[CVE-2011-2712] Apache Wicket XSS vulnerability

Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Wicket 1.4.x Apache Wicket 1.3.x and 1.5-RCx are not affected Description: With multi window support application configuration and special query parameters it is possible to execute any kind of JavaScript on a si...

Nafis Group (review.php?ID) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability Nafis Group review.php?ID AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Persian Gulf 4 Ever! Dork : "Powered by : Nafis Group" Exploite: www.victim.com/review.php?ID=SQL SpeCial TanX To :...

EMC AutoStart multiple buffer overflows

Multiple buffer overflows on network requests parsing...

[slackware-security] php (SSA:2011-237-01)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 slackware-security php SSA:2011-237-01 New php packages are available for Slackware 11.0, 12.0, 12.1, 12.2, 13.0, 13.1, 13.37, and -current to fix security issues. Here are the details from the Slackware 13.37 ChangeLog: +--------------------------+...

BUZLAB (prodotti.php?idCategoria) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability BUZLAB prodotti.php?idCategoria AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.buzlab.com/ Persian Gulf 4 Ever! Dork : "Produced by BUZLAB"...

CreatiWeb Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability CreatiWeb AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.crweb.it/ Persian Gulf 4 Ever! Dork : "Powered by CreatiWeb" "inurl:dettaglionews.php?id=" Exploite:...

HTTPKiller - (Global HTTP DoS)

Connection Keep-Alive + Pipelining + Close the connection before the response + Something... = DoS Apache, IIS, Squid, NetCache, What else?...

Spherica Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability Spherica AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.spherica.it/ Persian Gulf 4 Ever! Dork : "powered by spherica" "inurl:prodotto.php?idcatalogo=" Exploite:...

[PT-2011-23] Database information disclosure in GLPI

---------------------------------------------------------------------- PT-2011-23 Positive Technologies Security Advisory Database information disclosure in GLPI ---------------------------------------------------------------------- --- Vulnerable software GLPI Version 0.80.1 and earlier...

B-Keen communication (dettaglio_news.php&id) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability B-Keen communication dettaglionews.php&id AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.b-keen.it/ Persian Gulf 4 Ever! Dork : "Powered by B-Keen communication"...

Foresta Creativa (prodotti.php?idCategoria) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability Foresta Creativa prodotti.php?idCategoria AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.forestacreativa.com/ Persian Gulf 4 Ever! Dork : "Powered by Foresta Creativa"...

[PT-2011-23] Database information disclosure in GLPI

---------------------------------------------------------------------- PT-2011-23 Positive Technologies Security Advisory Database information disclosure in GLPI ---------------------------------------------------------------------- --- Vulnerable software GLPI Version 0.80.1 and earlier...

Web Art Studio (prodotto.php?lang) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability Web Art Studio prodotto.php?lang AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.was.it/ Persian Gulf 4 Ever! Dork : "Web Art Studio Web Agency" "inurl:prodotto.php?lang=...

NGS00054 Technical Advisory: : Lumension Device Control (formerly Sanctuary) remote memory corruption

======= Summary ======= Name: Lumension Device Control formerly Sanctuary remote memory corruption Release Date: 24 August 2011 Reference: NGS00054 Discoverer: Andy Davis [email protected] Vendor: Lumension Vendor Reference: Systems Affected: Lumension Device Control v4.4 SR6 Risk: High...

ZDI-11-275: EMC Autostart ftAgent Opcode 0x11 Parsing Remote Code Execution Vulnerability

ZDI-11-275: EMC Autostart ftAgent Opcode 0x11 Parsing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-275 August 23, 2011 -- CVE ID: CVE-2011-2735 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: EMC -- Affected Products: EMC AutoStart --...

Concrete CMS 5.4.1.1 <= Cross Site Scripting

Concrete CMS 5.4.1.1 = Cross Site Scripting 1. OVERVIEW Concrete CMS 5.4.1.1 and lower versions are vulnerable to Cross Site Scripting. 2. BACKGROUND Concrete5 makes running a website easy. Go to any page in your site, and a editing toolbar gives you all the controls you need to update your...

ZDI-11-273: EMC Autostart Domain Name Logging Remote Code Execution Vulnerability

ZDI-11-273: EMC Autostart Domain Name Logging Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-273 August 23, 2011 -- CVE ID: CVE-2011-2735 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: EMC -- Affected Products: EMC AutoStart -- TippingPointTM...

ZDI-11-274: EMC Autostart ftAgent Opcode 0x140 Parsing Remote Code Execution Vulnerability

ZDI-11-274: EMC Autostart ftAgent Opcode 0x140 Parsing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-274 August 23, 2011 -- CVE ID: CVE-2011-2735 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: EMC -- Affected Products: EMC AutoStart --...

[USN-1196-1] eCryptfs vulnerability

========================================================================== Ubuntu Security Notice USN-1196-1 August 23, 2011 ecryptfs-utils vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivative...

FLV Player flash application multiple security vulnerabilities

Content spoofing, crossite scripting...

Уязвимости в FLV Player

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Content Spoofing и Cross-Site Scripting уязвимостях в флеш видео плеере FLV Player. Content Spoofing WASC-12: Флешки плеера FLV Player принимают произвольные адреса в параметре configxml, что позволяет подделать содержимое флешки - например, указа...

eCryptfs multiple security vulnerabilities

Privilege escalation, information leakage...

ESA-2011-025: Multiple buffer overflow vulnerabilities in EMC AutoStart

ESA-2011-025.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2011-025: Multiple buffer overflow vulnerabilities in EMC AutoStart EMC Identifier: ESA-2011-025 CVE Identifier: CVE-2011-2735 Severity Rating: CVSS v2 Base Score: 7.9 AV:A/AC:M/Au:N/C:C/I:C/A:C Affected products: EMC AutoStart...

Mozilla Fireox / Seamonkey / Thunderbird multiple security vulnerabilities

Multiple memory corruptions, crossite access, information leak, restriction bypass...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

ASPR #2011-08-18-2: Remote Binary Planting in Mozilla Thunderbird

=====BEGIN-ACROS-REPORT===== PUBLIC ========================================================================= ACROS Security Problem Report 2011-08-18-2 ------------------------------------------------------------------------- ASPR 2011-08-18-2: Remote Binary Planting in Mozilla Thunderbird...

Grupo Argentina Web Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability Grupo Argentina Web AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://grupoargentinaweb.com/ Persian Gulf 4 Ever! Dork : "Designed & powered by GAW GrupoArgentinaWeb"...

Elgg 1.7.10 <= | Multiple Vulnerabilities

OVERVIEW The Elgg 1.7.10 and lower versions are vulnerable to Cross Site Scripting and SQL Injection. 2. BACKGROUND Elgg is an award-winning social networking engine, delivering the building blocks that enable businesses, schools, universities and associations to create their own fully-featured...

ALTOGRADO (catalogo.php?id_categoria) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability ALTOGRADO catalogo.php?idcategoria AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.altogrado.com.ar/ Persian Gulf 4 Ever! Dork : "Powered by ALTOGRADO"...

ASPR #2011-08-18-1: Remote Binary Planting in Mozilla Firefox

=====BEGIN-ACROS-REPORT===== PUBLIC ========================================================================= ACROS Security Problem Report 2011-08-18-1 ------------------------------------------------------------------------- ASPR 2011-08-18-1: Remote Binary Planting in Mozilla Firefox...

ZDI-11-271: Mozilla Firefox appendChild DOM Tree Inconsistency Remote Code Execution Vulnerability

ZDI-11-271: Mozilla Firefox appendChild DOM Tree Inconsistency Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-271 August 17, 2011 -- CVE ID: CVE-2011-2378 -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P -- Affected Vendors: Mozilla -- Affected Products: Mozilla...

ZDI-11-270: Mozilla Firefox SVGTextElement.getCharNumAtPosition Remote Code Execution Vulnerability

ZDI-11-270: Mozilla Firefox SVGTextElement.getCharNumAtPosition Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-270 August 17, 2011 -- CVE ID: CVE-2011-0084 -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P -- Affected Vendors: Mozilla -- Affected Products: Mozilla...

Nortel / Avaya Media Application Server buffer overflow

Buffer overflow on TCP/52005 request parsing...

ZDI-11-262: Symantec Veritas Storage Foundation vxsvc.exe Unicode String Parsing Remote Code Execution Vulnerability

ZDI-11-262: Symantec Veritas Storage Foundation vxsvc.exe Unicode String Parsing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-262 August 16, 2011 -- CVE ID: CVE-2011-0547 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: Symantec -- Affected...

CheckPoint SSL VPN ActiveX code execution

Unsafe methods allow file upload and execute...

cdeVision (index.php?page) Remote File Inclusion Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote File Inclusion Vulnerability cdeVision index.php?page AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.cdevision.com/ Persian Gulf 4 Ever! Dork : "Site by cdeVision" "inurl:index.php?page=" Exploite:...

CVE-2011-0527: VMware vFabric tc Server password obfuscation bypass

Severity: Important Versions Affected: 2.0.0.RELEASE to 2.0.5.SR01 2.1.0.RELEASE to 2.1.1.SR01 Description: tc Server allows users to store the passwords used for JMX authentication in an obfuscated form for organizations where storing passwords in plain text is not permitted. The JMX...

lab382 (dettaglio.php?id) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability lab382 dettaglio.php?id AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.lab382.com/ Persian Gulf 4 Ever! Dork : "Web site by: lab382.com" "inurl:dettaglio.php?id="...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

netplanet (dettaglio.asp?id) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability netplanet dettaglio.asp?id AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.netplanet.it/ Persian Gulf 4 Ever! Dork : "Powered by netplanet" "inurl:dettaglio.asp?id="...

RealNetworks Realplayer multiple security vulnerabilities

QCP, AAC, MP3, SWF, SIPR parsing memory corruptions, crossite scripting, unsafe methods and buffer overflow in ActiveX...

ZDI-11-258: Apple QuickTime STSC atom Parsing Remote Code Execution Vulnerability

ZDI-11-258: Apple QuickTime STSC atom Parsing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-258 August 16, 2011 -- CVE ID: CVE-2011-0249 -- CVSS: 9, AV:N/AC:L/Au:N/C:P/I:P/A:C -- Affected Vendors: Apple -- Affected Products: Apple Quicktime -- TippingPoint...

Symantec Veritas Storage Foundation multiple security vulnerabilities

Multiple vulnerabilities on TCP/2148 request parsing...

CheckPoint Security Management products symbolic links vulnerability

Symbolic links vulnerability during installation...

StudioLine Photo Basic ActiveX code execution

Unsafe EnableLog method...

EMC RSA Adaptive Authentication authentication data reuse (On-Premise)

No description provided...

[SECURITY] [DSA 2292-1] ISC DHCP security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2292-1 [email protected] http://www.debian.org/security/ Florian Weimer August 11, 2011 http://www.debian.org/security/faq -...

foomatic code execution

It's possible to execute code via .ppd files...

ZDI-11-255: Apple QuickTime Player H.264 Reference Picture List Remote Code Execution Vulnerability

ZDI-11-255: Apple QuickTime Player H.264 Reference Picture List Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-255 August 16, 2011 -- CVE ID: CVE-2011-0247 -- CVSS: 9, AV:N/AC:L/Au:N/C:P/I:P/A:C -- Affected Vendors: Apple -- Affected Products: Apple Quickti...

ZDI-11-257: Apple QuickTime Player H.264 Slice Header Remote Code Execution Vulnerability

ZDI-11-257: Apple QuickTime Player H.264 Slice Header Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-257 August 16, 2011 -- CVE ID: CVE-2011-0247 -- CVSS: 9, AV:N/AC:L/Au:N/C:P/I:P/A:C -- Affected Vendors: Apple -- Affected Products: Apple Quicktime --...