Re: PCPIN Chat <= 5.0.4 "login/language" remote cmmnds xctn

The patch has been released. Refer to http://www.pcpin.com for information.

ASPScriptz Guest Book 2.0 XSS

-- - ASPScriptz Guest Book 2.0 Remote XSS - -= http://colander.altervista.org/advisory/ASzGB.txt =- -- -= ASPScriptz Guest Book 2.0 =-

Re: Bookmark4U Remote File Include

The inc directory is filtered with .htaccess (Deny from all). Still vulnerable code though :) /str0ke On 4 Jun 2006 14:39:27 -, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote: --- Bookmark4U <= 2.0.0? ([include_prefix])

Re: [Full-disclosure] RealVNC 4.1.1 Remote Compromise

How is it that even though this vulnerability has been known now for some time, Red Hat still has not issued a new package or security update that addresses this? On RHN, the most recent package I can find is 4.0.0 beta and the most recent security patch for VNC dates back to December 2004. Since

[KAPDA::#47] - myNewsletter 1.1.2 SQL_Injection

[KAPDA::#47] - myNewsletter 1.1.2 SQL_Injection SQL_Injection --- KAPDA New advisory Vulnerable products : myNewsletter <= 1.1.2 Vendor: http://www.aspburst.com/index.asp Risk: Medium Vulnerability: SQL_Injection Date : Found : 2006/06/05 Vendor Contacted :

[Kil13r-SA-20060606] ESTsoft InternetDISK Arbitary Code Execution Vulnerability

Title: [Kil13r-SA-20060606] ESTsoft InternetDISK Arbitary Code Execution Vulnerability Author: Kil13r - http://www.kil13r.info/ Local / Remote: Remote Timeline: 2006/04/19 - Discovery 2006/04/19 - Vendor notification 2006/04/20 - Vendor response 2006/04/20 - Vendor patch release 2006/

[Kil13r-SA-20060605] Syworks SafeNET Policy File Vulnerability

Title: [Kil13r-SA-20060605] Syworks SafeNET Policy File Vulnerability Author: Kil13r - http://www.kil13r.info/ Local / Remote: Local Timeline: 2006/04/18 - Discovery 2006/06/05 - Release Affected version: All version of Syworks SafeNET Not affected version: In this time, none

Re: New Snort Bypass - Patch - Bypass of Patch

Apache uses a modified version of the isspace() macro. So it allows \f,\n,\r,\t (\v is not allowed, as far as I can recall) as whitespace. I know this affected lot of IPSes. Thanks, Pukhraj On 6/3/06, M. Dodge Mumford <[EMAIL PROTECTED]> wrote: [Sorry to reply to my own post, but...] M. Dodge

Dmx Forum <= v2.1a Remote Passwords Disclosure

#!/usr/bin/perl # # by DarkFig -- www.acid-root.new.fr # use LWP::Simple; if ( !$ARGV[1] ) { header(); print "\n| Usage: |"; print "\n+--+"; print "\n| Example: http://localhost/dmx/ 1 --|"; end(); } sub header { print "

Personal Information Disclosure/Account Hijacking Vulerability in mafia online games

The mafia online games www.mafia1930.de, www.mafia1930.com and www.the-mafia.de operated by e-sport GmbH are popular online applications with over 400.000 accounts. Although the basic game is free, many people upgrade to premium accounts and invest real money to get special features. An attacker i

Re: phpBB2 (template.php) Remote File Inclusion

template.php is an addon and not part of phpbb2, noobs [EMAIL PROTECTED] wrote: *Title: *phpBB2 Remote File Include * * *Credit: *Canberx * * *Thanx: *Forewer-Partizan * * *Mail: [EMAIL PROTECTED]www.canb

[MajorSecurity #9]HostAdmin <= 3.1 - Remote File Include Vulnerability

[MajorSecurity #9]HostAdmin <= 3.1 - Remote File Include Vulnerability - Software: HostAdmin Version: <=3.1 Type: Remote File Include Vulnerability Date: June, 3rd 2006 Vendor: dreamcost Page: http://dreamcost.co

[MajorSecurity #8]DreamAccount <= 3.1 - Remote File Include Vulnerability

[MajorSecurity #8]DreamAccount <= 3.1 - Remote File Include Vulnerability - Software: DreamAccount Version: <=3.1 Type: Remote File Include Vulnerability Date: June, 3rd 2006 Vendor: dreamcost Page: http://dreamc

Re: [Full Disclosure] [Kil13r-SA-20060520] Microsoft Internet Explorer Crash Vulnerability

Title: [Kil13r-SA-20060520] Microsoft Internet Explorer Crash Vulnerability Author: Kil13r - http://www.kil13r.info/ Local / Remote: Both Timeline: 2003/12/28 - Discovery 2006/05/20 - Release 2006/06/05 - Update Affected version: Microsoft Internet Explorer 6 SP2 or earlier Not aff

Advisory 04/2006: DokuWiki PHP code execution vulnerability in spellchecker

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hardened-PHP Project www.hardened-php.net -= Security Advisory =- Advisory: DokuWiki PHP code execution vulnerability in spellchecker Release Date: 2006/06/05 Last Modifie

ewsEngine <= 1.5.0(newscomments.php) Remote SQL Injection Vulnerability

# Title : NewsEngine <= 1.5.0(newscomments.php) Remote SQL Injection Vulnerability # Author : ajann ### Vulnerability; $$$ http://[target]/[path]/newscomments.php Example: $$ http://[target]/[path]/newscomments.php?newsid='/**/union/**/select/**/0,username,userpassword,0,0,0,0,0,0,0

FunkBoard CF0.71 (profile.php) Remote User Pass Change Exploit

# Title : FunkBoard CF0.71 (profile.php) Remote User Pass Change Exploit # Author : ajann REMOTE USER PASS CHANGE EXPLOİT; Change: => ID AND action ***

LocazoList Classifieds <= v1.05e(viewmsg.asp) Remote SQL Injection Vulnerability

# Title : LocazoList Classifieds <= v1.05e(viewmsg.asp) Remote SQL Injection Vulnerability # Author : ajann #Vulnerability; $$$ http://[target]/[path]/viewmsg.asp?msgid= SQL TEXT $$$ Example: http://[target]/[path]/viewmsg.asp?msgid=-1%20union%20select%20epass,0,0,0,email,0,0,0,0,0,0

TSLSA-2006-0032 - multi

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Trustix Secure Linux Security Advisory #2006-0032 Package names: kernel, postgresql Summary: Multiple vulnerabilities Date: 2006-06-05 Affected ver

RE: Fire fox dos exploit

I have seen that the exploit also freezes Eudora 6.2.1.2. I was trying to open the original mail in Eudora mail client and whenever I clicked on the the mail , Eudora stopped responding anymore. I had to restart the application. regards -Sanjay Rawat At 09:52 PM 5/31/2006, Andy wrote: Crashed

Kmita FAQ v1.0

Kmita FAQ v1.0 Homepage: http://www.kmita-faq.com Effected files: search.php index.php Search.php does not sanatize user input before dynamically genrating it. Proof of concept: http://www.example.com/search.php?q=http://evilsite.com/xss.js> SQL Injection proof of concept: http://www

LabWiki v1.0

LabWiki 1.0 Homepage: http://www.bioinformatics.org/phplabware/labwiki/index.php Effected files: search.php The search input box does not sanatize user input before dynamically genrating it. XSS Proof of concept: ">http://evilsite.com/xss.js><"

RE: phpBB2 (template.php) Remote File Inclusion

Sounds like a fake to me 1: template.php is in the /inludes/ subdir 2: it uses no variable $page 3: it does not use the inlude() function at all What was your aim ? lauching a massive script kiddy attack that wouldn't work ? Scrouaf Desert Warrior

Multiple Vendor NTFS Data Stream Malware Stealth Technique

Hi to all! Because it isn't a new problem and is well known by virus and spyware writters I decide to release to the public now. Full disclosure. Attached goes a simple paper that describes this "very-advanced" technique that was applicable at 1993 and is currently applicable. Re

CyBoards PHP Lite v1.25 (common.PHP) Remote File Inclusion

## # CyBoards PHP Lite v1.25 (common.PHP) Remote File Inclusion ## # Credit : SpC-x | The-BeKiR # Site: http://wWw.SaVSaK.CoM ##

Re: [Full-disclosure] bug in oscomerce

this would require access to the administrator panel to work, how is this a vuln? zeus olimpusklan wrote: ### #Advisory #2 Title: file Modification in osCommerce # # # Author: 0o_zeus_o0 # Contact: [EMAIL PROTECTED]

# MHG Security Team ---Rumble 1.02 version Remote File Inc.

# Milli-Harekat Advisory ( www.milli-harekat.org ) # Rumble <= 1.02 version - Remote File Include Vulnerabilities # Risk : high # Class: Remote # Script : Rumble 1.02 version # Msn : erne [at] ernealizm [dot] com # Credits : ERNE # Thanks : Dj_ReMix,The_bekir,SpC-x,Eskobar,Blackened,Poizonb

# MHG Security Team ---Rumble 1.02 version Remote File Inc.

# Milli-Harekat Advisory ( www.milli-harekat.org ) # Rumble <= 1.02 version - Remote File Include Vulnerabilities # Risk : high # Class: Remote # Script : Rumble 1.02 version # Msn : erne [at] ernealizm [dot] com # Credits : ERNE # Thanks : Dj_ReMix,The_bekir,SpC-x,Eskobar,Blackened,P

Bookmark4U Remote File Include

--- Bookmark4U <= 2.0.0? ([include_prefix]) Remote File Include Vulnerabilities --- Discovered By SnIpEr_SA Author: SnIpEr_SA Remote : Yes L

Client buffer-overflow in Quake 3 engine (1.32c / rev 795)

### Luigi Auriemma Application: Quake 3 engine http://www.idsoftware.com http://www.icculus.org/quake3/ Versions: Quake 3 <= 1.32c Icculus