Nwom topsites v3.0
http://www.nwom.net
Vulnerable files:
Comment input.
index.php
SQL info released on error:
http://www.example.com/index.php?o='
XSS:
http://www.example.com/index.php?o=
- Luny
LS-20061002
LSsec has discovered a vulnerability in Computer Associates BrightStor ARCserve
Backup v11.5, which could be exploited by an anonymous attacker in order to
execute arbitrary code with SYSTEM privileges on an affected system. The flaw
specifically exists within the Tape Engine (tapee
Ben Bucksch wrote:
> = Abstract =
>
> The Perforce client has a huge gapping security hole by design. It
> totally trusts the Perforce server and does whatever the server tells
> it, writing arbitrary files.
Eww :)
> = Risk =
>
> Critical. The server has full access to *all* files that *any* of it
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c00809525
Version: 1
HPSBMA02176 SSRT051035 rev.1 - HP OpenView Network Node Manager (OV NNM) Remote
Unauthorized Execution of Arbitrary Code
NOTICE: The information in this Security Bulletin s
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
___
Mandriva Linux Security Advisory MDKSA-2007:010
http://www.mandriva.com/security/
___
Digital Armaments pre-advisory is 01.10.2007
http://www.digitalarmaments.com/pre2007-00018659.html
Digital Armaments realease pre-advisory of vulnerabilties and exploit avaiable
only to Platinum Subscriptors.
The full-advisory will might be released to the public after 6 months.
I. Background
===
Ubuntu Security Notice USN-405-1 January 11, 2007
fetchmail vulnerability
CVE-2006-5867
===
A security issue affects the following Ubuntu releases:
Ubuntu 5.10
Ubuntu 6.0
easy-content filemanager
Email: hackerbinhphuoc (at)yahoo (dot) com
website: http://www.vnsecurity.com
-
we can hack web use easy-content filemanager very easy
we search with keyword:
intitle: easy-content filemanager
or inurl: filemanager/Default.asp
and we ca
ZDI-07-003: CA BrightStor ARCserve Backup Message Engine Buffer Overflow
Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-07-003.html
January 11, 2007
-- CVE ID:
CVE-2007-0169
-- Affected Vendor:
Computer Associates
-- Affected Products:
BrightStor ARCserve Backup r11.5
LayerOne 2007 - Call for Papers
May 5-6, 2007
Los Angeles, California
At the Pasadena Hilton
http://layerone.info
What is LayerOne? Currently in its 4th year, LayerOne is computer
security and technology conference held in the Los Angeles area. The
purpose of LayerOne is to bring together the man
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c00809410
Version: 1
HPSBMA02175 SSRT061174 rev.1 - HP OpenView Network Node Manager (OV NNM) Remote
Unauthorized Read Access to Files
NOTICE: The information in this Security Bulletin should b
ZDI-07-004: CA BrightStor ARCserve Backup Tape Engine Buffer Overflow
Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-07-004.html
January 11, 2007
-- CVE ID:
CVE-2007-0169
-- Affected Vendor:
Computer Associates
-- Affected Products:
BrightStor ARCserve Backup r11.5
Bri
ZDI-07-002: CA BrightStor ARCserve Backup Tape Engine Code Execution
Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-07-002.html
January 11, 2007
-- CVE ID:
CVE-2007-0168
-- Affected Vendor:
Computer Associates
-- Affected Products:
BrightStor ARCserve Backup r11.5
Bri
rPath Security Advisory: 2007-0006-1
Published: 2007-01-11
Products: rPath Linux 1
Rating: Major
Exposure Level Classification:
Remote Deterministic Denial of Service
Updated Versions:
krb5=/[EMAIL PROTECTED]:devel//1/1.4.1-7.5-1
krb5-server=/[EMAIL PROTECTED]:devel//1/1.4.1-7.5-1
k
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
=
FreeBSD-SA-07:01.jail Security Advisory
The FreeBSD Project
Topic: J
> - Original Message -
> From: [EMAIL PROTECTED] <[EMAIL PROTECTED]>
> Sent: 10/01/2007 01:29:35
> Subject: slocate leaks filenames of protected directories
>
> > * Version tested: 3.1
> >
> > * Problem description: slocate doesn't check readability bit of containing
> > directory. It c
Calyptix Security Advisory CX-2007-001
Date: 01/11/2007
http://www.calyptix.com/
http://labs.calyptix.com/advisories/CX-2007-01.txt
[ Overview ]
Snort 2.6.1.2 is vulnerable to an integer underflow that allows a
remote attacker to cause Snort to read beyond a specified length of
memory, potential
[EMAIL PROTECTED] wrote Tuesday, January 09, 2007 7:21 PM
> Testing (only with IE, Firefox, Opera and Konqueror so far)
> I found no way how to circumvent the restrictions of *reading*
> requested pages from JS - setting up the request works, but
> attempts to read the document (embedded in an
phpBB (privmsg.php) XSS Exploit
By: Demential
Web: http://headburn.altervista.org
E-mail: [EMAIL PROTECTED]
PhpBB website: http://phpbb.com
Exploit tested on phpBB 2.0.21
Secunia.com said:
Input passed to the form field "Message body" in privmsg.php
is not properly sanitised before it is return
Calling a steganography software "Steganography" is quite presumptuous
in itself.(Like calling an encryption software "Cryptography".)
Without having looked into that matter deeper you are right on at least
one account: Leaving a signature ("footprint") in stego text is defeating
the purpose.
[EMAIL PROTECTED] goes to the police/traffic department at a
certain northwest USA software company.
[EMAIL PROTECTED] is the proper alias for security bugs.
:-)
Nick Boyce wrote:
On 1/7/07, Nicob <[EMAIL PROTECTED]> wrote:
[EMAIL PROTECTED] is the only standardized security contact (as
defi
==
# scripts : Jshop Server 1.3
# Discovered By : irvian
# script: http://www.jshop.co.uk/
# Thanks To : #hitamputih #nyubicrew #patihack
# special To: nyubi,ibnusina,arioo,jipank,kacung,trangkil,cah_gembl
there iz a fmt string vuln in xine-ui (specifically in errors.c func
errors_create_window() ) that can be used to maliciously execuute arbitary code
The following WMF exploit appeared on milw0rm today:
http://www.milw0rm.com/exploits/3111
The vulnerability is a result of the WMF parser passing a value from the file as
a pointer argument to the CreateBrushIndirect function. The function
dereferences the pointer and dies with an access violation
Computer Terrorism (UK) :: Incident Response Centre
www.computerterrorism.com
Security Advisory: CT09-01-2007
===
Microsoft Outlook Advanced Find - Remote Code Execution
===
Advisory Date:
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
___
Mandriva Linux Security Advisory MDKSA-2007:008
http://www.mandriva.com/security/
___
Another source is Secunia Vendor Database at
http://secunia.com/vendor/
including links to specific vendor product pages.
(example: http://secunia.com/vendor/4/ Adobe Systems)
which helps to find the official Web pages of the vendor and the product.
- Juha-Matti
Chris Wysopal <[EMAIL PROTECTE
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
___
Mandriva Linux Security Advisory MDKSA-2007:009
http://www.mandriva.com/security/
___
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
___
Mandriva Linux Security Advisory MDKSA-2007:007
http://www.mandriva.com/security/
___
[EMAIL PROTECTED] wrote:
> very easy, in fact in less than two minute. The problem is similar to
> the bug I found in PGP last year.
The bug you did *NOT* find in PGP last year. All you did was bypass a
sanity check and show that you could decrypt a file with the wrong password
and get garba
I've been subject to a few DoS attacks as of late so these did not quite
make it out. Enjoy the typos as usual. =P
-KF
DMA[2007-0109a] - 'Apple Finder Disk Image Volume Label Overflow / DoS'
Author: Kevin Finisterre
Vendor(s): http://www.apple.com
Product: '<= OSX 10.4 (?)'
References:
http://w
31 matches
Mail list logo
