[ MDVSA-2012:009 ] perl

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2012:009 http://www.mandriva.com/security/ Package : perl Date : January 18, 2012 Affected: Enterprise Server 5.0 Problem Description: A vulnerability has been found and corrected in perl: Eval injection in the...

[SECURITY] [DSA 2355-1] clearsilver security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2355-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff November 30, 2011 http://www.debian.org/security/faq -...

Wordpress clickdesk-live-support-chat plugin Cross-Site Scripting Vulnerabilities

a bug in Wordpress clickdesk-live-support-chat plugin that allows to us to occur a Cross-Site Scripting on a Remote machin. Www.Aria-security.com/forum/ Wordpress clickdesk-live-support-chat plugin Cross-Site Scripting Vulnerabilities Download......:...

Valid tiny-erp <= 1.6 SQL Injection Vulnerability

Dear all, I have found a SQL injection vulnerability in Valid tiny-erp = 1.6. It seems to be version 1.6 as you can see in the 'project' section of www.valid.gr. Anyway there is not any specific number version in the sourceforge page. I reported the vulnerability to the vendor but no response as...

Mozilla Foundation Security Advisory 2011-52

Mozilla Foundation Security Advisory 2011-52 Title: Code execution via NoWaiverWrapper Impact: Critical Announced: November 8, 2011 Reporter: mozbugra4 Products: Firefox, Thunderbird Fixed in: Firefox 8.0 Thunderbird 8.0 Description Mozilla security researcher mozbugra4 reported that an internal...

[security bulletin] HPSBMU02716 SSRT100651 rev.1 - HP Data Protector Notebook Extension, Remote Execution of Arbitrary Code

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03058866Version: 1 HPSBMU02716 SSRT100651 rev.1 - HP Data Protector Notebook Extension, Remote Execution of Arbitrary Code NOTICE: The information in this Security Bulletin should be acted upon a...

ZDI-11-289 : Microsoft Internet Explorer swapNode Handling Remote Code,Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-11-289 : Microsoft Internet Explorer swapNode Handling Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-289 October 15, 2011 - -- CVE ID: CVE-2011-2000 - -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P - -- Affected...

XSS vulnerability in FortiMail Messaging Security Appliance

Advisory: XSS vulnerability in FortiMail Messaging Security Appliance Advisory ID: SSCHADV2011-011 Author: Stefan Schurtz Affected Software: v4.0,build0245,101208 MR1 Patch 2 Vendor URL: http://www.fortinet.com/ Vendor Status: informed ========================== Vulnerability Description:...

ph5gruppo (prodotto.php?id) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability ph5gruppo prodotto.php?id AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.ph5gruppo.it/ Persian Gulf 4 Ever! Dork : "Sito realizzato da ph5 gruppo" Exploite:...

APPLE-SA-2011-08-03-1 QuickTime 7.7

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2011-08-03-1 QuickTime 7.7 QuickTime 7.7 is now available and addresses the following: QuickTime Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Windows 7, Vista, XP SP2 or later Impact: Viewing a maliciously crafted pict file may...

Funnel Web (items.php?&cat_id) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability Funnel Web items.php?&catid AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.funnel-web.com.au/ Persian Gulf 4 Ever! Dork : "Web site design by Funnel Web" "inurl:items.ph...

Proofpoint Protection Server Cross-Site Scripting Vulnerability - SOS-11-005

Sense of Security - Security Advisory - SOS-11-005 Release Date. 03-May-2011 Last Update. - Vendor Notification Date. 28-Apr-2011 Product. Proofpoint Protection Server Platform. Appliance Affected versions. 5.5.5 verified, and possibly others Severity Rating. Medium Impact. Cookie/credential thef...

Mozilla Foundation Security Advisory 2011-12

Mozilla Foundation Security Advisory 2011-12 Title: Miscellaneous memory safety hazards rv:2.0.1/ 1.9.2.17/ 1.9.1.19 Impact: Critical Announced: April 28, 2011 Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 4.0.1 Firefox 3.6.17 Firefox 3.5.19 Thunderbird 3.1.10 SeaMonkey 2.0.14...

HTB22924: Arbitrary Command Execution in phpAlbum.net

Vulnerability ID: HTB22924 Reference: http://www.htbridge.ch/advisory/arbitrarycommandexecutioninphpalbumnet.html Product: phpAlbum.net Vendor: Patrik Jakab http://www.phpalbum.net/ Vulnerable Version: 0.4.1-14fix06 Vendor Notification: 31 March 2011 Vulnerability Type: Arbitrary Command Executio...

HTB22853: XSS vulnerability in Pragyan CMS

Vulnerability ID: HTB22853 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinpragyancms.html Product: Pragyan CMS Vendor: Pragyan Team http://sourceforge.net/projects/pragyan/ Vulnerable Version: v.3.0 beta Vendor Notification: 17 February 2011 Vulnerability Type: Stored XSS Cross Site...

http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-04

http://www.procheckup.com/vulnerabilitymanager/vulnerabilities/pr10-04 PR10-04 Directory traversal limited to file validation within Viva thumbs WordPress add-on Advisory publicly released: Tuesday, 21 December 2010 Vulnerability found: Thursday, 4 February 2010 Vendor informed: Monday, 8 Februar...

[USN-1015-1] libvpx vulnerability

=========================================================== Ubuntu Security Notice USN-1015-1 November 10, 2010 libvpx vulnerability CVE-2010-4203 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 10.10 This advisory also...

SQL injection vulnerability in e107

Vulnerability ID: HTB22604 Reference: http://www.htbridge.ch/advisory/sqlinjectionvulnerabilityine1072.html Product: e107 Website System Vendor: e107 http://www.e107.org/ Vulnerable Version: 0.7.23 and Probably Prior Versions Vendor Notification: 13 September 2010 Vulnerability Type: SQL Injectio...

ZDI-10-172: Mozilla Firefox tree Object Removal Remote Code Execution Vulnerability

ZDI-10-172: Mozilla Firefox tree Object Removal Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-172 September 13, 2010 -- CVE ID: CVE-2010-3168 -- CVSS: 9, AV:N/AC:L/Au:N/C:P/I:P/A:C -- Affected Vendors: Mozilla Firefox -- Affected Products: Mozilla Firefox...

SQL injection vulnerability in TCMS

Vulnerability ID: HTB22578 Reference: http://www.htbridge.ch/advisory/sqlinjectionvulnerabilityintcms4.html Product: TCMS Vendor: Target CMS http://targetcms.com/ Vulnerable Version: 100728 and Probably Prior Versions Vendor Notification: 09 August 2010 Vulnerability Type: SQL Injection Status: N...

Apple iTunes multiple security uvlnerabilities

Multiple memory corruptions on different media formats parsing, privilege escalations, code exeecution from network shares...

XSS vulnerability in pimcore

Vulnerability ID: HTB22562 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinpimcore.html Product: pimcore Vendor: elements.at New Media Solutions GmbH. http://www.pimcore.org/ Vulnerable Version: 1.1.0 and Probably Prior Versions Vendor Notification: 02 August 2010 Vulnerability Type:...

About the security content of Safari 5.0.1 and Safari 4.1.1

About the security content of Safari 5.0.1 and Safari 4.1.1 Last Modified: July 28, 2010 Article: HT4276 Summary This document describes the security content of Safari 5.0.1 and Safari 4.1.1. For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a...

ZDI-10-134: Mozilla Firefox DOM Attribute Cloning Remote Code Execution Vulnerability

ZDI-10-134: Mozilla Firefox DOM Attribute Cloning Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-134 July 20, 2010 -- CVE ID: CVE-2010-1208 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: Mozilla Firefox -- Affected Products: Mozilla Firefox...

ZDI-10-115: Adobe Flash Player AVM newFrameState Integer Overfow Remote Code Execution Vulnerability

ZDI-10-115: Adobe Flash Player AVM newFrameState Integer Overfow Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-115 June 25, 2010 -- CVE ID: CVE-2010-2160 -- Affected Vendors: Adobe -- Affected Products: Adobe Flash Player -- TippingPointTM IPS Customer...

GVI-2010-01 Multiple vulnerabilities in Kapitalist/capitalist

GVI-2010-01 : Multiple vulnerabilities in Kapitalist/capitalist Overview ----------- Quote from http://kapitalist.sourceforge.net/ "Kapitalist is a Monopoly®-like board game for 2-8 players. Walk around the board, buy properties, receive rent from your competitors, try to get monopolies to build...

VUPEN Security Research - Adobe Shockwave 3D Two Remote Code Execution Vulnerabilities (CVE-2010-1284)

VUPEN Security Research - Adobe Shockwave 3D Two Code Execution Vulnerabilities CVE-2010-1284 http://www.vupen.com/english/research.php I. BACKGROUND --------------------- "Over 450 million Internet-enabled desktops have installed Adobe Shockwave Player. These people now have access to some of th...

Bonsai Information Security - OS Command Injection in Cacti <= 0.8.7e

OS Command Injection in Cacti ============================= http://www.bonsai-sec.com/en/research/vulnerability.php ============================= 1. Advisory Information Advisory ID: BONSAI-2010-0105 Date published: 2010-04-21 Vendors contacted: Cacti Release mode: Coordinated release 2...

ZDI-10-057: Sun Java Runtime Environment JPEGImageDecoderImpl Remote Code Execution Vulnerability

ZDI-10-057: Sun Java Runtime Environment JPEGImageDecoderImpl Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-057 April 5, 2010 -- CVE ID: CVE-2010-0849 -- Affected Vendors: Sun Microsystems -- Affected Products: Sun Microsystems Java Runtime -- Vulnerabilit...

ZDI-10-033: Microsoft Internet Explorer TIME2 Behavior Remote Code Execution Vulnerability

ZDI-10-033: Microsoft Internet Explorer TIME2 Behavior Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-033 April 2, 2010 -- CVE ID: CVE-2010-0492 -- Affected Vendors: Microsoft -- Affected Products: Microsoft Internet Explorer -- TippingPointTM IPS Customer...

CVE-2010-0684: Apache ActiveMQ Persistent Cross-Site Scripting (XSS) Vulnerability

CVE-2010-0684: Apache ActiveMQ Persistent Cross-Site Scripting XSS Vulnerability ============================================================== Security Advisory 03.30.2010 I. BACKGROUND Apache ActiveMQ is the most popular and powerful open source messaging and Integration Patterns provider...

Cisco Security Advisory: Cisco Unified Communications Manager Denial of Service Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco Unified Communications Manager Denial of Service Vulnerabilities Advisory ID: cisco-sa-20100303-cucm Revision 1.0 For Public Release 2010 March 3 1600 UTC GMT...

[ MDVSA-2009:340 ] jpgraph

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2009:340 http://www.mandriva.com/security/ Package : jpgraph Date : December 26, 2009 Affected: Corporate 4.0, Enterprise Server 5.0 Problem Description: A vulnerability has been found and corrected in jpgraph:...

Kayako SupportSuite version 3.60.04

Product Kayako SupportSuite version 3.60.04 Url http://www.kayako.com/solutions/supportsuite/ Path Disclosure http://supportsite/rss/index.php?m=tickets&a=view&group=default Fatal error: view action is not registered in includesfunctions.php on line 754 P.S. Только если не давится вывод ошибок Cr...

Microsoft Windows Active Directory Federation Service multiple security vulnerabilities

Code execution, session hijack...

Microsoft Security Bulletin MS09-073 - Important Vulnerability in WordPad and Office Text Converters Could Allow Remote Code Execution (975539)

Microsoft Security Bulletin MS09-073 - Important Vulnerability in WordPad and Office Text Converters Could Allow Remote Code Execution 975539 Published: December 08, 2009 Version: 1.0 General Information Executive Summary This security update resolves a privately reported vulnerability in Microso...

AssetsSoSimple supplier_admin.php Supplier Field XSS

product: AssetsSoSimple version tested: 0.33 vendor URL: http://assetssosimple.sourceforge.net/ script: supplieradmin.php field: Supplier ooo BugsNotHugs Shared Vulnerability Disclosure Account...

PostgreSQL multiple security vulnerabilities

Denial of Service, privilege escalation, LDAP authentication bypass...

ZDI-09-052: CA Unicenter Software Delivery dtscore.dll Stack Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-052 August 7, 2009 -- Affected Vendors: Computer Associates -- Affected Products: Computer Associates Unicenter S

CA20090806-02: Security Notice for Unicenter Asset Portfolio Management, Unicenter Desktop and Server Management, Unicenter Patch Management Issued: August 6, 2009 CA's technical support is alerting customers to a security risk with Unicenter Asset Portfolio Management, Unicenter Desktop and Serv...

Mozilla Firefox / Seamonkey multiple security vulnerabilities

Memory corruption, same policy origin violation, crossite scripting...

Microsoft Security Bulletin MS09-010 - Critical Vulnerabilities in WordPad and Office Text Converters Could Allow Remote Code Execution (960477)

Microsoft Security Bulletin MS09-010 - Critical Vulnerabilities in WordPad and Office Text Converters Could Allow Remote Code Execution 960477 Published: April 14, 2009 Version: 1.0 General Information Executive Summary This security update resolves two publicly disclosed vulnerabilities and two...

[ECHO_ADV_102$2009] BusinessSpace <= 1.2 (id) Remote SQL Injection Vulnerability

ECHOADV102$2009 ----------------------------------------------------------------------------------------- ECHOADV102$2009 BusinessSpace = 1.2 id Remote SQL Injection Vulnerability ----------------------------------------------------------------------------------------- Author : M.Hasran Addahroni...

OpenSSL / ntp / bind / boinc certificate validation cryptographic vulnerabilities

Multiple vulnerabilities in SSL/TLS DSA/ECDSA certificate chain validations...

Secunia Research: Calendarix Basic Two SQL Injection Vulnerabilities

====================================================================== Secunia Research 25/08/2008 - Calendarix Basic Two SQL Injection Vulnerabilities - ====================================================================== Table of Contents Affected...

[USN-612-1] OpenSSL vulnerability

=========================================================== Ubuntu Security Notice USN-612-1 May 13, 2008 openssl vulnerability CVE-2008-0166 =========================================================== A weakness has been discovered in the random number generator used by OpenSSL on Debian and...

Microsoft Security Bulletin MS08-020 – Important Vulnerability in DNS Client Could Allow Spoofing (945553)

Microsoft Security Bulletin MS08-020 – Important Vulnerability in DNS Client Could Allow Spoofing 945553 Published: April 8, 2008 Version: 1.0 General Information Executive Summary This security update resolves a privately reported vulnerability. This spoofing vulnerability exists in Windows DNS...

Mozilla Foundation Security Advisory 2008-06

Mozilla Foundation Security Advisory 2008-06 Title: Web browsing history and forward navigation stealing Impact: Critical Announced: February 7, 2008 Reporter: David Bloom Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 2.0.0.12 SeaMonkey 1.1.8 Description Mozilla contributor David...

Syhunt: HFS (HTTP File Server) Template Cross-Site Scripting and Information Disclosure Vulnerabilities

Syhunt: HFS HTTP File Server Template Cross-Site Scripting and Information Disclosure Vulnerabilities Advisory-ID: 200801161 Discovery Date: 1.16.2008 Release Date: 1.23.2008 Affected Applications: HFS 2.0 to and including 2.3Beta Build 174 Non-Affected Applications: HFS 1.6a and earlier versions...

[SECURITY] [DSA 1449-1] New loop-aes-utils packages fix programming error

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1449-1 [email protected] http://www.debian.org/security/ Steve Kemp January 05, 2008 http://www.debian.org/security/faq -...

rPSA-2007-0242-1 php5 php5-cgi php5-mysql php5-pear php5-pgsql php5-soap php5-xsl

rPath Security Advisory: 2007-0242-1 Published: 2007-11-19 Products: rPath Appliance Platform Linux Service 1 rPath Linux 1 Rating: Minor Exposure Level Classification: Remote Deterministic Denial of Service Updated Versions: php5=conary.rpath.com@rpl:1/5.2.5-1-1...