47153 matches found
Tiki Wiki CMS Groupware <= 8.2 (snarf_ajax.php) Remote PHP Code Injection
------------------------------------------------------------------------- Tiki Wiki CMS Groupware = 8.2 snarfajax.php Remote PHP Code Injection ------------------------------------------------------------------------- author...........: Egidio Romano aka EgiX mail.............:...
Adobe Flash Player multiple security vulnerabilities
Multiple memory corruptions, buffer overflows, crossite data access...
pfSense invalid certificates issue
All certificates are issued with CA:true flag...
Novell Sentinel Log Manager <=1.2.0.1 Path Traversal
Vuln: Path Traversal Application: Sentinel Log Manager Vendor: Novell Version affected: = 1.2.0.1 Website: http://www.novell.com/products/sentinel-log-manager/ Discovered By: Andrea Fabrizi Email: [email protected] Web: http://www.andreafabrizi.it The latest version of Sentinel Log Manager...
[SECURITY] [DSA 2370-1] unbound security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2370-1 [email protected] http://www.debian.org/security/ Florian Weimer December 22, 2011 http://www.debian.org/security/faq -...
VUPEN Security Research - Adobe Flash Player "SAlign" Memory Corruption Vulnerability (CVE-2011-2459)
VUPEN Security Research - Adobe Flash Player "SAlign" Memory Corruption Vulnerability CVE-2011-2459 Website : http://www.vupen.com/english/research.php Twitter : http://twitter.com/vupen I. BACKGROUND --------------------- Adobe Flash Player is a cross-platform browser-based application runtime...
ZDI-11-354 : HP Managed Printing Administration jobDelivery Multiple Vulnerabilities
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-11-354 : HP Managed Printing Administration jobDelivery Multiple Vulnerabilities http://www.zerodayinitiative.com/advisories/ZDI-11-354 December 22, 2011 - -- CVE ID: CVE-2011-4168 - -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P - -- Affected Vendors:...
ZDI-11-353 : HP Managed Printing Administration MPAUploader.dll Remote Code Execution Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-11-353 : HP Managed Printing Administration MPAUploader.dll Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-353 December 22, 2011 - -- CVE ID: CVE-2011-4167 - -- CVSS: 9, AV:N/AC:L/Au:N/C:P/I:P/A:C - --...
Certificate Spoofing in Google Chrome for Android
Hello 3APA3A! I want to warn you about Certificate Spoofing in Google Chrome for Android. This vulnerability is low risk, but can be used by phishers for stealing certificates from legitimate sites for conducting phishing attacks. ------------------------- Affected products:...
Microsoft Windows win32k.sys memory corruption
Integer overflow on the frame with large height...
EMC RSA Adaptive Authentication (On-Premise) security vulnerabilities
Protection bypass is possible...
Websense multiple security vulnerabilities
Code execution, crossite scripting...
Multiple vulnerabilities in Browser CRM
Vulnerability ID: HTB23059 Reference: https://www.htbridge.ch/advisory/multiplevulnerabilitiesinbrowsercrm.html Product: Browser CRM Vendor: BrowserCRM Limited http://www.browsercrm.com Vulnerable Version: 5.100.01 and probably prior Tested Version: 5.100.01 Vendor Notification: 23 November 2011...
NGS00141 Patch Notification: Websense Triton 7.6 - Stored XSS in report management UI
High risk Vulnerability in Websense Triton 15 December 2011 Ben Williams of NGS Secure has discovered a High risk vulnerability in Websense Impact: Stored XSS Versions affected include: Websense Web Security Gateway Anywhere v7.6 Websense Web Security Gateway v7.6 Websense Web Security v7.6...
Adobe Acrobat / Reader multiple security vulnerabilities
Vulnerabilities are used in-the-wild for unauthorized access...
libxml library security vulnerabilities
Buffer overflow, unallocated memory reference...
JasPer library security vulnerabilities
Buffer overflow and memory corruption on JPEG2000 parsing...
0A29-11-4 : Privilege escalation vulnerabilities in Nagios XI installer < 2011R1.9
================ Privilege escalation vulnerabilities in Nagios XI installer 2011R1.9 Author: 0a29406d9794e4f9b30b3c5d6702c708 twitter.com/0a29 - 0a29.blogspot.com - GMail 0a2940 ================ Description: ================ Multiple privilege escalations exist within Nagios XI installer. Tested...
NGS00138 Patch Notification: Websense Triton 7.6 - Authentication bypass in report management UI
High Risk Vulnerability in Websense Triton 15 December 2011 Ben Williams of NGS Secure has discovered a High risk vulnerability in Websense Impact: Authentication bypass Versions affected include: Websense Web Security Gateway Anywhere v7.6 Websense Web Security Gateway v7.6 Websense Web Security...
bzip2 bzexe symbolic links vulnerability
Insecure temporary files creation...
Microsoft Windows multiple applications DLL hijacking
If application is launched via file type association, current path is set to the path file is located, making it's possible to place DLLs application tries to load dynamically into same directory...
libpurple / Pidgin DoS
Crash on SILC protocol parsing, crash on OSCAR parsing AIM, ICQ...
Secunia Research: Sterling Trader Data Processing Buffer Overflow Vulnerability
====================================================================== Secunia Research 13/12/2011 - Sterling Trader Data Processing Buffer Overflow Vulnerability - ====================================================================== Table of Contents Affected...
NGS00137 Patch Notification: Websense Triton 7.6 - Reflected XSS in report management UI
Medium Risk Vulnerability in Websense Triton 15 December 2011 Ben Williams of NGS Secure has discovered a Medium risk vulnerability in Websense Impact: Reflected XSS Versions affected include: Websense Web Security Gateway Anywhere v7.6 Websense Web Security Gateway v7.6 Websense Web Security v7....
Citrix Receiver, XenDesktop "Pass-the-hash" Attack
Tested against: Citrix XenDesktop, XenServer, Receiver 5.6 SP2 possibly other versions as well By default, the authentication between the Citrix Receiver client to the Web interface is not configured to use SSL. If a company elects not to use SSL for this, the XML transaction between the receiver...
Sterling Trader integer overflow
Interger overflow on network request parsing...
zFTPServer Suite 6.0.0.52 'rmdir' Directory Traversal
Advisory: zFTPServer Suite 6.0.0.52 'rmdir' Directory Traversal Advisory ID: INFOSERVE-ADV2011-09 Author: Stefan Schurtz Contact: [email protected] Affected Software: Successfully tested on zFTPServer Suite 6.0.0.52 Vendor URL: http://www.zftpserver.com/ Vendor Status: fixed CVE-ID:...
Seotoaster SQL-Injection Admin Login Bypass
Advisory: Seotoaster SQL-Injection Admin Login Bypass Advisory ID: INFOSERVE-ADV2011-06 Author: Stefan Schurtz Contact: [email protected] Affected Software: Successfully tested on Seotoaster v.1.9 Vendor URL: http://www.seotoaster.com/ Vendor Status: fixed ==========================...
PHP-SCMS 1.6.8 "lang" parameter XSS vulnerability
Advisory: PHP-SCMS 1.6.8 "lang" parameter XSS vulnerability Advisory ID: SSCHADV2011-035 Author: Stefan Schurtz Affected Software: Successfully tested on PHP-SCMS 1.6.8 Vendor URL: http://php-scms.sourceforge.net/ Vendor Status: unpatched no vendor feedback ========================== Vulnerabilit...
Nova unauthroized access
It's possible to overwrite files...
Restorepoint security vulnerabilities
Code execution, privileg escalation...
[USN-1308-1] bzip2 vulnerability
========================================================================== Ubuntu Security Notice USN-1308-1 December 14, 2011 bzip2 vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...
ESA-2011-039: RSA(r), The Security Division of EMC, announces security fixes and improvements for RSASecurID(r) Software Token 4.1 for Microsoft(r)Windows(r)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2011-039: RSA®, The Security Division of EMC, announces security fixes and improvements for RSASecurID® Software Token 4.1 for Microsoft®Windows® Advisories Updated December 12, 2011 Summary: RSA, The Security Division of EMC, announces security...
[ MDVSA-2011:183 ] pidgin
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2011:183 http://www.mandriva.com/security/ Package : pidgin Date : December 10, 2011 Affected: 2010.1, 2011., Enterprise Server 5.0 Problem Description: Multiple vulnerabilities has been discovered and corrected ...
[ MDVSA-2011:185 ] libcap
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2011:185 http://www.mandriva.com/security/ Package : libcap Date : December 12, 2011 Affected: 2010.1, 2011., Enterprise Server 5.0 Problem Description: A vulnerability has been discovered and corrected in libcap...
libcap protection bypass
chdir is not called after chroot...
Wordpress the-welcomizer plugin Cross-Site Scripting Vulnerabilities
a bug in Wordpress the-welcomizer plugin that allows to us to occur a Cross-Site Scripting on a Remote machin. Iran Hack Security Team & Islamic Republic Of Iran Security Team http://IranHack.Org & http://irist.ir/forum/ Wordpress the-welcomizer plugin Cross-Site Scripting Vulnerabilities...
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
zFTPServer irectory traversal
Directory traversal in rmdir command...
CS и XSS уязвимости в Zeema CMS
Здравствуйте 3APA3A! Сообщаю вам о найденных мною Content Spoofing и Cross-Site Scripting уязвимостях в системе Zeema CMS. Это украинская коммерческая CMS. Content Spoofing WASC-12: В связи с возможностью прямого обращения к скрипту http://site/counter/counter.php с подделкой параметра ref и...
[RT-SA-2011-005] Owl Intranet Engine: Authentication Bypass
Advisory: Owl Intranet Engine: Authentication Bypass During a penetration test, RedTeam Pentesting discovered an Authentication Bypass vulnerability in the Owl Intranet Engine, which allows unauthenticated users administrative access to the affected systems. Details ======= Product: Owl Intranet...
RedTeam Pentesting GmbH
Advisory: Owl Intranet Engine: Information Disclosure and Unsalted Password Hashes The Owl Intranet Engine uses no salting in the password hashing procedure. Furthermore, users in the "Administrators" group are able to see the MD5 password hashes of every user using the web interface. Details...
NGS00140 Patch Notification: Websense Triton 7.6 - Unauthenticated remote command execution as SYSTEM
Critical Vulnerability in Websense Triton 15 December 2011 Ben Williams of NGS Secure has discovered a Critical vulnerability in Websense Impact: Unauthenticated remote command execution as SYSTEM Versions affected include: Websense Web Security Gateway Anywhere v7.6 Websense Web Security Gateway...
ESA-2011-036: RSA, The Security Division of EMC, announces the release of a Security Fix for RSA(r) Adaptive Authentication (On-Premise)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2011-036: RSA, The Security Division of EMC, announces the release of a Security Fix for RSA® Adaptive Authentication On-Premise Advisories Updated December 6, 2011 Summary: An issue with RSA® Adaptive Authentication On-Premise was discovered whic...
BF, XSS, IAA и CSRF уязвимости в poMMo
Здравствуйте 3APA3A! Сообщаю вам о найденных мною Brute Force, Cross-Site Scripting, Insufficient Anti-automation и Cross-Site Request Forgery уязвимостях в poMMo. Brute Force WASC-11: http://site/pommo/index.php XSS WASC-08:...
[MATTA-2011-003] Restorepoint Remote root command execution vulnerability - CVE-2011-4201 CVE-2011-4202
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Matta Consulting - Matta Advisory https://www.trustmatta.com Restorepoint Remote root command execution vulnerability Advisory ID: MATTA-2011-003 CVE reference: CVE-2011-4201 - Code injection vulnerability CVE-2011-4202 - Privilege escalation through...
0A29-11-3 : Cross-Site Scripting vulnerabilities in Nagios XI < 2011R1.9
================ Cross-Site Scripting vulnerabilities in Nagios XI 2011R1.9 Author: 0a29406d9794e4f9b30b3c5d6702c708 twitter.com/0a29 - 0a29.blogspot.com - GMail 0a2940 ================ Description: ================ Multiple XSS vulnerabilities exist within Nagios XI. It is entirely likely this...
ZDI-11-348 : HP OpenView NNM nnmRptConfig.exe nameParams Remote Code Execution Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-11-348 : HP OpenView NNM nnmRptConfig.exe nameParams Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-348 December 13, 2011 - -- CVE ID: CVE-2011-3165 - -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C - -- Affected...