XSS, AoF и IAA уязвимости в MC Content Manager

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Cross-Site Scripting уязвимостях в системе MC Content Manager. Это украинская коммерческая CMS. XSS WASC-08: Уязвимости на страницах регистрации и восстановления пароля. http://websecurity.com.ua/uploads/2011/MC20Content20Manager20XSS.html...

Advantech BroadWin WebAccess multiple security vulnerabilities

Code execution, information leak from TCP/4592 RPC-based service...

IBM Lotus Domino Server Controller unauthorized access

User-supplied network file is used for stored user's credentials during TCP/2050 service authentication...

libcgroup security vulnerabilities

Buffer overflow, privilege escalation...

ZDI-11-106: Novell Netware NWFTPD.NLM DELE Remote Code Execution Vulnerability

ZDI-11-106: Novell Netware NWFTPD.NLM DELE Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-106 March 18, 2011 -- CVE ID: CVE-2010-4228 -- CVSS: 9, AV:N/AC:L/Au:S/C:C/I:C/A:C -- Affected Vendors: Novell -- Affected Products: Novell Netware -- TippingPointTM I...

Progea Movicon TCPUploadServer unauthorized access

It's possible to upload and execute file to arbitrary location...

iDefense Security Advisory 03.21.11: Apple OfficeImport Framework Excel Memory Corruption Vulnerability

iDefense Security Advisory 03.21.11 http://labs.idefense.com/intelligence/vulnerabilities/ Mar 21, 2011 I. BACKGROUND The OfficeImport framework is an API used by Apple's mobile devices, including the iPod Touch, iPhone, and iPad. The framework is used to parse and display Microsoft Office file...

ZDI-11-107: Libtiff ThunderCode Decoder THUNDER_2BITDELTAS Remote Code Execution Vulnerability

ZDI-11-107: Libtiff ThunderCode Decoder THUNDER2BITDELTAS Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-107 March 21, 2011 -- CVE ID: CVE-2011-1167 -- CVSS: 9, AV:N/AC:L/Au:N/C:P/I:P/A:C -- Affected Vendors: Libtiff -- Affected Products: Libtiff libtiff --...

XSS vulnerability in Web Poll Pro

Product: Web Poll Pro Vendor: http://www.got.my Vulnerable Version: 1.0.3 and probably prior versions Vulnerability Type: Stored XSS Cross Site Scripting Risk level: Medium Credit: Hector.x90 Vulnerability Details: User can execute arbitrary JavaScript code within the vulnerable application. The...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

libzip library / PHP DoS

NULL pointer dereference in zipnamelocate...

Tugux CMS (nid) BLIND sql injection vulnerability

=================================================================== Tugux CMS nid BLIND sql injection vulnerability =================================================================== Software: Tugux CMS Vendor: www.tugux.com Vuln Type: BLind SQL Injection Download link:...

libzip 0.9.3 _zip_name_locate NULL Pointer Dereference (incl PHP 5.3.5)

libzip 0.9.3 zipnamelocate NULL Pointer Dereference incl PHP 5.3.5 Author: Maksymilian Arciemowicz http://securityreason.com/ http://cxib.net/ Date: - Dis.: 03.01.2011 - Pub.: 18.03.2011 CVE: CVE-2011-0421 CERT: VU325039 Affected Software: - libzip 0.9.3 - PHP 5.3.5 fixed 5.3.6 Original URL:...

LFI, IAA, XSS и FPD уязвимости в W-Agora

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Local File Inclusion, Insufficient Anti-automation, Cross-Site Scripting и Full path disclosure уязвимостях в W-Agora. Local File Inclusion WASC-31: http://site/register.php?bn=1 в папке conf http://site/register.php?bn=..1 в любой папке - только ...

Douran Portal File Download/Source Code Disclosure Vulnerability

Title: Douran Portal File Download/Source Code Disclosure Vulnerability Date of Publishing: 16 March 2010 Application Name: Douran Portal Version: 3.9.7.8 Impact: Medium Vendor: www.douran.com Link: http://douran.com/HomePage.aspx?TabID=4862 Vendor Responses: They didn't respond to the emails...

XOOPS 2.5.0 <= Cross Site Scripting Vulnerability

XOOPS 2.5.0 = Cross Site Scripting Vulnerability 1. OVERVIEW The XOOPS 2.5.0 and lower versions were vulnerable to Cross Site Scripting. 2. BACKGROUND XOOPS is an acronym of eXtensible Object Oriented Portal System. It's the 1 Content Management System CMS project on www.sourceforge.net and a...

SAP Crystal Reports Server crossite scripting

Multiple crossite scripting vulnerabilities...

ESA-2011-009: RSA, The Security Division of EMC, announces a fix for potential security vulnerability in RSA Access Manager Server

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2011-009: RSA, The Security Division of EMC, announces a fix for potential security vulnerability in RSA® Access Manager Server. Summary: RSA Access Manager Server contains a potential vulnerability that could be exploited by malicious people to...

SAP GUI DLL hijacking

DLL hijacking by placing .sap files in network floder...

HTB22889: XSS in Rating-Widget wordpress plugin

Vulnerability ID: HTB22889 Reference: http://www.htbridge.ch/advisory/xssinratingwidgetwordpressplugin.html Product: Rating-Widget wordpress plugin Vendor: Vova Feldman http://rating-widget.com/ Vulnerable Version: 1.3.1 Vendor Notification: 03 March 2011 Vulnerability Type: XSS Cross Site...

HTB22890: XSS in Rating-Widget wordpress plugin

Vulnerability ID: HTB22890 Reference: http://www.htbridge.ch/advisory/xssinratingwidgetwordpressplugin1.html Product: Rating-Widget wordpress plugin Vendor: Vova Feldman http://rating-widget.com/ Vulnerable Version: 1.3.1 Vendor Notification: 03 March 2011 Vulnerability Type: XSS Cross Site...

HTB22894: XSS in Sodahead Polls wordpress plugin

Vulnerability ID: HTB22894 Reference: http://www.htbridge.ch/advisory/xssinsodaheadpollswordpressplugin1.html Product: Sodahead Polls wordpress plugin Vendor: SodaHead.com SodaHead.com Vulnerable Version: 2.0.2 Vendor Notification: 03 March 2011 Vulnerability Type: XSS Cross Site Scripting Status...

ESA-2011-007: EMC Avamar sensitive information disclosure vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2011-007: EMC Avamar sensitive information disclosure vulnerability. EMC Identifier: ESA-2011-007 CVE Identifier: CVE-2011-0442 Severity Rating: CVSS v2 Base Score: 8.5 AV:N/AC:M/Au:S/C:C/I:C/A:C Affected products: EMC Avamar 5.0.0-407 and later b...

HTB22892: Path disclosure in Smen Social Button wordpress plugin

Vulnerability ID: HTB22892 Reference: http://www.htbridge.ch/advisory/pathdisclosureinsmensocialbuttonwordpressplugin.html Product: Smen Social Button wordpress plugin Vendor: Alexandru Dumencu http://smen.ro/ Vulnerable Version: 0.7 Vendor Notification: 03 March 2011 Vulnerability Type: Path...

RSA Access Manager Server unauthorized access

No description provided...

HTB22893: XSS in Sodahead Polls wordpress plugin

Vulnerability ID: HTB22893 Reference: http://www.htbridge.ch/advisory/xssinsodaheadpollswordpressplugin.html Product: Sodahead Polls wordpress plugin Vendor: SodaHead.com SodaHead.com Vulnerable Version: 2.0.2 Vendor Notification: 03 March 2011 Vulnerability Type: XSS Cross Site Scripting Risk...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

EMC Avamar secrurity vulnerabilities

Information leakage, privilege escalation...

[DSECRG-11-011] SAP Crystal Reports 2008 - Multiple XSS

DSECRG-11-011 SAP Crystal Reports 2008 - Multiple XSS SAP Crystal Report Server 2008 - multiple cross-site scripting vulnerabilities. SAP Crystal Report Server 2008 - Multiple cross-site scripting vulnerabilities. DSecRG-11-011 Internal DSECRG-00147 Multiple XSS vulnerabilities found in the modul...

HTB22891: XSS in Rating-Widget wordpress plugin

Vulnerability ID: HTB22891 Reference: http://www.htbridge.ch/advisory/xssinratingwidgetwordpressplugin2.html Product: Rating-Widget wordpress plugin Vendor: Vova Feldman http://rating-widget.com/ Vulnerable Version: 1.3.1 Vendor Notification: 03 March 2011 Vulnerability Type: XSS Cross Site...

[DSECRG-11-014] SAP GUI (sapgui) - DLL hijacking

DSECRG-11-014 SAP GUI sapgui - DLL hijacking SAP Front End applications SAPGui.exe are vulnerable to DLL hijacking attacks. It makes possible to remote code execution Digital Security Research Group DSecRG Advisory DSecRG-11-014 Internal DSecRG-00183 Application: SAP GUI Versions Affected: 6.4 -...

nostromo nhttpd directory traversal

Directory traversal including code execution via CGI with escaped URI...

[SECURITY] [DSA 2192-1] chromium-browser security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2192-1 [email protected] http://www.debian.org/security/ Giuseppe Iuculano March 15, 2011 http://www.debian.org/security/faq -...

[DSECRG-11-013] SAP NetWeaver Runtime - multiple XSS

DSECRG-11-013 SAP NetWeaver Runtime - multiple XSS SAP NetWeaver Integration Directory has linked XSS vulnerability. Digital Security Research Group DSecRG Advisory DSecRG-11-013 Internal DSecRG-00163 Application: SAP NetWeaver Runtime Versions Affected: SAP NetWeaver Runtime Vendor URL:...

XSS, LFI и BT уязвимости в W-Agora

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Cross-Site Scripting, Local File Inclusion и Brute Force уязвимостях в W-Agora. XSS WASC-08: http://site/current/getfile.php/supporthowto/223E3Cbody20onload=alertdocument.cookie3E/1/ Local File Inclusion WASC-31: В папке conf:...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Apple WebKit / Safari / iTunes / libtiff / Google Chrome multiple security vulnerabilities

Multiple vulnerabilities on PNG, TIFF, JPEG, XML parsing, multipe WebKit memory corruptions...

[DSECRG-11-012] SAP NetWeaver Integration Directory - multiple XSS

DSECRG-11-012 SAP NetWeaver Integration Directory - multiple XSS SAP NetWeaver Integration Directory has multiple linked XSS vulnerabilities. Digital Security Research Group DSecRG Advisory DSecRG-11-012 Internal DSecRG-00159 Application: SAP NetWeaver XI Versions Affected: SAP NetWeaver XI Vendo...

[RT-SA-2011-001] nostromo nhttpd directory traversal leading to arbitrary command execution

Advisory: nostromo nhttpd directory traversal leading to arbitrary command execution During a penetration test, RedTeam Pentesting discovered a directory traversal vulnerability leading to arbitrary command execution in the nostromo HTTP server. Details ======= Product: nostromo nhttpd Affected...

MITKRB5-SA-2011-003 [CVE-2011-0284] KDC double-free when PKINIT enabled

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 MITKRB5-SA-2011-003 MIT krb5 Security Advisory 2011-003 Original release: 2011-03-15 Last update: 2011-03-15 Topic: KDC vulnerable to double-free when PKINIT enabled CVE-2011-0284 CVSSv2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:POC/RL:OF/RC:C CVSSv2 Base...

MIT Kerberos 5 double free

Double free vulnerability on PKINIT...

VUPEN Security Research - Apple Safari WebKit Iframe Event Handling Remote Use-after-free

VUPEN Security Research - Apple Safari WebKit Iframe Event Handling Remote Use-after-free http://www.vupen.com/english/research.php I. BACKGROUND --------------------- "Apple Safari is a web browser developed by Apple. As of February 2010, Safari was the fourth most widely used browser, with 4.45...

Joomla! 1.6.0 | SQL Injection Vulnerability

================================= Joomla! 1.6.0 | SQL Injection Vulnerability ================================= 1. OVERVIEW Joomla! 1.6.0 was vulnerable to SQL Injection. 2. BACKGROUND Joomla is a free and open source content management system CMS for publishing content on the World Wide Web and...

HTB22882: Path disclosure in OXID eShop

Vulnerability ID: HTB22882 Reference: http://www.htbridge.ch/advisory/pathdisclosureinoxideshop.html Product: OXID eShop Vendor: OXID eSales AG http://www.oxid-esales.com/ Vulnerable Version: CE 4.4.7 Vendor Notification: 01 March 2011 Vulnerability Type: Path disclosure Status: Not Fixed Risk...

Checkpoint VPN - Priviledge Escalation

It appears this bug has gone unoticed to vulnerability databases maintainers, very likely due to the lack of disclosure/publication. This usually means it's also not in compliance/patching systems and exposes customers to unecessary risk. To counteract I'd like to drop this note. Checkpoint SNX...

IAA и XSS уязвимости в CMS WebManager-Pro

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Insufficient Anti-automation и Cross-Site Scripting уязвимостях в CMS WebManager-Pro. Это украинская коммерческая CMS. Insufficient Anti-automation WASC-21: На странице контактов http://site/index.php?menuid=x нет защиты от автоматизированных...

HTB22888: File Content Disclosure in LotusCMS

Vulnerability ID: HTB22888 Reference: http://www.htbridge.ch/advisory/filecontentdisclosureinlotuscms.html Product: LotusCMS Vendor: Arboroia Network http://www.lotuscms.org/ Vulnerable Version: 3.0.3 and probably prior versions Vendor Notification: 01 March 2011 Vulnerability Type: File Content...

About the security content of Safari 5.0.4

About the security content of Safari 5.0.4 Last Modified: March 09, 2011 Article: HT4566 Email this article Print this page Summary This document describes the security content of Safari 5.0.4. For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until...

HTB22887: XSS vulnerability in LotusCMS

Vulnerability ID: HTB22887 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinlotuscms3.html Product: LotusCMS Vendor: Arboroia Network http://www.lotuscms.org/ Vulnerable Version: 3.0.3 and probably prior versions Vendor Notification: 01 March 2011 Vulnerability Type: Stored XSS Cross...

VUPEN Security Research - Apple Safari WebKit Scroll Event Handling Remote Use-after-free

VUPEN Security Research - Apple Safari WebKit Scroll Event Handling Remote Use-after-free http://www.vupen.com/english/research.php I. BACKGROUND --------------------- "Apple Safari is a web browser developed by Apple. As of February 2010, Safari was the fourth most widely used browser, with 4.45...