are currently vulnerable to Cross Site Scripting. 2. BACKGROUND PHPShop is a PHP-powered shopping cart applicatio...

ZDI-11-051: IBM Lotus Notes cai URI Handler Remote Code Execution Vulnerability

ZDI-11-051: IBM Lotus Notes cai URI Handler Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-051 February 7, 2011 - This vulnerability is being disclosed publicly without a patch in accordance with the ZDI 180 day deadline. To view mitigations for this...

HTB22810: SQL Injection in ReOS

Vulnerability ID: HTB22810 Reference: http://www.htbridge.ch/advisory/sqlinjectioninreos3.html Product: ReOS Vendor: IT ELAZOS S.L. http://reos.elazos.com/ Vulnerable Version: 2.0.5 Vendor Notification: 20 January 2011 Vulnerability Type: SQL Injection Risk level: High Credit: High-Tech Bridge SA...

GNU libc/regcomp(3) Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 GNU libc/regcomp3 Multiple Vulnerabilities Author: Maksymilian Arciemowicz http://securityreason.com/ http://cxib.net/ Date: - - Dis.: 01.10.2010 - - Pub.: 07.01.2011 CERT: VU912279 CVE: CVE-2010-4051 CVE-2010-4052 Affected tested: - - Ubuntu 10.10 - ...

XSS vulnerability in Frog CMS

Vulnerability ID: HTB22682 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinfrogcms.html Product: Frog CMS Vendor: Philippe Archambault http://www.madebyfrog.com/ Vulnerable Version: 0.9.5 and probably prior versions Vendor Notification: 09 November 2010 Vulnerability Type: Stored XSS...

[USN-1015-1] libvpx vulnerability

=========================================================== Ubuntu Security Notice USN-1015-1 November 10, 2010 libvpx vulnerability CVE-2010-4203 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 10.10 This advisory also...

Mozilla Foundation Security Advisory 2010-70

Mozilla Foundation Security Advisory 2010-70 Title: SSL wildcard certificate matching IP addresses Impact: Moderate Announced: October 19, 2010 Reporter: Richard Moore Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 3.6.11 Firefox 3.5.14 Thunderbird 3.1.5 Thunderbird 3.0.9 SeaMonkey...

XSS vulnerability in GetSimple CMS

Vulnerability ID: HTB22609 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityingetsimplecms1.html Product: GetSimple CMS Vendor: Cagintranet Networks http://get-simple.info/ Vulnerable Version: 2.01 and Probably Prior Versions Vendor Notification: 15 September 2010 Vulnerability Type:...

[SECURITY] [DSA 2097-2] New phpmyadmin packages fix several vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-2097-2 [email protected] http://www.debian.org/security/ Thijs Kinkhorst September 11, 2010 http://www.debian.org/security/faq -...

Mozilla Foundation Security Advisory 2010-58

Mozilla Foundation Security Advisory 2010-58 Title: Crash on Mac using fuzzed font in data: URL Impact: Critical Announced: September 7, 2010 Reporter: Marc Schoenefeld Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 3.6.9 Firefox 3.5.12 Thunderbird 3.1.3 Thunderbird 3.0.7 SeaMonkey...

Microsoft Security Bulletin MS10-048 - Important Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (2160329)

Microsoft Security Bulletin MS10-048 - Important Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege 2160329 Published: August 10, 2010 Version: 1.0 General Information Executive Summary This security update resolves one publicly disclosed and four privately reported...

About the security content of Safari 5.0.1 and Safari 4.1.1

About the security content of Safari 5.0.1 and Safari 4.1.1 Last Modified: July 28, 2010 Article: HT4276 Summary This document describes the security content of Safari 5.0.1 and Safari 4.1.1. For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a...

[ MDVSA-2010:132 ] python

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2010:132 http://www.mandriva.com/security/ Package : python Date : July 14, 2010 Affected: 2008.0, 2009.0, 2009.1, 2010.0, 2010.1, Corporate 4.0, Enterprise Server 5.0 Problem Description: Multiple vulnerabilitie...

[SECURITY] CVE-2010-2227: Apache Tomcat Remote Denial Of Service and Information Disclosure Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2010-2227: Apache Tomcat Remote Denial Of Service and Information Disclosure Vulnerability Severity: Important Vendor: The Apache Software Foundation Versions Affected: Tomcat 5.5.0 to 5.5.29 Tomcat 6.0.0 to 6.0.27 Tomcat 7.0.0 Note: 7.0.0 is stil...

Microsoft Security Bulletin MS10-041 - Important Vulnerability in Microsoft .NET Framework Could Allow Tampering (981343)

Microsoft Security Bulletin MS10-041 - Important Vulnerability in Microsoft .NET Framework Could Allow Tampering 981343 Published: June 08, 2010 Version: 1.0 General Information Executive Summary This security update resolves a publicly disclosed vulnerability in Microsoft .NET Framework. The...

[security bulletin] HPSBMA02535 SSRT100029 rev.1 - HP Performance Manager, Remote Unauthorized Access, Cross Site Scripting (XSS), Denial of Service (DoS)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c02181353 Version: 1 HPSBMA02535 SSRT100029 rev.1 - HP Performance Manager, Remote Unauthorized Access, Cross Site Scripting XSS, Denial of Service DoS NOTICE: The information in this Security...

Secunia Research: Pulse CMS Cross-Site Request Forgery

====================================================================== Secunia Research 08/04/2010 - Pulse CMS Cross-Site Request Forgery - ====================================================================== Table of Contents Affected Software......................................................

AneCMS Multiple Vulnerabilities

www.BugReport.ir AmnPardaz Security Research Team Title: AneCMS Multiple Vulnerabilities Vendor: http://anecms.com/ Vulnerable Version: 1.0 Latest version till now Exploitation: Remote with a RAW HTTP packet sender Fix: N/A - Description: AneCMS is a small and fast CMS completely modular. Written...

Secunia Research: VMWare VMnc Codec HexTile Encoding Buffer Overflow

====================================================================== Secunia Research 09/04/2009 - VMWare VMnc Codec HexTile Encoding Buffer Overflow - ====================================================================== Table of Contents Affected...

[SECURITY] [DSA-2018-1] New php5 packages fix null pointer dereference

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-2018-1 [email protected] http://www.debian.org/security/ Raphael Geissert March 18, 2010 http://www.debian.org/security/faq -...

Microsoft Security Bulletin MS10-017 - Important Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution (980150)

Microsoft Security Bulletin MS10-017 - Important Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution 980150 Published: March 09, 2010 Version: 1.0 General Information Executive Summary This security update resolves seven privately reported vulnerabilities in Microsoft Offi...

CORE-2009-0625: Internet Explorer Dynamic OBJECT tag and URLMON sniffing vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ Internet Explorer Dynamic OBJECT tag and URLMON sniffing vulnerabilities 1. Advisory Information Title: Internet Explorer Dynamic OBJECT tag and URLMON sniffing...

[SECURITY] CVE-2009-2902 Apache Tomcat unexpected file deletion in work directory

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2009-3548: Apache Tomcat unexpected file deletion and/or alteration Severity: Low Vendor: The Apache Software Foundation Versions Affected: Tomcat 5.5.0 to 5.5.28 Tomcat 6.0.0 to 6.0.20 The unsupported Tomcat 3.x, 4.x and 5.0.x versions may be als...

[ MDVSA-2009:344 ] perl-DBD-Pg

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2009:344 http://www.mandriva.com/security/ Package : perl-DBD-Pg Date : December 28, 2009 Affected: 2008.0 Problem Description: Multiple vulnerabilities was discovered and corrected in perl-DBD-Pg: Heap-based...

Apache Tomcat for Windows backdoor account

admin account with empty password is created during installation...

Cisco Unified Communications Manager / Cisco Unified Presence DoS

Multiple Denial of Service conditions on SIP and Skinny processing...

Microsoft Security Bulletin MS09-055 - Critical Cumulative Security Update of ActiveX Kill Bits (973525)

Microsoft Security Bulletin MS09-060 - Critical Vulnerabilities in Microsoft Active Template Library ATL ActiveX Controls for Microsoft Office Could Allow Remote Code Execution 973965 Published: October 13, 2009 Version: 1.0 General Information Executive Summary This security update resolves...

FreeBSD <= 6.1 kqueue() NULL pointer dereference

FreeBSD = 6.1 suffers from classical check/use race condition on SMP systems in kevent syscall, leading to kernel mode NULL pointer dereference. It can be triggered by spawning two threads: 1st thread looping on open and close syscalls, and the 2nd thread looping on kevent, trying to add possibly...

Mozilla Firefox, Thunderbird, SeaMonkey, NSS multiple security vulnerabilities

Certificate spoofing, buffer overflow, code execution...

About the security content of Security Update 2009-003 / Mac OS X v10.5.8

About the security content of Security Update 2009-003 / Mac OS X v10.5.8 Last Modified: August 05, 2009 Article: HT3757 Summary This document describes the security content of Security Update 2009-003 / Mac OS X v10.5.8, which can be downloaded and installed via Software Update preferences, or...

(GET var 'id') BLIND SQL INJECTION EXPLOIT --Dog Pedigree Online Database v1.0.1-Beta -->

!/usr/bin/perl ------------------------------------------------------------------------------------------ GET var 'id' BLIND SQL INJECTION EXPLOIT --Dog Pedigree Online Database v1.0.1-Beta -- ------------------------------------------------------------------------------------------ CMS...

Cisco Wireless LAN Controller multiple security vulnerabilities

Multiple DoS conditions, privilege escalation...

Joomla component beamospetition 1.0.12 Sql Injection

Joomla component beamospetition 1.0.12 Sql Injection / Xss Author : vdss Dork : "Powered by beamospetition 1.0.12" Dl : http://joomlacode.org/gf/project/beamospetition/ Xss : http://site/?option=combeamospetition&func=sign&pet='scriptalert'Xss'/script Sql Injection :...

DMXReady Blog Manager (SQL/XSS)

--------------------------------------------------------- Portal Name: DMXReady Blog Manager SQL/XSS Vendor : http://www.galaxyscripts.com Author : PouyaServer , [email protected] Aria-Security.Net Vulnerability : SQL/XSS --------------------------------------------------------- SQL:...

Two XSS Flaws in PrestaShop 1.1.0.3

Affects PrestaShop 1.1.0.3 product: homepage: http://prestashop.com This is XSS in the URI of PrestaShop. Trust no one, not even your $SERVERPHPSELF . http://10.1.1.155/prestashop1.1.0.3/admin/login.php/223Cscript3Ealert13C/script3E Add an item to the shoping cart and then vist this url:...

[security bulletin] HPSBMA02388 SSRT080059 rev.1 - HP OpenView Network Node Manager (OV NNM), Remote Cross Site Scripting (XSS)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c01607570 Version: 1 HPSBMA02388 SSRT080059 rev.1 - HP OpenView Network Node Manager OV NNM, Remote Cross Site Scripting XSS NOTICE: The information in this Security Bulletin should be acted upon ...

Remote and Local File Inclusion Vulnerability <= 1.1 Rportal

RPortal v1.1 Rportal is a management system of contents simple and powerful Web, enabling you to create your site in a few minutes, while profiting from a complete and effective administration. Remote and Local File Inclusion Vulnerability = 1.1 Found the 29th September 2008 Author: Kad mail :...

CS-Cart <= 1.3.5 SQL Injection

GulfTech Security Research September 02, 2008 Vendor : CS-Cart.com URL : http://www.cs-cart.com/ Version : CS-Cart = 1.3.5 Risk : SQL Injection Description: CS-Cart Cart is a full featured online ecommerce application written in php that allows users to build, run and promote an online store. The...

Exploit for vBulletin "obscure" XSS (3.7.1 & 3.6.10)

====================================================================== Advisory : Exploit for vBulletin "obscure" XSS Release Date : June 13th 2008 Application : vBulletin Version : vBulletin 3.7.1 and lower, vBulletin 3.6.10 and lower Platform : PHP Vendor URL : http://www.vbulletin.com/ Authors...

[SECURITY] [DSA 1597-1] New mt-daapd packages fix several vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1597-1 [email protected] http://www.debian.org/security/ Devin Carraway June 12, 2008 http://www.debian.org/security/faq -...

blur6ex-0.3.462 LOCAL FILE INCLUSION Vulnerbility

..:::::blur6ex-0.3.462 LOCAL FILE INCLUSION Vulnerbility ::::... Virangar Security Team www.virangar.net -------- Discoverd By :Virangar Security Team hadihadi special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra & all virangar members & all iranian hackerz greetz:to my best friend in the world...

ZDI-08-022: Apple Safari WebKit PCRE Handling Integer Overflow Vulnerability

ZDI-08-022: Apple Safari WebKit PCRE Handling Integer Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-08-022 April 16, 2008 -- CVE ID: CVE-2008-1026 -- Affected Vendors: Apple -- Affected Products: Apple Safari -- TippingPointTM IPS Customer Protection: TippingPoint IPS...

[NEWS] Websphere MQ MCAUSER Setting Bypass Vulnerability

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

IBM Rational ClearQuest Web Multiple XSS Vulnerabilities

IBM Rational ClearQuest Web Multiple XSS CVE-2007-4592 Discovered on 07-24-07 by sasquatch of SecureState - www.securestate.com Multiple cross site scripting vulnerabilities exist within IBM's Rational ClearQuest Web interface. VULNERABLE VARIABLES: ===================== contextid query string...

Mozilla Foundation Security Advisory 2008-06

Mozilla Foundation Security Advisory 2008-06 Title: Web browsing history and forward navigation stealing Impact: Critical Announced: February 7, 2008 Reporter: David Bloom Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 2.0.0.12 SeaMonkey 1.1.8 Description Mozilla contributor David...

[Full-disclosure] iDefense Security Advisory 02.04.08: Hewlett-Packard Network Node Manager Topology Manager Service DoS Vulnerability

iDefense Security Advisory 02.04.08 http://labs.idefense.com/intelligence/vulnerabilities/ Feb 04, 2008 I. BACKGROUND HP Network Node Manager is a network mapping and management application that allows administrators to monitor and control their networks. The ovtopmd process listens, in a default...

[Full-disclosure] TPTI-07-21: Adobe Flash Player JPG Processing Heap Overflow Vulnerability

TPTI-07-21: Adobe Flash Player JPG Processing Heap Overflow Vulnerability http://dvlabs.tippingpoint.com/advisory/TPTI-07-21 December 19, 2007 -- CVE ID: CVE-2007-6242 -- Affected Vendor: Adobe -- Affected Products: Flash Player -- TippingPointTM IPS Customer Protection: TippingPoint IPS customer...

Re: PHP-Nuke NSN Script Depository module <= 1.0.3 Remote Source / DB Credentials Disclosure

sorry, i've made a mistake! only the versions = 1.0.0 are veulnerable!...

rPSA-2007-0242-1 php5 php5-cgi php5-mysql php5-pear php5-pgsql php5-soap php5-xsl

rPath Security Advisory: 2007-0242-1 Published: 2007-11-19 Products: rPath Appliance Platform Linux Service 1 rPath Linux 1 Rating: Minor Exposure Level Classification: Remote Deterministic Denial of Service Updated Versions: php5=conary.rpath.com@rpl:1/5.2.5-1-1...