ZDI-11-258: Apple QuickTime STSC atom Parsing Remote Code Execution Vulnerability

ZDI-11-258: Apple QuickTime STSC atom Parsing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-258 August 16, 2011 -- CVE ID: CVE-2011-0249 -- CVSS: 9, AV:N/AC:L/Au:N/C:P/I:P/A:C -- Affected Vendors: Apple -- Affected Products: Apple Quicktime -- TippingPoint...

phpWebSite (userpage) Cross Site Scripting Vulnerabilities

IRANIAN THE BEST HACKERS IN THE WORLD Cross Site Scripting Vulnerabilities phpWebSite userpage AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Persian Gulf 4 Ever! Dork : allinurl:"mod.php?mod=userpage" Exploite: www.victim.com/mod.php?mod=userpage&pageid=XSS...

NetSaro Enterprise Messenger Server Plaintext Password Storage Vulnerability

NetSaro Enterprise Messenger Server Plaintext Password Storage Vulnerability CVSS Risk Rating: 4.6 Medium Product: NetSaro Enterprise Messenger Server Application Vendor: SEM Software Vendor URL: http://www.netsaro.com/ Public disclosure date: 8/15/2011 Discovered by: Rob Kraus, Jose Hernandez, a...

HP ProLiant SL Advanced Power Manager unauthorized access

No description provided...

CA ARCserve D2D unauthorized access

Information leakage and code execution while processing TCP/8014 HTTP RPC request...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Adobe Flash Media Server DoS

Memory corruption...

libavcodec / FFmpeg / MPlayer buffer overflow

Buffer overflow in CAVS decoding...

Adobe Photoshop memory corruption

Memory corruption on GIF parsing...

HP Palm WebOS crossite scripting

Crossite scripting in Contacts and Calendar applications...

iDefense Security Advisory 08.09.11: Adobe Flash Player ActionScript Display Memory Corruption Vulnerability

iDefense Security Advisory 08.09.11 http://labs.idefense.com/intelligence/vulnerabilities/ Aug 09, 2011 I. BACKGROUND Adobe Flash Player is an application for viewing animations and movies using computer programs such as a Web browser; in common usage, Flash lets you put animation and movies on a...

[oCERT-2011-002] libavcodec insufficient boundary check

2011-002 libavcodec insufficient boundary check Description: The libavcodec library, an open source video encoding/decoding library part of the FFmpeg and Libav projects, performs insufficient boundary check against a buffer index. The missing check can result in arbitrary read/write of data...

[security bulletin] HPSBGN02696 SSRT100590 rev.1 - HP webOS Calendar Application, Remote Execution of Arbitrary Code

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c02945437 Version: 1 HPSBGN02696 SSRT100590 rev.1 - HP webOS Calendar Application, Remote Execution of Arbitrary Code NOTICE: The information in this Security Bulletin should be acted upon as soon...

iDefense Security Advisory 08.09.11: Adobe Flash Player Integer Overflow

iDefense Security Advisory 08.09.11 http://labs.idefense.com/intelligence/vulnerabilities/ Aug 09, 2011 I. BACKGROUND Adobe Flash Player is an application for viewing animations and movies using computer programs such as a Web browser; in common usage, Flash lets you put animation and movies on a...

[SECURITY] [DSA 2289-1] typo3-src security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2289-1 [email protected] http://www.debian.org/security/ Florian Weimer August 07, 2011 http://www.debian.org/security/faq -...

[security bulletin] HPSBPI02698 SSRT100404 rev.1 - HP Easy Printer Care Software Running on Windows, Remote Execution of Arbitrary Code

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c02949847 Version: 1 HPSBPI02698 SSRT100404 rev.1 - HP Easy Printer Care Software Running on Windows, Remote Execution of Arbitrary Code NOTICE: The information in this Security Bulletin should be...

[security bulletin] HPSBHF02699 SSRT100592 rev.1 - HP ProLiant SL Advanced Power Manager (SL-APM), Remote User Validation Failure

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c02950841 Version: 1 HPSBHF02699 SSRT100592 rev.1 - HP ProLiant SL Advanced Power Manager SL-APM, Remote User Validation Failure NOTICE: The information in this Security Bulletin should be acted...

CA20110809-01: Security Notice for CA ARCserve D2D

CA20110809-01: Security Notice for CA ARCserve D2D Issued: August 9, 2011 CA Technologies support is alerting customers to a security risk associated with CA ARCserve D2D. A vulnerability exists that can allow a remote attacker to access credentials and execute arbitrary commands. CA Technologies...

Mambo CMS 4.6.x (4.6.5) | SQL Injection

Mambo CMS 4.6.x 4.6.5 | SQL Injection 1. OVERVIEW Mambo CMS 4.6.5 and lower versions are vulnerable to SQL Injection. 2. BACKGROUND Mambo is a full-featured, award-winning content management system that can be used for everything from simple websites to complex corporate applications. It is used...

[security bulletin] HPSBGN02694 SSRT100586 rev.1 - HP webOS Contacts Application, Remote Execution of Arbitrary Code

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c02937744 Version: 1 HPSBGN02694 SSRT100586 rev.1 - HP webOS Contacts Application, Remote Execution of Arbitrary Code NOTICE: The information in this Security Bulletin should be acted upon as soon...

[USN-1188-1] eCryptfs vulnerabilities

========================================================================== Ubuntu Security Notice USN-1188-1 August 09, 2011 ecryptfs-utils vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its...

McAfee Security-as-a-Service ActiveX code execution

Insecure methods in MyAsUtil5.2.0.603.dll, myCIOScn.dll...

HP OpenView Performance Insight security vulnerabilities

Crossite scripting, unauthorized access...

Microsoft Windows multiple security vulnerabilities

NDISTAPI service and CSRSS privilege escalations, kernel DoS, TCP/IP DoS, RDP DoS, .Net information disclosure...

Android application spoofing

Application can emulate logon window of different application...

Microsoft Windows Remote Desktop Web Access crossite scripting

Crossite scripting on the logon page...

Microsoft Office Visio security vulnerabilities

Memory corruption on Visio files parsing...

Microsoft Windows DNS server security vulnerabilities

Memory corruption on NAPTR record handling, uninitialized memory access on non-existent domain lookup...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Microsoft Internet Explorer multiple security vulnerabilities

Multiple memory corruptions, crossite data access, code execution...

Многичесленные уязвимости в Register Plus Redux для WordPress

Здравствуйте 3APA3A! Сообщаю вам о найденных мною многочисленных Cross-Site Scripting уязвимостях в плагине Register Plus Redux для WordPress. XSS persistent WASC-08: Есть много persistent XSS уязвимостей в настойках плагина http://site/wp-admin/options-general.php?page=register-plus-redux. В...

Re: CA ARCserve D2D r15 GWT RPC Request Auth Bypass / Credentials

FYI, we have published a fix for this issue. https://support.ca.com/irj/portal/anonymous/solndtls?aparNo=RO33517&os=W INDOWS&actionID=3 A formal security notice will be published next week. Thanks and regards, Ken Williams, Director CA Technologies Product Vulnerability Response Team CA...

Kimia Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability Kimia AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.kimia.co.za/ Persian Gulf 4 Ever! Dork : "Graphic design & Website design by Kimia" "inurl:id=" Exploite:...

THE STUDIO (prod.php?id) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability THE STUDIO prod.php?id AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.thestudio.net/ Persian Gulf 4 Ever! Dork : "Site designed by The Studio, INC." "inurl:prod.php?id="...

Web Design Sydney (news-item.php?id) (news-item.php?newsid) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability Web Design Sydney news-item.php?id news-item.php?newsid AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.milkdigital.com.au/ Persian Gulf 4 Ever! Dork : "web design sydney...

ZDI-11-250: Apple QuickTime STTS atom Remote Code Execution Vulnerability

ZDI-11-250: Apple QuickTime STTS atom Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-250 August 9, 2011 -- CVE ID: CVE-2011-0252 -- CVSS: 9, AV:N/AC:L/Au:N/C:P/I:P/A:C -- Affected Vendors: Apple -- Affected Products: Apple Quicktime -- Vulnerability Details...

Arte Dude (collections.php?id) (property.php?id) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability Arte Dude collections.php?id property.php?id AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.artdudegraphics.com/ Persian Gulf 4 Ever! Dork : "inurl:property.php?id=" "an...

TPTI-11-13: McAfee SaaS myCIOScn.dll Scan Method Script Injection Remote Code Execution Vulnerability

TPTI-11-13: McAfee SaaS myCIOScn.dll Scan Method Script Injection Remote Code Execution Vulnerability http://dvlabs.tippingpoint.com/advisory/TPTI-11-13 August 8, 2011 -- CVSS: 9, AV:N/AC:L/Au:N/C:P/I:P/A:C -- Affected Vendors: McAfee -- Affected Products: McAfee Security-as-a-Service --...

TPTI-11-12: McAfee SaaS MyAsUtil5.2.0.603.dll SecureObjectFactory Instantiation Design Flaw Remote Code Execution Vulnerability

TPTI-11-12: McAfee SaaS MyAsUtil5.2.0.603.dll SecureObjectFactory Instantiation Design Flaw Remote Code Execution Vulnerability http://dvlabs.tippingpoint.com/advisory/TPTI-11-12 August 8, 2011 -- CVSS: 8.3, AV:N/AC:M/Au:N/C:P/I:P/A:C -- Affected Vendors: McAfee -- Affected Products: McAfee...

Webdesigns-studio (sysMsg.php?errMsg) Cross Site Scripting Vulnerabilities

IRANIAN THE BEST HACKERS IN THE WORLD Cross Site Scripting Vulnerabilities Webdesigns-studio sysMsg.php?errMsg AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://webdesigns-studio.com/ Persian Gulf 4 Ever! Dork : "Designed and Developed by...

Avant-Garde Technologies (display-section.php?id) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability Avant-Garde Technologies display-section.php?id AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.agtsindia.com/ Persian Gulf 4 Ever! Dork : "Powered by Avant-Garde...

6House Design (product_details.php?id) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability 6House Design productdetails.php?id AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://sixhousedesign.com/ Persian Gulf 4 Ever! Dork : "Designed By: 6House Design"...

Liberating IT (picture.php?gid) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability Liberating IT picture.php?gid AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.liberatingit.com/ Persian Gulf 4 Ever! Dork : "Web Design by LiberatingIT.com"...

SQL injection in Social Slider

Vulnerability ID: HTB23033 Reference: http://www.htbridge.ch/advisory/sqlinjectioninsocialslider.html Product: Social Slider Vendor: Lukasz Wiecek http://wiecek.pl Vulnerable Version: 5.6.2 and probably prior Tested on: 5.6.2 Vendor Notification: 20 July 2011 Vulnerability Type: SQL Injection Ris...

TWSL2011-008: Focus Stealing Vulnerability in Android

Trustwave's SpiderLabs Security Advisory TWSL2011-008: Focus Stealing Vulnerability in Android https://www.trustwave.com/spiderlabs/advisories/TWSL2011-008.txt Published: 2011-08-06 Version: 1.0 Vendor: Google http://www.android.com/ Product: Android Versions affected: Tested on 2.1 - 2.3 Other...

Multiple XSS in eShop for Wordpress

Vulnerability ID: HTB23034 Reference: http://www.htbridge.ch/advisory/multiplexssineshopforwordpress.html Product: eShop for Wordpress Vendor: Rich Pedley http://wordpress.org/extend/plugins/eshop/ Vulnerable Version: 6.2.8 and probably prior Tested on: 6.2.8 Vendor Notification: 20 July 2011...

Fwd: {Lostmonґs Group} Internet Explorer 6, 7 and 8 Window.open race condition Vulnerability

Internet Explorer 6, 7 and 8 Window.open race condition Vulnerability Vendor URL: http://www.microsoft.com Advisore: http://lostmon.blogspot.com/2011/08/internet-explorer-6-7-and-8-windowopen.html Coordinate Dislcosure: YES exploit available: Private CVE-2011-1257 and MS011-57 Microsoft Internet...

ZDI-11-248: Microsoft Internet Explorer 9 STYLE Object Parsing Remote Code Execution Vulnerability

ZDI-11-248: Microsoft Internet Explorer 9 STYLE Object Parsing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-248 August 9, 2011 -- CVE ID: CVE-2011-1964 -- CVSS: 9, AV:N/AC:L/Au:N/C:P/I:P/A:C -- Affected Vendors: Microsoft -- Affected Products: Microsoft...

Synchrony Infotech (product_details.php?id) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability Synchrony Infotech productdetails.php?id AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.synchrony.co.in/ Persian Gulf 4 Ever! Dork : "Designed by synchrony infotech."...

SEO New York (prod.php?id) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability SEO New York prod.php?id AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.eyesonnet.com/ Persian Gulf 4 Ever! Dork : "Powered by:SEO New York" "inurl:prod.php?id" Exploite...