47153 matches found
[SECURITY] [DSA 2606-1] proftpd-dfsg security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2606-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst January 13, 2013 http://www.debian.org/security/faq -...
Cross-Site Scripting (XSS) vulnerability in Quick.Cms and Quick.Cart
Advisory ID: HTB23135 Product: Quick.Cms, Quick.Cart Vendor: OpenSolution team Vulnerable Versions: Quick.Cms 5.0, Quick.Cart 6.0 and probably prior Tested Version: Quick.Cms 5.0, Quick.Cart 6.0 Vendor Notification: December 19, 2012 Vendor Patch: December 20, 2012 Public Disclosure: January 9,...
Fwd: SQL injection
Product: FOOT Gestion Version: - Vendor: Winsoft Vendor site:http://www.footgestion.ch Status: fixed Level: High ========= Description ========= FOOT Gestion is a soccer team management CMS. The solution is based on a software and a CMS website. The website module is affected by a SQL injection...
SEC Consult SA-20121017-0 :: ModSecurity multipart/invalid part ruleset bypass
SEC Consult Vulnerability Lab Security Advisory 20121017-0 ======================================================================= title: ModSecurity multipart/invalid part ruleset bypass product: ModSecurity vulnerable version: = 2.6.8 fixed version: 2.7.0 CVE number: - impact: Depends what you...
[USN-1545-1] Nova vulnerability
========================================================================== Ubuntu Security Notice USN-1545-1 August 22, 2012 nova vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubunt...
traq-2.3.5_CSRF_XSS_SQL_INjeCTION_vulns
==================================================================== Vulnerable Software: traq-2.3.5 Official Site: TraqProject.org ==================================================================== About Software: Traq is a PHP powered project manager, capable of tracking issues for multiple...
ZDI-12-093 : (Pwn2Own) Microsoft Internet Explorer Fixed Table Colspan Remote Code Execution Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-093 : Pwn2Own Microsoft Internet Explorer Fixed Table Colspan Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-093 June 12, 2012 - -- CVE ID: CVE-2012-1876 - -- CVSS: 9, AV:N/AC:L/Au:N/C:P/I:P/A:C - --...
[waraxe-2012-SA#084] - Multiple Vulnerabilities in OpenCart 1.5.2.1
waraxe-2012-SA084 - Multiple Vulnerabilities in OpenCart 1.5.2.1 =============================================================================== Author: Janek Vind "waraxe" Date: 06. April 2012 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-84.html Description of vulnerable software:...
[waraxe-2012-SA#086] - Local File Inclusion in Invision Power Board 3.3.0
waraxe-2012-SA086 - Local File Inclusion in Invision Power Board 3.3.0 =============================================================================== Author: Janek Vind "waraxe" Date: 12. April 2012 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-86.html CVE:...
Minify and related plugins DOM-Based XSS Vulnerability
+-------------------------------------------------------------------------------------------+ Title : Minify and related plugins DOM-Based XSS Vulnerability Version : 2.1.3 & 2.1.4-Beta Credit : Ayoub Aboukir, Independent Security Researcher Contact : ay.aboukir at gmail d0t com Software Link :...
[SECURITY] [DSA 2443-1] linux-2.6 security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ---------------------------------------------------------------------- Debian Security Advisory DSA-2443-1 [email protected] http://www.debian.org/security/ Dann Frazier March 26, 2012 http://www.debian.org/security/faq -...
VMWare applications multiple security vulnerabilities
Privilege escalation, cross application scripting, information leakage, crossite scripting...
Endian UTM Firewall v2.4.x & v2.5.0 - Multiple Web Vulnerabilities
Title: ====== Endian UTM Firewall v2.4.x & v2.5.0 - Multiple Web Vulnerabilities Date: ===== 2012-03-01 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=228 VL-ID: ===== 228 Introduction: ============= Einfach, schnell und zukunftssicher! Die ideale Losung, um Ihre...
OpenKM 5.1.7 Privilege Escalation
COMPASS SECURITY ADVISORY http://www.csnc.ch/ ID: COMPASS-2012-001 Product: OpenKM Document Management System 5.1.7 1 Vendor: OpenKM http://www.openkm.com/ Subject: Privilege Escalation, Improper Access Control Risk: High Effect: Remotely exploitable Author: Cyrill Brunschwiler...
[ MDVSA-2011:178 ] glibc
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2011:178 http://www.mandriva.com/security/ Package : glibc Date : November 25, 2011 Affected: 2010.1, Enterprise Server 5.0 Problem Description: Multiple vulnerabilities was discovered and fixed in glibc: Multipl...
Cisco Security Advisory: Cisco TelePresence System Integrator C Series and Cisco TelePresence EX Series Device Default Root Account Manufacturing Error
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco TelePresence System Integrator C Series and Cisco TelePresence EX Series Device Default Root Account Manufacturing Error Advisory ID: cisco-sa-20111109-telepresence-c-ex-series Revision 1.0 For Public Release 2011 November 9 16:00 UTC GMT...
[ GLSA 201111-04 ] phpDocumentor: Function call injection
Gentoo Linux Security Advisory GLSA 201111-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...
Low severity flaw in various applications including KSSL, Rekonq, Arora, Psi IM
I recently discovered that various Qt applications including KSSL the KDE class library responsible for SSL negotiation, Rekonq, Arora and Psi IM are vulnerable to UI spoofing due to their use of QLabel objects to render externally controlled security critical information. The primary area of...
[SECURITY] [DSA 2289-1] typo3-src security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2289-1 [email protected] http://www.debian.org/security/ Florian Weimer August 07, 2011 http://www.debian.org/security/faq -...
Avon Groups (search_result.php?cid) Remote SQL injection Vulnerability
IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability Avon Groups searchresult.php?cid AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.avongroups.in/it/ Persian Gulf 4 Ever! Dork : "Powered By: Avon Enterprises Pvt. Ltd. "...
phpMyAdmin 3.x preg_replace RCE POC
I'm flooded with requests for a POC and many doubt that these vulnerabilities are exploitable. And since this vulnerability is rather technically interesting I believe many could learn from it. http://ha.xxor.se/2011/07/phpmyadmin-3x-pregreplace-rce-poc.html...
Arbitrary files deletion in HP OpenView Communication Broker
Luigi Auriemma Application: HP OpenView Communication Broker http://www8.hp.com/us/en/software/enterprise-software.html Versions: ovbbccb.exe = 11.0.43.0 Platforms: Windows, Linux, Solaris, HP-UX, AIX Bug: arbitrary files deletion Exploitation: remote, versus server Date: 27 Jun 2011 found 01 Jun...
Wordpress plugin BackWPup Remote and Local Code Execution Vulnerability - SOS-11-003
Sense of Security - Security Advisory - SOS-11-003 Release Date. 28-Mar-2011 Last Update. - Vendor Notification Date. 25-Mar-2011 Product. Wordpress Plugin BackWPup Platform. Independent Affected versions. 1.6.1 verified, possibly others Severity Rating. High Impact. System Access Attack Vector...
Novell Netware FTP server buffer overflow
rmdir/mkdir/dele commands buffer overflow...
ZDI-11-051: IBM Lotus Notes cai URI Handler Remote Code Execution Vulnerability
ZDI-11-051: IBM Lotus Notes cai URI Handler Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-051 February 7, 2011 - This vulnerability is being disclosed publicly without a patch in accordance with the ZDI 180 day deadline. To view mitigations for this...
vBulletin 4.1.2 0-day Denial Of Service Exploit
========================================= vBulletin 4.1.2 0-day Denial Of Service Exploit ========================================= The largest Exploit Database in the world ! 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 /' /' / /' 0 /, // ,/ / 1 // /' / // /' / /'...
[USN-1042-1] PHP vulnerabilities
=========================================================== Ubuntu Security Notice USN-1042-1 January 11, 2011 php5 vulnerabilities CVE-2009-5016, CVE-2010-3436, CVE-2010-3709, CVE-2010-3710, CVE-2010-3870, CVE-2010-4156, CVE-2010-4409, CVE-2010-4645...
Microsoft Security Bulletin MS10-088 - Important Vulnerabilities in Microsoft PowerPoint Could Allow Remote Code Execution (2293386)
Microsoft Security Bulletin MS10-088 - Important Vulnerabilities in Microsoft PowerPoint Could Allow Remote Code Execution 2293386 Published: November 09, 2010 Version: 1.0 General Information Executive Summary This security update resolves two privately reported vulnerabilities in Microsoft Offi...
[ MDVSA-2010:226 ] dhcp
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2010:226 http://www.mandriva.com/security/ Package : dhcp Date : November 10, 2010 Affected: 2009.1, 2010.0, 2010.1 Problem Description: A vulnerability was discovered and corrected in ISC dhcp: ISC DHCP server 4...
Security update available for Adobe Flash Player
Security update available for Adobe Flash Player Release date: November 4, 2010 Vulnerability identifier: APSB10-26 CVE number: CVE-2010-3636, CVE-2010-3637, CVE-2010-3638, CVE-2010-3639, CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646,...
[security bulletin] HPSBMA02584 SSRT100230 rev.1 - HP System Management Homepage (SMH) for Linux and Windows, Remote URL Redirection
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c02514953 Version: 1 HPSBMA02584 SSRT100230 rev.1 - HP System Management Homepage SMH for Linux and Windows, Remote URL Redirection NOTICE: The information in this Security Bulletin should be acte...
[SECURITY] [DSA 2097-2] New phpmyadmin packages fix several vulnerabilities
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-2097-2 [email protected] http://www.debian.org/security/ Thijs Kinkhorst September 11, 2010 http://www.debian.org/security/faq -...
CSRF, Information Leakage and Full path disclosure vulnerabilities in WordPress
Hello 3APA3A! I want to warn you about new security vulnerabilities in WordPress which I published at 30.07.2010 during my Day of bugs in WordPress 2 project. This is second advisory for this project. ------------------------------ Advisory: Day of bugs in WordPress 2: CSRF, Information Leakage a...
XSS vulnerability in Spitfire
Vulnerability ID: HTB22486 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinspitfire3.html Product: Spitfire Vendor: Claus Muus http://spitfire.clausmuus.de/ Vulnerable Version: 1.0.336 and Probably Prior Versions Vendor Notification: 08 July 2010 Vulnerability Type: XSS Cross Site...
Microsoft Security Bulletin MS10-027 - Critical Vulnerability in Windows Media Player Could Allow Remote Code Execution (979402)
Microsoft Security Bulletin MS10-027 - Critical Vulnerability in Windows Media Player Could Allow Remote Code Execution 979402 Published: April 13, 2010 Version: 1.0 General Information Executive Summary This security update resolves a privately reported vulnerability in Windows Media Player. The...
MKPortal Contact module XSS Vulnerability
========================================= MKPortal Contact module XSS Vulnerability ========================================= The largest Exploit Database in the world ! 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' /' / /' 0 0 /, // ,/ / 1 1 // /' / // /' / /'...
DynPG CMS Multiple Remote File Inclusion Vulnerability
fucking the Web Apps attack edition / / / / L /' / , / / /' , / /' /' / /' / / / / / / L / / / // // // ///////////L // ////// // // Hack0wn! Security Project / /&...
VUPEN Security - Adobe Shockwave Player Multiple Code Execution Vulnerabilities
VUPEN Vulnerability Research - Adobe Shockwave Player Multiple Code Execution Vulnerabilities I. BACKGROUND --------------------- "Over 450 million Internet-enabled desktops have installed Adobe Shockwave Player. These people now have access to some of the best the Web has to offer including...
Re: Cherokee Web Server 0.5.4 Denial Of Service
This attack should only work on the Windows version of Cherokee Web Server, as it references a DOS-style special device, AUX. This attack can also be launched through a browser as follows: http://www.example.com/AUX...
Microsoft Security Bulletin MS09-054 - Critical Cumulative Security Update for Internet Explorer (974455)
Microsoft Security Bulletin MS09-054 - Critical Cumulative Security Update for Internet Explorer 974455 Published: October 13, 2009 Version: 1.0 General Information Executive Summary This security update resolves three privately reported vulnerabilities and one publicly disclosed vulnerability in...
FreeBSD <= 6.1 kqueue() NULL pointer dereference
FreeBSD = 6.1 suffers from classical check/use race condition on SMP systems in kevent syscall, leading to kernel mode NULL pointer dereference. It can be triggered by spawning two threads: 1st thread looping on open and close syscalls, and the 2nd thread looping on kevent, trying to add possibly...
ZDI-09-059: Oracle Secure Backup Administration Server Multiple Command Injection Vulnerabilities
ZDI-09-059: Oracle Secure Backup Administration Server Multiple Command Injection Vulnerabilities http://www.zerodayinitiative.com/advisories/ZDI-09-059 -- CVE ID: CVE-2009-1978 -- Affected Vendors: Oracle -- Affected Products: Oracle Secure Backup -- Vulnerability Details: This vulnerability...
About the security content of Security Update 2009-003 / Mac OS X v10.5.8
About the security content of Security Update 2009-003 / Mac OS X v10.5.8 Last Modified: August 05, 2009 Article: HT3757 Summary This document describes the security content of Security Update 2009-003 / Mac OS X v10.5.8, which can be downloaded and installed via Software Update preferences, or...
wordpress plugins wp-Table v1.52 Remote File Inclusion Vulnerability
=========================================================================================== o wordpress plugins wp-Table v1.52 Remote File Inclusion Vulnerability Software : wp-Table v1.52 Vendor : http://wordpress.org/ Download : http://wordpress.org/extend/plugins/wp-table/wp-table.zip Author :...
Cisco WLC 4402 Denial-of-Service vulnerability
======================================= Vulnerable Product: Cisco WLC 4402 most likely among many others Vulnerability discovered: January 2009 Reported to vendor: Jan 01, 2009 Fix available: not yet ======================================= TIMELINE:...
[waraxe-2009-SA#074] - Multiple Vulnerabilities in TorrentTrader Classic 1.09
waraxe-2009-SA074 - Multiple Vulnerabilities in TorrentTrader Classic 1.09 =============================================================================== Author: Janek Vind "waraxe" Date: 15. June 2009 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-74.html Description of vulnerable...
(Post Form var 'username') BLIND SQLi exploit --S-CMS <= v-2.0 Beta3-->
!/usr/bin/perl ------------------------------------------------------------------------ Post Form var 'username' BLIND SQLi exploit --S-CMS = v-2.0 Beta3-- ------------------------------------------------------------------------ CMS INFORMATION: --WEB: http://www.matteoiammarrone.com/public/s-cms...
Syhunt: A-A-S (Application Access Server) Multiple Security Vulnerabilities
Syhunt: A-A-S Application Access Server Multiple Security Vulnerabilities Advisory-ID: 200905111 Discovery Date: 3.23.2009 Release Date: 5.11.2009 Affected Applications: A-A-S 2.0.48 and possibly older versions Class: XSRF Cross Site Request Forgery Arbitrary Command Execution, Undocumented Defau...
PostgreSQL DoS
Stack overflow on error message conversion...
[security bulletin] HPSBMA02390 SSRT071481 rev.1 - HP OpenView Performance Agent, HP Performance Agent, Remote Denial of Service (DoS)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c01621724 Version: 1 HPSBMA02390 SSRT071481 rev.1 - HP OpenView Performance Agent, HP Performance Agent, Remote Denial of Service DoS NOTICE: The information in this Security Bulletin should be...